Loading article...
EU supervisors will map client-facing uses of AI and tokenization and begin checks on selected firms, alongside wider digital-resilience supervision of crypto service providers.
European Commission representation office with EU flags in Paris. Photo: Richardprins via Wikimedia Commons (CC0). Source
The European Securities and Markets Authority announced on September 23 that artificial intelligence and tokenization will be the initial focus of a new EU supervisory priority starting in 2027. Under the program, national regulators will map how financial firms use those technologies in activities affecting clients and begin checks on selected businesses, according to ESMA's announcement and its accompanying factsheet.
Called "Innovation with investor safeguards," the initiative is a Union Strategic Supervisory Priority, or USSP. It directs supervisory attention and resources across authorities. The announcement does not adopt a new tokenization law or identify firms against which ESMA has made findings of misconduct.
The eight-page factsheet explains that ESMA selects up to two strategic priorities every three years. National competent authorities, together with ESMA where it supervises firms directly, then work annually on agreed areas. ESMA reviews the work and possible follow-up once a year. The framework moves incrementally from setting objectives to deeper supervision and eventually embedding the resulting practices.
For 2027, the authority distinguishes core financial activities from back-office technology. Supervisors are to examine processes and products that directly affect client outcomes, including planned uses of AI and tokenization. CoinDesk's reporting also identifies governance, reliable data and customer outcomes as the focus of the new program.
The factsheet sets out several concrete tasks. Authorities will identify where tokenization is emerging in practice, assess the staff and tools they need, and begin developing common approaches. They will engage with the market about possible benefits, examine information provided to investors and share examples of technology improving investor experiences.
Initial checks will cover a subset of the most affected firms. Neither the published plan nor the announcement supplies the names of that subset or a firm-by-firm inspection timetable. The mapping exercise includes technologies already in use and those firms intend to deploy, so it is broader than a review of products that have already launched.
ESMA identifies four areas of risk: supervisors lacking suitable skills and tools; AI producing biased, unclear or misleading outputs; products investors may struggle to understand; and dependence on a small number of technology suppliers. Its proposed outcomes include testing, data-quality checks, reliable outputs and governance aligned with clients' interests. Unchained's account describes the same combination of market mapping and early supervisory checks.
The plan also recognizes possible benefits, including faster processes, lower operating costs, improved access to information and more connected EU markets. These are opportunities ESMA wants authorities to assess alongside the risks. They are not findings that every AI tool or tokenized product already delivers those results.
The digital-innovation priority will run alongside the cyber and operational resilience USSP launched in 2025. That work focuses on digital resilience and compliance with the Digital Operational Resilience Act, known as DORA. ESMA says increasingly advanced AI models with cybersecurity capabilities add to the need for coordination and effective supervision.
In 2027, the resilience program's next steps include expanding coverage to smaller supervised entities and crypto-asset service providers. Authorities are also expected to increase on-site inspections, improve the use and quality of incident data, and exchange information about findings and root causes. The factsheet describes work already conducted on governance, incident management, testing and third-party risks.
These two tracks address different questions. The innovation program examines how firms develop and use technologies in financial services; the resilience program examines their capacity to withstand and manage digital disruption. The same firm may therefore be relevant to both without either program amounting to a new product authorization.
ESMA is closing its separate ESG-disclosures USSP in 2026 after launching it in 2023. The announcement says work on sustainability information will continue, while the new digital-innovation priority can be adjusted to address further technological developments.