The European Union’s chief financial supervisory authority has announced that artificial intelligence (AI) and tokenisation will become central pillars of its regulatory agenda beginning in 2027. This strategic shift reflects a broader recognition that emerging digital technologies are reshaping the way financial services are designed, delivered, and consumed, and that the supervisory framework must evolve in step with these innovations to protect market integrity, consumer safety, and systemic stability. ### Why AI and Tokenisation Matter Artificial intelligence, encompassing machine learning models, natural language processing tools, and advanced analytics, is now embedded in a wide array of banking and investment products.

From algorithmic trading engines that execute orders at microsecond speeds to chatbots that field customer inquiries, AI is driving efficiency, personalization, and new revenue streams. However, the same capabilities also introduce novel risks: opaque decision‑making (the “black‑box” problem), model bias, data privacy concerns, and the potential for rapid propagation of errors across interconnected systems. Tokenisation, on the other hand, involves converting assets—whether fiat currency, securities, real‑estate holdings, or even intangible rights—into digital tokens that can be transferred and settled on distributed ledger technologies (DLTs).

Tokenised assets promise greater liquidity, lower transaction costs, and broader access to investment opportunities. Yet they also raise questions about custody, legal enforceability, anti‑money‑laundering (AML) compliance, and the resilience of underlying blockchain infrastructures. Together, AI and tokenisation represent a convergence of data‑intensive computation and novel asset representation. Regulators are therefore keen to understand how these tools are being used in client‑facing products, where the greatest exposure to consumers exists.

### Mapping the Landscape The first phase of the supervisory plan will involve a comprehensive mapping exercise. Financial institutions will be required to submit detailed inventories of AI‑driven applications and tokenised offerings that interact directly with end‑users. This includes: * **Retail banking chatbots and virtual assistants** – documenting the underlying models, training data sources, and escalation procedures. * **Credit‑scoring algorithms** – outlining how inputs such as transaction histories and alternative data are weighted, and how fairness is ensured.

* **Robo‑advisory platforms** – describing portfolio construction logic, risk‑adjustment mechanisms, and client disclosure practices. * **Tokenised securities and stablecoins** – providing information on token issuance protocols, smart‑contract audits, and the legal status of the underlying assets. * **Payment‑system tokenisation** – detailing how card‑details or bank‑account numbers are replaced by tokens for secure transactions.

By collecting this data, supervisors aim to identify which firms are most heavily reliant on these technologies and therefore present the highest supervisory interest. The mapping will also help to pinpoint gaps in current regulatory provisions, such as the need for model‑explainability standards or clearer guidance on the legal treatment of tokenised assets across member states.

### Targeted Supervisory Checks Once the mapping is complete, the regulator will initiate focused supervisory checks on the identified high‑impact entities. These checks will assess: 1. **Governance and risk management** – whether firms have robust oversight committees, clear accountability lines, and documented risk‑assessment procedures for AI and tokenisation projects.

2. **Model validation and monitoring** – the existence of continuous testing regimes to detect drift, bias, or performance degradation in AI models.

3. **Data quality and privacy** – compliance with GDPR and other data‑protection rules, as well as the integrity of datasets used to train AI systems.

4. **Transparency and client communication** – the adequacy of disclosures to customers regarding the use of AI in decision‑making and the nature of tokenised products. 5. **Operational resilience** – the ability of firms to maintain service continuity in the face of cyber‑attacks, smart‑contract failures, or unexpected market shocks.

Supervisors will employ a mix of on‑site inspections, desk‑based reviews, and, where appropriate, sandbox‑type testing environments that allow firms to demonstrate compliance in a controlled setting. ### Anticipated Regulatory Developments In parallel with the supervisory rollout, the EU is expected to refine its legislative framework. Potential initiatives include: * **AI Act extensions** – tailoring the risk‑based approach of the EU AI Act to cover financial‑sector specific use cases, such as credit underwriting and fraud detection.

* **MiCA (Markets in Crypto‑Assets) updates** – clarifying the status of tokenised assets that fall outside the traditional definition of crypto‑assets, ensuring they are subject to appropriate prudential rules. * **Digital Operational Resilience Act (DORA) enhancements** – incorporating requirements for AI model governance and blockchain infrastructure testing. These legislative moves aim to create a cohesive set of rules that align technology innovation with consumer protection and market stability.

### International Coordination Given the cross‑border nature of both AI models (often trained on global data sets) and tokenised assets (which can be transferred instantly across jurisdictions), the EU regulator will deepen cooperation with counterparts in the United States, United Kingdom, and Asia‑Pacific. Information‑sharing agreements and joint supervisory teams will help to harmonise supervisory expectations and avoid regulatory arbitrage.

### Implications for Financial Institutions For banks, asset managers, fintech firms, and other market participants, the upcoming supervisory focus signals several practical imperatives: * **Strengthen internal controls** – establish dedicated AI and tokenisation risk units, complete with expertise in data science, blockchain engineering, and regulatory compliance. * **Enhance documentation** – maintain up‑to‑date model cards, data lineage records, and token issuance whitepapers that can be readily inspected. * **Invest in explainability tools** – adopt techniques such as SHAP values or counterfactual analysis to make AI decisions more transparent to regulators and customers alike. * **Conduct regular audits** – engage independent third parties to verify smart‑contract code, model performance, and data protection measures.

* **Engage with regulators early** – participate in supervisory sandboxes and consultative forums to shape forthcoming rules and demonstrate proactive compliance. ### Looking Ahead By making AI and tokenisation a supervisory priority in 2027, the EU aims to strike a balance between fostering innovation and safeguarding the financial system. The mapping exercise will provide a clear picture of how these technologies are currently deployed, while targeted checks will ensure that firms adopt robust governance, risk, and transparency practices.

As the regulatory landscape evolves, financial institutions that embed responsible AI and tokenisation strategies into their core operations will be better positioned to thrive in a digitally driven market. In summary, the upcoming supervisory agenda represents a decisive step toward a future where advanced technologies are integrated safely and responsibly into the fabric of European finance, protecting consumers, preserving market integrity, and encouraging sustainable innovation.