Eight hundred and forty-seven use cases

The European Securities and Markets Authority announced on Wednesday that artificial intelligence and tokenisation will become a Union Strategic Supervisory Priority from 2027. The initial focus "will be on how supervised entities use artificial intelligence and tokenisation", ESMA said, and it will "remain flexible to address future technological developments as they emerge", in its own statement. The purpose is to help supervisors build the expertise to oversee new technology while protecting investors.

The announcement has been read in several places as the start of direct European oversight of AI and tokenised products in retail finance. It is not that. ESMA directly supervises a short list of entities: credit rating agencies, trade repositories, securitisation repositories, benchmark administrators and data reporting service providers. Investment firms, fund managers and the banks that provide investment services are supervised by national competent authorities in twenty-seven member states. A USSP is the instrument by which ESMA tells those authorities where to point, then collects and compares what they find. It sets the agenda for supervision rather than performing it.

The teeth are second-order. Once a USSP is set, national regulators have to report against it, ESMA runs peer reviews on how consistently they do so, and firms receive data requests they cannot decline. The existing USSP on cyber and operational resilience, running since 2025, has worked exactly that way. The one on ESG disclosures, launched in 2023, concludes this year. Digital innovation joins the first and replaces the second.

The more interesting question is what the priority is built on. ESMA's own baseline is the risk analysis it published on 20 February 2026 under the reference ESMA50-481369926-30599, drawing on a survey that fifteen national authorities and ESMA ran between June and September 2025. It gathered responses from 728 entities in nineteen EU countries: 274 investment managers, 262 investment firms, 106 credit institutions providing investment services, 77 financial market infrastructures, eight credit rating agencies and one benchmark administrator.

Of those 728 firms, 395 reported any AI use case at all. Between them they listed 847, each firm allowed up to three. Of the 847, 426 were said to be in production, 391 in development or experimentation, and 30 unspecified. And here is the number that sits awkwardly beneath a supervisory priority aimed at customer outcomes: firms classified 87 per cent of the use cases as internal only. Ten per cent were client-facing tools for customer relationship management. Three per cent were used in the provision of investment services.

The detail is starker still. Across the whole sample, portfolio risk management accounted for twenty use cases, portfolio optimisation nineteen, algorithmic trading ten, high-frequency trading three and robo-advising two. The bulk of what firms reported was search and summarisation, process automation, chatbots and know-your-customer checks. On the regulator's own evidence, AI in European securities markets is a back-office efficiency programme that has barely reached the front office.

The sample has a second feature the headline figure conceals. Participation was voluntary, and ESMA says plainly that the statistics "are not necessarily representative of the broader population of EU-domiciled securities markets firms". Some national authorities did not circulate the survey because they had recently run their own. The resulting geography is lopsided: Portugal supplied 182 respondents and Malta 135, which is 43 per cent of the sample between two jurisdictions that are not where the weight of European asset management sits. Ireland contributed 82, Spain 70, France 68 and Belgium 54. A third of respondents were micro firms.

Then there is the other half of the priority. The February analysis is about AI; it was not designed to measure tokenisation. Among the 77 financial market infrastructures sat 21 virtual asset service providers and eight crypto-asset service providers. There is no equivalent baseline for tokenised products in retail distribution, which is presumably why the first phase is described as mapping where firms already use or plan to use them. ESMA is starting that half without a number.

None of this makes the priority wrong. Supervisory capacity does not have to wait for the risk to materialise, and a regulator that waits for conclusive evidence arrives after the fact. The survey is also fifteen months old and predates the current wave of agentic deployment entirely; the three per cent may well have moved. But that is an argument for saying so. The framing on offer is that firms are increasingly using AI and tokenised products to gain market share and supervision must catch up. The framing the numbers support is that European firms have so far kept AI almost entirely away from anything a client touches, that nobody has measured tokenisation in this population at all, and that the apparatus is being built ahead of the exposure.

The contrast with the United States is instructive. There the agencies are writing substantive rules because Congress declined to, and the CFTC chairman has been telling the Treasury market to prepare for tokenised collateral while the statutory basis for doing so remains unavailable. In Europe the rulebooks already exist — MiCA, DORA and the AI Act between them — and what is missing is the supervisory muscle to read them. Firms should expect data requests in 2026 and thematic examinations in 2027, concentrating on governance, data quality and whether customer outcomes match what the models were sold as doing. The exercise will, if nothing else, produce a better number than 847.