ESMA to prioritise AI, tokenisation supervision in 2027

The European regulator said on Wednesday it will introduce digital innovation as a new Union Strategic Supervisory Priority (USSP), seeking to strengthen regulators' ability to oversee emerging technologies across EU financial markets.

The initiative will focus on how supervised financial firms use artificial intelligence and tokenisation, with ESMA working alongside national competent authorities to ensure supervisors have the expertise and capacity to oversee the technologies.

ESMA said digitalisation is rapidly reshaping financial markets, with firms increasingly using AI and tokenised products in day-to-day financial services as they seek to gain market share.

The regulator identified faster processes, lower operational costs, new products and services and greater integration of EU financial markets among the potential benefits of new technologies.

However, ESMA warned AI outputs could be biased, unclear or misleading, while increased use of these technologies could leave firms more dependent on a limited number of third-party providers. New products could also prove difficult for investors to understand or introduce new risks.

The new priority follows warnings from European financial regulators in August over risks posed by frontier AI models, with watchdogs calling for stronger governance as increasingly advanced models create new cyber and operational risks across the financial sector.

Supervisors to examine firms' AI use

From 2027, ESMA and national regulators will focus on areas where AI, tokenisation and other emerging technologies are being used by supervised firms to deliver core activities.

Authorities will map how firms already use or plan to use AI and tokenisation in products and processes that directly affect clients, going beyond the use of the technologies for back-office tasks.

Regulators will also conduct initial checks on a subset of firms considered most affected and identify where tokenisation is emerging in practice.

The programme will seek to develop common supervisory approaches and tools across the EU and build regulators' capacity to oversee emerging technology.

ESMA also wants firms to have robust governance when developing and deploying new technologies, including testing and data-quality checks, measures to mitigate bias and controls designed to ensure reliable outputs.

USSPs are used by ESMA to coordinate supervision across the EU on strategic issues and emerging risks. National authorities apply the priorities each year based on areas of focus established with ESMA, which reviews progress annually and identifies potential follow-up work.

Cyber supervision continues

The digital innovation push will operate alongside ESMA's existing USSP covering cyber and operational resilience, which was introduced in 2025 and is currently in its second year.

National authorities have expanded supervisory checks to cover more regulated firms and are increasingly using on-site inspections alongside exploratory and self-assessment tools.

The regulator said the emergence of advanced AI models with cybersecurity capabilities reinforced the need for firms to comply with the EU's Digital Operational Resilience Act and for authorities to develop common supervisory approaches.

In 2027, supervisors plan to expand the number of entities covered by this work, including smaller supervised firms and crypto-asset service providers, while increasing the use of on-site inspections. Authorities will also examine the impact of technologies including AI on cyber and digital operational resilience.

ESMA is meanwhile concluding its USSP covering environmental, social and governance disclosures, which was launched in 2023. The regulator said it and national authorities will continue work on ESG disclosures after the priority formally closes in 2026.

Earlier this month, ESMA and the Securities and Exchange Board of India signed an agreement aimed at restoring EU access to Indian clearing houses, allowing SEBI-regulated central counterparties to re-apply for recognition under European Market Infrastructure Regulation rules and establishing arrangements for regulatory cooperation and information sharing.