The Pulse
ESMA Makes AI Supervision an EU Priority From 2027
The European Securities and Markets Authority will make digital innovation a Union Strategic Supervisory Priority from 2027. Its initial work will examine how supervised financial firms use artificial intelligence and tokenisation.
AI.info Team ·
The European Securities and Markets Authority will put artificial intelligence under a new EU-wide supervisory priority from 2027, placing oversight of financial firms’ use of AI alongside existing work on cyber and operational resilience.
ESMA announced the decision on September 23, 2026, saying its new digital innovation priority will seek to give supervisors the expertise and capacity to oversee new technologies while protecting investors. The authority’s first areas of attention will be artificial intelligence and tokenisation, with room to add other technologies as they develop.
The decision sets up a tension that financial regulators across Europe are already confronting: firms are adopting systems that may improve analysis, trading and operations, while supervisors must assess risks that can change faster than established controls. ESMA’s announcement places the responsibility for that assessment on coordinated supervision rather than on a single new rule.
AI and tokenisation move into ESMA’s supervisory program
The new initiative is a Union Strategic Supervisory Priority, or USSP. ESMA describes USSPs as convergence tools used to direct supervisory resources toward high-risk issues affecting investor protection, financial stability and the orderly functioning of EU financial markets.
Under the digital innovation USSP, ESMA will work with national competent authorities to examine how supervised entities use AI and tokenisation. The authority does not limit the program to one model type or one financial product. It says the work will remain flexible as new technologies emerge.
That wording gives national supervisors a framework for common attention without prescribing a single technical method. Firms operating across several EU markets can expect the subject to be discussed through coordinated supervisory work, while the announcement leaves the detailed activities and assessments to the program that begins in 2027.
Frontier AI links the new priority to operational risk
ESMA will run the digital innovation priority alongside its USSP on cyber and operational resilience, which has been in place since 2025. The authority specifically identifies advanced systems, including frontier AI, as a source of challenges that will require continued coordination.
The connection is not theoretical. In a July 31, 2026 statement, ESMA joined the European Banking Authority and the European Insurance and Occupational Pensions Authority in calling for a cross-sectoral, risk-based approach to information and communications technology risks associated with frontier AI models. The authorities highlighted prevention, detection and management of cyber risks, as well as governance and risk-management frameworks for financial entities.
That earlier statement focused on resilience against risks tied to frontier models. The new USSP broadens the supervisory lens to digital innovation generally, with AI as one of its first areas and tokenisation as the other. The two strands give ESMA a way to examine both how firms deploy technology and how those deployments could affect their ability to operate safely.
ESG priority ends as digital innovation begins
ESMA also says it is concluding its USSP on ESG disclosures this year. The ESG program began in 2023 and was intended to improve the quality of sustainability information and the advice investors receive from financial firms.
Its replacement by a digital innovation priority does not remove ESG disclosure from the authority’s remit. ESMA says sustainability remains a long-term undertaking, but its strategic supervisory resources will shift toward technology from 2027.
The change creates a clearer sequence in ESMA’s supervisory agenda. ESG disclosures move out of the priority cycle after three years, cyber and operational resilience continues, and digital innovation becomes the new focus for coordinated work with national authorities.
What the announcement does—and does not do
ESMA’s decision is a supervisory coordination measure, not a new artificial intelligence statute. The announcement does not set out new compliance deadlines, technical standards or penalties for particular uses of AI. Instead, it establishes the subject as a common priority for regulators and signals that supervisory expertise will need to keep pace with firms’ technology choices.
The next concrete step is the launch of the digital innovation USSP in 2027. ESMA’s accompanying factsheet on Union Strategic Supervisory Priorities sets out the wider priority framework, while its July statement with the other European supervisory authorities provides the existing reference point for frontier-AI and ICT-risk oversight.
For financial firms, the immediate message is specific: AI and tokenisation will be among the first technologies examined through coordinated EU supervision, and frontier AI will remain tied to expectations around governance, cyber risk and operational resilience.