ESMA's new supervisory priority from 2027: AI and tokenisation under the spotlight

On 23 September 2026 ESMA said it will launch a new Union Strategic Supervisory Priority (USSP) on digital innovation. The aim is to make sure supervisors have the expertise and capacity to oversee the use of new technologies. Working with national competent authorities, ESMA will start with how supervised entities use AI and tokenisation, and will stay flexible enough to cover other technologies as they emerge. In its factsheet ESMA describes the new priority as innovation with investor safeguards, due to start in 2027.

ESMA's 2027 annual work programme (ESMA22-50751485-1673, dated 28 September 2026) places the new USSP in the retail investor space: it is meant to support innovation and the better investor outcomes that new technologies may bring, while keeping investor protection adequate.

The new priority runs alongside the USSP on cyber and operational resilience, in place since 2025; 2027 will be the third year of that priority and of the application of DORA. The USSP on ESG disclosures, launched in 2023, closes in 2026.

USSPs are priorities that ESMA sets at EU level to direct supervisors' resources towards high-risk areas that need EU-wide attention. Every three years ESMA identifies up to two of them. National competent authorities, and ESMA where it supervises directly, apply them: each year every authority works on the USSP topic, within areas of focus and parameters set with ESMA, and ESMA takes stock of the work once a year.

CySEC, as a national competent authority, applies ESMA's USSPs, so the new priority will feed into its supervisory work from 2027 alongside the cyber and operational resilience priority.

According to ESMA's factsheet, in 2027 authorities will focus on areas where AI, tokenisation and other emerging technologies may be used by supervised entities to deliver core activities. The work is organised around three outcomes: supporting innovation; supervisory readiness; and governance, quality and client interests.

In the first year supervisors are to engage with the market on potential benefits, explore the information firms give investors and share examples of innovation that improved investor outcomes; identify where technologies such as tokenisation are emerging in practice and build up their own capacity; and map how firms use, or plan to use, AI and tokenisation in processes and products that directly affect client outcomes, beyond back-office tasks, and run initial checks on a subset of the most affected firms.

The risks ESMA lists are fairness (AI outputs may be biased, unclear or misleading), investor protection (new products may be hard to understand or create new risks), over-reliance (dependence on a small number of third-party providers) and supervisory readiness. The outcome sought from firms is robust governance and client-aligned outcomes when they develop and deploy new technologies, supported by testing, data-quality checks, bias mitigation and reliable outputs. ESMA's work programme adds that it will identify AI use cases through periodic national surveys, which ESMA aggregates.

Nothing new applies yet, and existing rules already cover AI. In a public statement of 30 May 2024 ESMA said it expects firms using AI to provide investment services to retail clients to comply with MiFID II, in particular its organisational requirements, conduct of business rules and the duty to act in the client's best interest. It named algorithmic bias and data quality, opaque decision-making, over-reliance on AI, and privacy and security as the main risks.

Firms can get ahead of the mapping exercise by keeping an inventory of AI tools and tokenised products that touch clients, for example in investment advice, portfolio management, onboarding and suitability, client communications and marketing, with a named owner for each. For each use, compliance should be able to show who approved it, how it was tested, how data quality and bias are checked, what clients are told and how staff can override the output. For the MiFID II basics, see our study note on organisational requirements.

Under the cyber and operational resilience priority, supervisors will also look at the impact of AI on digital operational resilience and at the quality of DORA registers of information, so reliance on outside AI providers should be visible there. In July 2026 the European Supervisory Authorities also asked financial entities to have robust governance and risk management for cyber risks linked to frontier AI models. Firms offering tokenised instruments should be ready to explain how each asset is classified: ESMA will keep monitoring the consistent classification of DLT-based assets under MiFID II, MiCA and the DLT Pilot Regime.