What happened
The European Securities and Markets Authority (ESMA) confirmed it will launch a new Union Strategic Supervisory Priority (USSP) on digital innovation from 2027. The first focus will be how supervised entities use artificial intelligence and tokenisation, with the work carried out alongside national competent authorities. ESMA said it will stay flexible enough to address later technological developments, naming advanced frontier AI as one of them.
The new priority runs next to the USSP on cyber and operational resilience that has been in place since 2025, so digital technology and operational risk now sit side by side on the same supervisory agenda. At the same time ESMA is closing out the USSP on ESG disclosures it launched in 2023, saying disclosure quality and investor understanding improved but that sustainability reporting remains a long term effort.
USSPs are ESMA's convergence tools. They are how the authority directs supervisory resources across the EU toward the risks it considers most material for investor protection, financial stability and the orderly functioning of markets. In practice a USSP tells national regulators what to examine, and the reviews and information requests that follow are how the priority reaches individual firms.
Why this is a GRC story
Supervisory priorities are a leading indicator of enforcement. A USSP does not change the rulebook, but it changes where supervisors look. Firms that treat AI and tokenised products as pure product decisions, with no governance record behind them, will find themselves answering questions they cannot evidence.
The practical obligation is to show your work. A supervisory review of this kind tends to ask the same things: who owns the model or the tokenised product, what testing was done, what its limits are, and how the firm would detect and stop harm to clients. If that evidence does not exist before the review starts, it cannot be assembled convincingly afterwards.
Two agendas, one conversation. AI and tokenisation now sit alongside operational resilience in the same supervisory frame, and the same technology usually raises both sets of questions. A model outage, a badly scoped agent or a smart contract failure is an innovation question and an operational resilience question at once, and it helps to handle them in one governance forum rather than two.
What to watch
The translation step is what matters. Watch how national competent authorities turn the priority into questionnaires, thematic reviews and data requests, and which participants get asked first. The factsheet ESMA published with the announcement is the clearest statement of scope so far, and the frontier AI language is the part most likely to widen.
For a firm with EU clients, a reasonable next move is to pick one AI or tokenised process that touches investors and assemble the evidence a supervisor would ask for. If items are missing, that gap is the finding, and finding it now is cheaper than explaining it later.
Attribution: Analysis based on Compliance Week's reporting and ESMA's announcement of the new supervisory priority. This article is original commentary, not a repost of the source material.