EU markets regulator ESMA sets a 2027 supervisory priority on digital innovation, starting with AI and tokenisation

The European Securities and Markets Authority (ESMA), the EU's financial markets regulator and supervisor, said on 23 September 2026 that it "will launch a new Union Strategic Supervisory Priority (USSP)" on digital innovation, with an "initial focus" on "how supervised entities use artificial intelligence and tokenisation". A factsheet published alongside the announcement says the priority is due "to start in 2027".

What a supervisory priority is

ESMA's factsheet says it promotes "consistent and effective supervision across the EU through supervisory convergence", and USSPs are one of its tools for doing so. In the factsheet's words, USSPs are "priorities set by ESMA at the EU level on strategic topics" that "drive supervisors' agendas".

According to the factsheet:

• "Every three years, ESMA identifies up to two priorities that are relevant across the EU and reflect emerging developments and trends."
• National competent authorities (NCAs), and ESMA in its own direct supervision where applicable, apply them, so that "each year all authorities will work on the relevant USSP topic based on areas of focus and parameters established with ESMA."
• "ESMA takes stock once a year on the work done and possible areas of follow-up."

The press release describes USSPs as "convergence tools that address high-risk areas of strategic importance across the EU", which "help direct supervisory resources towards the risks that matter most".

What ESMA announced

The factsheet calls the new priority Innovation with Investor Safeguards, with the objective to "harness rapid technological trends to optimise outcomes while ensuring investor protection". The press release says it "aims to ensure supervisors have the expertise and capacity to oversee the use of new technologies", adding: "We will remain flexible to address future technological developments as they emerge." The factsheet likewise says the priority "may look at different technologies and market practices across time".

It will run alongside the existing USSP on cyber and operational resilience, "which has been in place since 2025", according to the release. ESMA also said it is concluding its USSP on ESG disclosures this year.

What ESMA says about AI

The factsheet's case for the priority is that "Firms are increasingly using AI and tokenised products in day-to-day financial services to gain market share" and that "Technological innovation brings benefits but also risks."

Among the risks it lists:

• Fairness: "AI outputs may be biased, unclear or misleading."
• Over-reliance: "New technologies, such as AI, may create increased dependency on a limited number of third-party providers."
• Readiness: "Supervisors need the right skills and tools."
• Investor protection: "New products may be hard to understand or create new risks for investors."

It also lists opportunities, including "Easier access to information, financial products and services" and "Faster processes and lower operational costs".

Of its three targeted outcomes, the third covers firms directly: "Ensuring firms have robust governance and client-aligned outcomes in their organisation when developing and deploying new technologies", "Undertaking testing and data quality checks" and "Mitigating bias and ensuring reliable outputs." The other two are supporting innovation and supervisory readiness.

What supervisors will do in 2027

The factsheet says: "In 2027, authorities will focus on areas where AI, tokenisation and other emerging technologies may be used by supervised entities to deliver core activities." It defines authorities as national competent authorities and ESMA in its direct supervision, "as applicable". The next steps it lists, under its three headings, are:

• Supporting innovation: "Engage with the market on potential benefits." "Explore information that firms deliver to investors." "Share among supervisors examples of use cases where innovation has made a positive difference to investor experiences and outcomes."
• Supervisory readiness: "Identify where new technologies such as tokenisation are emerging in practice." "Determine capacity needs and start building on them." "Start identifying supervisory approaches and best practices."
• Governance, quality and client interests: "Map how firms already use or plan to use AI/tokenisation in processes and products that directly impact clients' outcomes (i.e. beyond back-office tasks)." "Run initial checks on a subset of the most impacted firms."

In the factsheet, tokenisation appears in these steps and in the priority's rationale; ESMA does not set out a separate list of tokenisation risks.

Frontier AI and cyber resilience

On the ongoing cyber priority, the release says ESMA will "continue our efforts and coordination to address the challenges ahead, including those emerging from advanced models such as frontier AI." The factsheet says "The emergence of highly advanced AI models with cybersecurity-related features underscores the importance for firms to ensure compliance with the Digital Operational Resilience Act (DORA)" requirements. Separately, on 31 July 2026, ESMA and the other two European Supervisory Authorities published a joint statement "calling for a cross-sectoral, risk-based and consistent supervisory approach to mitigate the ICT risks stemming from frontier AI models."

Why it matters

On our reading, the announcement does not create new rules for firms. It sets where EU supervisors are expected to point their effort from 2027. The factsheet's next steps include supporting innovation and building supervisory capacity, as well as mapping how firms already use or plan to use AI and tokenisation in processes and products that directly affect clients, and running "initial checks on a subset of the most impacted firms". None of the ESMA documents we read mention the UK.