On 23 September 2026, the European Securities and Markets Authority (ESMA) announced a new Union Strategic Supervisory Priority (USSP) on digital innovation, starting in 2027. National regulators will coordinate how they supervise the way EU financial firms use artificial intelligence and tokenisation. For fintech and crypto platforms this is the most concrete signal yet of how EU supervisors plan to approach these technologies. The design choices are sensible. The risk is in how it is executed.
What ESMA actually announced
A USSP is a supervisory convergence tool: ESMA picks a high-risk area of strategic importance and national competent authorities (NCAs) align their supervisory work around it. According to Cointelegraph's account of the factsheet, supervisors will identify where tokenisation is emerging, document how firms use or plan to use AI and tokenisation in products and processes that affect investors, and run initial checks on a subset of the most affected firms. They will also review what firms tell investors about these technologies and share examples of innovations that improved investor outcomes and reduced bias.
The same report lists three risks: biased or misleading AI outputs, products investors may struggle to understand, and reliance on a limited number of third-party providers. ESMA's own release frames the aim as helping to "embrace innovation while protecting investors and maintaining strong safeguards." The release also says the priority is meant to build supervisors' expertise and capacity, and to stay flexible as technology changes.
The new priority runs alongside the cyber and operational resilience USSP, announced in November 2023 to take effect in 2025 together with the Digital Operational Resilience Act (DORA). The ESG disclosures priority, launched in 2023, closes in 2026. Per Cointelegraph, ESMA identifies up to two such priorities every three years, so the digital innovation priority takes a scarce slot.
The strongest case for this priority
The case for early, coordinated supervision is serious. AI models can embed bias or produce misleading outputs that reach retail investors at scale. Tokenised products can be harder to understand than the instruments they represent. If a handful of cloud or model providers sit beneath many firms, one outage or flaw can spread across the sector. Without coordination, 27 supervisors could reach 27 different readings of the same risk, which raises costs for any firm that operates across borders. A shared EU approach is better than that outcome, and it is better for the single market than leaving firms to guess what each NCA will expect.
Why the sequencing is the right call
The most important feature of the announcement is what it does not do. It does not create a new rulebook. It begins with a use-case map and initial checks on a subset of the most affected firms. That is how a regulator should start when it does not yet know where the real harms are.
The evidence supports caution about assuming harm. Finance Magnates reports that 87% of the 847 AI use cases reported by EU securities firms were for internal activities, with 10% in customer relationship tools and 3% in investment services. This is reported data, so it reflects what firms disclosed, and the article does not give the review's methodology. Even so, it suggests that most current AI use in this sector is back-office, not client-facing advice. A supervisory programme that begins by mapping this ground can focus on the small share of use that touches investors, instead of treating every model as a high-risk system.
The tokenisation side deserves the same discipline. Tokenisation is a change in how an asset is recorded and settled. It is not a new category of risk by default. The right question for supervisors is whether a given product's disclosures let investors understand what they hold, not whether the underlying ledger is novel. Technology-neutral supervision of outcomes, such as clear disclosure, fair treatment and operational soundness, is more durable than rules aimed at a specific technology that will change within a few years.
Where this could go wrong
Three risks stand out for fintech and crypto platforms.
- Scope creep from "checks" into de facto rules. Initial checks on a subset of firms can become informal expectations for everyone. If NCAs publish findings as supervisory expectations, firms will treat them as binding even though they have no legislative basis. ESMA should say clearly what is guidance, what is law, and what firms may do differently if they can show equivalent outcomes.
- Overlap with existing regimes. The new priority sits beside the cyber and operational resilience priority and, in practice, beside DORA's rules on ICT third-party risk. Firms that are small and new cannot absorb duplicate questionnaires about the same cloud provider from several supervisors. The risk of reliance on a few third-party providers should be handled once, through the existing resilience framework, not asked about again under a new heading.
- Uneven capacity. The priority's own stated purpose is to build supervisory skills. That is an honest admission that many NCAs are still learning. Checks run by inexperienced teams can produce false positives, such as treating ordinary statistical tools as risky AI. ESMA's promise to share examples of innovations that improved outcomes is the right counterweight, and it should be delivered with the same priority as the risk findings.
What good implementation looks like
First, publish the methodology for the use-case mapping before 2027 starts, so firms know what is being measured and can correct errors. Second, treat the first year as a learning exercise with proportionate treatment for smaller firms, including start-ups that rely on a single provider because they have no practical alternative. Third, report results that include the cases where AI or tokenisation improved outcomes, as the factsheet promises. A regulator that publishes only the failures will teach firms to avoid innovation in the EU.
The broader point is that a supervisory priority is a better tool than a new regulation for a fast-moving field. It can be corrected after one cycle, and it generates evidence before anyone commits to binding rules. If ESMA keeps to that model, mapping first, checking a subset and publishing balanced findings, the EU will have a credible way to protect investors without closing the door on the firms building the next generation of financial products. If it drifts toward unwritten requirements, it will have created regulation by another name, with less accountability and less certainty for the firms it supervises.