ESMA Targets AI and Tokenization for EU Regulation Starting in 2027

Europe’s markets watchdog is coming for fintech’s two hottest buzzwords. The European Securities and Markets Authority — ESMA — has locked in artificial intelligence and tokenization as its next big supervisory push, with national regulators across the EU set to get to work on both starting in 2027.

The plan sits inside ESMA’s Union Strategic Supervisory Priority framework, known as the USSP. It’s basically the mechanism ESMA uses every three years to pick up to two issues that need coordinated, EU-wide attention — things that one country can’t really tackle alone because the risks bleed across borders. And right now, the authority thinks AI and tokenization are exactly those kinds of risks. National regulators will start by mapping out where firms are actually using these technologies on the client-facing side. Then they’ll pull a subset of those firms in for closer checks, trying to understand how AI and tokenized products are being woven into services that touch real investors.

Not a small task.

The risks ESMA has already flagged are pretty concrete. Biased or misleading AI outputs are one. Investors potentially misunderstanding complex tokenized products is another. Both of those are live problems — not hypothetical ones — and the authority seems well aware that the industry isn’t going to slow down and wait for regulators to catch up. So the mapping exercise is partly about building internal expertise among supervisors who, frankly, may not yet have deep familiarity with how these tools actually work inside financial firms.

Where This Fits in ESMA’s Broader Agenda

The new AI and tokenization priority won’t be starting from scratch. It slots in alongside an existing USSP on cyber and operational resilience, which kicked off in 2025 and is still running. So national regulators are already in the habit of coordinating on tech-related systemic risk. Adding AI and tokenization to that mix seems like a natural extension, though the workload is clearly growing.

At the same time, ESMA is wrapping up its current priority on environmental, social, and governance disclosures. That one’s closing out this year. So there’s a handoff happening — ESG gets wound down, AI and tokenization ramp up. It’s a pretty clear signal about where the authority thinks the next wave of investor risk is coming from.

One thing supervisors will look at closely: what firms are actually telling investors about these technologies. Not just the fine print, but whether the communication is genuinely informative or whether it’s the kind of vague, jargon-heavy disclosure that leaves ordinary investors more confused than informed. ESMA wants supervisors to push for transparency and reliability — and to share examples of innovations that have genuinely improved investor outcomes, reduced biases, and delivered consistent results.

More context: Ondo Finance Revolutionizes Tokenization, Allowing Direct Stock Swaps for Institutions

Third-Party Providers in the Crosshairs

There’s a specific concern buried in the agenda that’s worth flagging. ESMA is looking at how much firms lean on third-party providers for their AI and tokenization infrastructure. If a small number of vendors end up dominating the market — supplying the core AI tools or tokenization platforms that dozens or hundreds of firms rely on — that creates concentration risk. One provider goes down, or gets it wrong, and the knock-on effects could be wide. Regulators want to map those dependencies early, before they become a structural vulnerability.

That’s actually a fairly sophisticated worry. It’s not just about whether an individual firm’s AI is biased. It’s about whether the whole sector is quietly building on a handful of shared foundations that nobody’s really stress-tested at scale.

And that’s kind of the bigger picture here. ESMA isn’t just trying to police bad actors. It’s trying to understand a fast-moving landscape before it hardens into something harder to fix. By coordinating across national regulators rather than letting each country figure it out separately, the authority is betting that a common framework will produce more consistent oversight — and fewer gaps that firms can slip through.

The checks on individual firms will also feed back into that bigger picture. Data from a subset of companies, gathered early, gives supervisors a clearer read on how widespread certain practices are, where the real risks are concentrating, and what best practices actually look like in the field. It’s probably the most practical way to build regulatory knowledge fast in an area where the technology is moving faster than the rulebooks.

Related: ECB Aims to Scrap Bank Deposit Requirement for Stablecoin Issuers Under MiCA

No specific firm names have been attached to the initiative yet. The 2027 start date gives national regulators time to prepare, but the mapping work — figuring out which firms to examine and how — presumably starts well before that.

ESMA plans to share examples of successful innovations that have delivered measurable benefits for investors, as a way of illustrating what good looks like alongside the enforcement side of the work.