Last updated: 01.10.2026

The European Securities and Markets Authority (ESMA), will launch a new Union Strategic Supervisory Priority (USSP) in 2027, to make sure that the National Competent Authorities (NCAs) are prepared for the potential risks of highly advanced AI tools and tokenization through the use of supervised entities to protect investors and prevent over-dependency on certain service providers, while supporting the benefits of technological innovation.

As a basis for this USSP and in accordance with EU AI regulatory developments, ESMA surveyed 728 financial market participants across 19 EU Member States—including credit institutions providing investment services, investment firms, credit rating agencies, investment managers—published a report this year, namely “AI adoption and trends in securities markets: EU evidence”.[1]

Table of Contents:

1.       Key Highlights from ESMA AI report

2.       ESMA Announces New USSP: Technological Innovation With Investor Safeguards

3.       Focus On Four Key Risks and Important Roles of National Competent Authorities

4.       Running in Parallel with Cyber and Operational Resilience Priority

5.       Strategic Goal and Forward-Looking Approach of ESMA – Digital Trends and Emerging Risks

Key Highlights from ESMA AI report

ESMA summarizes in its report that AI adoption in the EU financial sector remains partial and uneven, with smaller firms lagging behind larger ones in terms of investment, deployment, expected efficiency gains, as well as the ability to develop models and leverage internal data. Within the size criteria defined by ESMA, this discrepancy is supported by the figure that the lack of adoption is particularly pronounced among micro firms, 65% of which have no active or planned AI use cases, while large firms are at the forefront of AI deployment, with 96% either already using AI or planning to do so. However, regardless of size, firms’ sentiment on AI appears to be trending upward across the board, with 70% of firms anticipating an increase in AI-related investment.

The report also shows that AI is mainly used to automate support tasks —including drafting/summarising information, data processing, internal assistance and translation—based on the reported use cases, of which 87% are internal only, while 10% are client-facing, with limited use in core investment tasks.

ESMA concludes in its report that:

· AI adoption in EU securities markets has been gradual and uneven.

· The most widespread applications are in back-office activities.

·  Safeguarding the reliability of AI infrastructure is likely to become ever more important for policymakers.

·  Ability to harness AI is one of the key innovation drivers in the global and European financial industry.

ESMA Announces New USSP: Technological Innovation With Investor Safeguards

ESMA announced new USSP considering that digitalisation is bringing a rapid reshaping of how financial markets operate and firms are exploring and starting to invest in AI—not only in back-office staff, but also in client-facing tools— to gain more market share. It seems that supervisors should keep pace with these developments in an agile manner. However, while giving flexibility to the market to increase their operational efficiency with lower costs, where applicable, it is important for the competent authorities to remain closely watchful of the risks it brings to protect the investors’ right and the stability of the market.[2]

Focus On Key Risks and Important Roles of National Competent Authorities

While ESMA identifies in its supervisory priority factsheet the key risks as supervisor readiness, biased or misleading AI outputs, new risks for investors, and over-reliance on service providers, firms also appear to be aware of similar risks and challenges associated with AI, according to the survey results. Data- and model-related issues are the most frequently cited risks, with 82% of respondents identifying at least one data-related challenge, and model hallucinations remain a concern for the majority (51%). Respectively, 46% and 37% of firms are concerned about cyber risks and reliance on providers—two mutually reinforcing operational vulnerabilities with potential systemic implications.

The President of the ECB and Chair of the European Systemic Risk Board (ESRB), Christine Lagarde, highlighted three critical areas where AI could disrupt the financial system: market trading, cyber resilience, and geopolitics, at the annual conference of the ESBR on 1 October 2026.[3]

She warned that autonomous AI agents in financial market trading might pursue goals in ways human overseers neither intended nor could detect, raising concerns over market manipulation and price distortion. Addressing cyber resilience, the ECB chief stressed that recent frontier AI models possess advanced capabilities that allow automated attacks to escalate from an initial breach to widespread exploitation in hours rather than weeks.

Considering the same anticipation of AI and concerns about it from both parties, it should be expected that the NCAs regulate this area in line with market needs and limited capacity or capability.

Running in Parallel with Cyber and Operational Resilience Priority

The technological innovation priority will run in parallel with the USSP on cyber and operational resilience, which has already been in place since 2025.  Technological innovation brings benefits but also risks. One of the key risks is over-reliance, as new technologies may create increased dependency on a limited number of third-party providers. According to ESMA’s AI adoption report, most surveyed firms (62%) rely exclusively on commercial cloud solutions for AI infrastructure and firms’ reliance on a small number of AI infrastructure providers may create third-party dependencies that warrant monitoring due to the potential operational risk they pose.

From the cybersecurity aspect, the emergence of AI use will bring enhanced cyber risks, for which firms should ensure compliance with the Digital Operational Resilience Act (DORA).

Strategic Goal and Forward-Looking Approach of ESMA – Digital Trends and Emerging Risks

ESMA is committed in its 2027 workplan to continuously monitoring developments in AI and its applications in financial markets, building on its mandate and in close collaboration with NCAs. The identification of AI use cases in supervised markets via periodic national surveys, hosting use case discussions within relevant committees, and using supervisory convergence tools to promote consistent regulatory interpretation and treatment will be the most important staff going forward.[4]

For the next steps, the authorities are expected to focus on areas where AI, tokenisation and other emerging technologies may be used by supervised entities to deliver core activities, within the approach to supporting innovation, identifying supervisory approaches and best practices, mapping firms’ use of AI directly impacting clients, and running initial audits.

References:

[1] https://www.esma.europa.eu/sites/default/files/2026-02/ESMA50-48136992630599_TRV_Risk_Analysis_AI_adoption_and_trends_in_securities_markets.pdf

[2] Union strategic supervisory priorities

[3]https://www.ecb.europa.eu/press/key/date/2026/html/ecb.sp261001~cf3c630379.en.html

[4] ESMA22-50751485-1673 Annual Work Programme 2027