EU Financial Regulator Sets AI and Tokenisation as Top Supervisory Focus for 2027

In a decisive move that signals the European Union’s commitment to staying ahead of technological disruption in the financial sector, the continent’s chief financial regulator has announced that artificial intelligence (AI) and tokenisation will become the central pillars of its supervisory agenda beginning in 2027. This strategic shift reflects a growing recognition that both AI-driven solutions and token‑based assets are reshaping how banks, insurers, asset managers, and other financial service providers design, deliver, and manage products for their customers.

**Why AI and tokenisation matter now** Artificial intelligence has already permeated many aspects of modern finance, from algorithmic trading and credit‑scoring models to chat‑bots that handle routine customer inquiries. The speed, scale, and predictive power of AI tools enable firms to automate complex decision‑making processes, personalise offerings, and improve operational efficiency. Yet, the same capabilities also raise concerns about model opacity, bias, data privacy, and systemic risk.

When AI systems make critical lending or investment decisions, any hidden flaws can propagate across markets, potentially amplifying shocks. Tokenisation, on the other hand, refers to the process of converting real‑world assets—such as securities, real estate, or commodities—into digital tokens that can be transferred, traded, or stored on distributed ledger technologies (DLTs). By breaking down assets into smaller, more liquid units, tokenisation promises to democratise access to investment opportunities, reduce settlement times, and lower transaction costs. However, the novelty of tokenised instruments also introduces regulatory gaps, questions about custody, legal enforceability, and the adequacy of existing anti‑money‑laundering (AML) frameworks.

**The regulator’s roadmap** The supervisory authority will undertake a two‑phase approach. In the first phase, it will map out how financial institutions embed AI and tokenisation within client‑facing products. This mapping exercise will involve a comprehensive survey of banks, fintech firms, and asset managers to capture details such as: 1. The specific AI models used (e.g., machine‑learning classifiers, natural‑language processing engines, reinforcement‑learning agents).

2. The data sets that feed these models, including the sources, quality controls, and consent mechanisms. 3.

The tokenised assets currently offered, the underlying blockchain platforms, and the governance structures overseeing token issuance and redemption. 4. The risk‑management frameworks that firms have instituted to monitor model performance, mitigate bias, and ensure token security.

The second phase will consist of targeted supervisory checks on the sectors and firms identified as most exposed to AI‑related or tokenisation‑related risks. These checks will be risk‑based, meaning that entities with high‑volume AI‑driven credit decisions or extensive tokenised product portfolios will face deeper scrutiny.

The regulator plans to use a combination of on‑site inspections, data‑analytics tools, and thematic reviews to assess compliance with existing EU directives such as the Markets in Financial Instruments Directive (MiFID II), the General Data Protection Regulation (GDPR), and the upcoming Digital Finance Package. **Key supervisory priorities** 1. **Model Transparency and Explainability** – Supervisors will demand that firms provide clear documentation on how AI models reach conclusions, especially when those conclusions affect consumer rights or market stability.

This includes maintaining model cards, data lineage records, and post‑deployment monitoring dashboards. 2. **Bias and Fairness** – Institutions must demonstrate that their AI systems do not systematically disadvantage protected groups. The regulator will expect regular bias audits, the use of fairness metrics, and remediation plans for identified issues.

3. **Data Governance** – Robust data‑handling practices will be essential. Firms need to prove that data used for training AI is accurate, up‑to‑date, and obtained with appropriate consent, aligning with GDPR’s stringent standards.

4. **Token Custody and Security** – For tokenised assets, the focus will be on safeguarding private keys, ensuring that custodial arrangements meet capital adequacy requirements, and that smart contracts governing tokens are free from vulnerabilities.

5. **Legal Certainty and Consumer Protection** – The regulator will scrutinise the contractual terms attached to tokenised products to ensure they are clear, enforceable, and that investors receive adequate disclosures about risks, liquidity, and redemption rights. 6. **Systemic Risk Monitoring** – By aggregating data from multiple firms, supervisors aim to detect emerging patterns that could signal broader market instability, such as correlated AI model failures or rapid token‑driven capital flows.

**Implications for market participants** Financial firms should view the upcoming supervisory emphasis as both a compliance challenge and an opportunity to strengthen their governance frameworks. Proactive steps include: - Conducting internal audits of AI models to identify blind spots and document mitigation strategies.

- Investing in explainable‑AI (XAI) technologies that make model decisions more interpretable for regulators and customers alike. - Establishing clear tokenisation policies that outline issuance procedures, investor rights, and redemption mechanisms. - Enhancing cyber‑security measures around blockchain infrastructure, including multi‑factor authentication, hardware security modules, and regular penetration testing.

- Engaging with industry consortia and standard‑setting bodies to shape best‑practice guidelines that align with regulatory expectations. **Looking ahead** The 2027 supervisory focus on AI and tokenisation is part of a broader EU ambition to foster a digital finance ecosystem that is innovative, resilient, and consumer‑centric.

By setting clear expectations now, the regulator aims to reduce the likelihood of regulatory arbitrage, protect market integrity, and ensure that technological advances translate into tangible benefits for European citizens. Stakeholders are encouraged to start dialogue with the supervisory authority early, share their implementation roadmaps, and seek guidance on compliance pathways.

As the regulatory landscape evolves, continuous learning and adaptation will be essential for firms that wish to harness AI and tokenisation responsibly while maintaining the trust of regulators, investors, and the public. In summary, the EU’s decision to elevate AI and tokenisation to a supervisory priority underscores the transformative impact these technologies have on finance. Through systematic mapping, risk‑based inspections, and a focus on transparency, fairness, and security, the regulator aims to create a balanced environment where innovation can thrive without compromising stability or consumer protection.