The European Union’s principal financial supervisory authority has announced that artificial intelligence (AI) and tokenisation will become central pillars of its supervisory agenda beginning in 2027. This strategic shift reflects the rapid adoption of advanced digital tools across banking, insurance, asset management and other financial sectors, as well as growing concerns about the systemic risks, consumer protection issues, and market integrity challenges that these innovations may pose. In practical terms, the regulator plans to develop a comprehensive mapping exercise that will catalogue how banks, fintech firms, investment houses and other financial entities are integrating AI algorithms and token‑based solutions into products that are directly offered to clients.
This mapping will not merely list the technologies in use; it will assess the purpose of each application, the data flows involved, the decision‑making logic embedded in AI models, and the extent to which tokenisation is used for settlement, collateralisation, or the creation of digital assets. By creating a detailed inventory, supervisors will be better equipped to identify patterns of risk concentration, detect potential gaps in existing regulatory frameworks, and design targeted supervisory interventions.
One of the first concrete steps will be the rollout of supervisory checks focused on the firms that are most heavily reliant on these technologies. The regulator intends to prioritize institutions that have already launched AI‑driven credit‑scoring engines, robo‑advisory platforms, automated compliance monitoring tools, or that have issued tokenised securities, stablecoins, or other digital representations of assets.
These checks will evaluate whether the firms have robust governance structures, transparent model documentation, and adequate risk‑management controls in place. For AI systems, particular attention will be given to model explainability, bias mitigation, data quality, and the existence of human‑in‑the‑loop oversight mechanisms. For tokenisation projects, supervisors will examine the legal status of the tokens, the custody arrangements, the resilience of underlying blockchain infrastructures, and the adequacy of anti‑money‑laundering (AML) and counter‑terrorist‑financing (CTF) safeguards.
The regulator’s approach is informed by a broader EU policy context that includes the Digital Finance Package, the Artificial Intelligence Act, and the Markets in Crypto‑Assets (MiCA) Regulation. While the AI Act sets out a risk‑based regime for high‑impact AI systems, and MiCA provides a harmonised framework for crypto‑assets, the supervisory authority’s 2027 agenda aims to bridge the gap between these legislative instruments and day‑to‑day supervisory practice.
By aligning supervisory priorities with the legislative timeline, the authority hopes to ensure that firms are not caught off‑guard by compliance obligations and that market participants enjoy a level playing field. Stakeholder engagement will be a key component of the rollout. The regulator has pledged to hold a series of workshops, round‑table discussions and public consultations with industry participants, consumer advocacy groups, academic experts and technology providers. These dialogues will serve to refine the mapping methodology, clarify expectations around model validation and token issuance, and gather feedback on practical challenges that firms encounter when implementing AI or tokenisation solutions.
The regulator also intends to publish guidance documents that outline best‑practice standards for model risk management, data governance, and the design of token structures that comply with existing securities law. From a consumer protection perspective, the supervisory focus on AI and tokenisation is expected to enhance transparency and fairness in financial services.
For instance, AI‑driven credit decisions that previously operated as opaque “black boxes” will be subject to scrutiny to ensure that they do not discriminate against protected groups or produce unjustified adverse outcomes. Similarly, tokenised products that are marketed to retail investors will be examined for clear disclosure of risks, liquidity characteristics, and the rights attached to the digital tokens. By enforcing higher standards of information provision, the regulator aims to empower consumers to make informed choices and to reduce the likelihood of mis‑selling or fraud.
The regulator also acknowledges the cross‑border nature of many AI and tokenisation initiatives. Many financial institutions operate in multiple EU member states, and blockchain networks often span jurisdictions. To address this, the supervisory authority will coordinate closely with national competent authorities, the European Banking Authority (EBA), the European Securities and Markets Authority (ESMA) and the European Insurance and Occupational Pensions Authority (EIOPA). This collaborative framework will facilitate the sharing of supervisory findings, the harmonisation of supervisory expectations, and the joint handling of cross‑border investigations when necessary.
In addition to the immediate supervisory actions slated for 2027, the regulator is laying the groundwork for a longer‑term supervisory ecosystem that can adapt to future technological developments. This includes investing in its own analytical capabilities, such as building in‑house expertise on AI model auditing, blockchain forensics, and data‑analytics tools that can process large volumes of transaction data in real time. The authority also plans to develop a sandbox environment where firms can test innovative AI or tokenisation projects under supervisory observation before full market deployment.
Such sandboxes will help regulators gain early insight into emerging risks while allowing firms to refine their solutions in a controlled setting. Overall, the decision to elevate AI and tokenisation to a supervisory priority signals the EU’s commitment to fostering a safe, innovative, and competitive financial ecosystem.
By mapping usage, focusing checks on the most impacted firms, engaging stakeholders, and strengthening supervisory tools, the regulator aims to mitigate risks without stifling the transformative potential of these technologies. The 2027 timeline provides a clear horizon for market participants to align their strategies with regulatory expectations, ultimately contributing to a more resilient and trustworthy financial market across Europe.