# ESMA AI statement ESMA35-335435667-5924: Public Statement on the use of Artificial Intelligence (AI) in the provision of retail investment services

Source: https://www.bankingnewsai.com/ai-regulation/documents/esma-public-statement-ai-investment-services-2024
Last updated: Oct 5, 2026

ESMA's Public Statement ESMA35-335435667-5924, published on 30 May 2024, gives initial guidance to firms, including banks providing investment services, on using AI in retail investment services under MiFID II. It states that firms' decisions remain the responsibility of management bodies whether taken by people or AI-based tools, and that firms must act in clients' best interest, disclose AI use in client interactions such as chatbots, and keep AI-specific governance, risk management, staff training, accuracy controls and records. It is not new law and is without prejudice to the AI Act and DORA. ESMA and national competent authorities will keep monitoring to decide whether further action is needed.

## At a glance

| Field | Value |
| --- | --- |
| Authority | [ESMA](https://www.bankingnewsai.com/ai-regulation/esma) |
| Type | Guidance |
| Status | Final |
| Published | May 30, 2024 |
| Applies to | Investment firms providing investment services under MiFID II, expressly including credit institutions providing investment services (footnote 3), in particular retail clients; covers AI tools built or bought by the firm and third-party tools such as ChatGPT used by staff, with or without management's knowledge. Non-binding statement. |
| Official text | https://www.esma.europa.eu/press-news/esma-news/esma-provides-guidance-firms-using-artificial-intelligence-investment-services |

## Key points

- Published 30 May 2024; reference ESMA35-335435667-5924; 27 numbered paragraphs. Footnote 3: 'investment firms' also encompasses credit institutions providing investment services.
- Paragraph 2: firms' decisions remain the responsibility of management bodies, irrespective of whether decisions are taken by people or AI-based tools.
- Paragraph 4: the statement covers third-party AI technologies such as ChatGPT or Google Bard used by staff with or without senior management's knowledge; firms need measures to control such use.
- Paragraphs 7 to 9: act in the client's best interest irrespective of the tools used; present information on AI use in a clear, fair and not misleading way; disclose use of AI in client interactions such as chatbots.
- Paragraphs 10 to 13: the management body must understand and oversee AI; robust governance, regular model testing and monitoring; input data must be relevant, sufficient and representative; risk management tailored to AI, applying proportionality; documentation and reporting.
- Paragraphs 14 to 18: third-party AI solutions are subject to MiFID II outsourcing due diligence; ex-ante accuracy controls and ex-post monitoring of AI-delivered information; heightened vigilance where AI supports staff giving information about investment products; AI training for relevant staff and control functions.
- Paragraphs 19 to 22: conduct-of-business rules, especially for advice and portfolio management — suitability and product governance alignment, rigorous quality assurance, stress tests and data protection compliance.
- Paragraphs 23 and 24, 26 and 27: record keeping on AI use, data sources, algorithms and modifications over time, and on related complaints; initial guidance only; ESMA and NCAs will keep monitoring the evolution of AI and the relevant EU legal framework to determine whether further action is needed.

## What changed for banks

The statement made explicit that MiFID II's organisational, conduct and best-interest obligations apply fully to AI used in retail investment services, including AI used informally by staff. It added no new legal requirements but set the baseline that national supervisors can use when examining firms' AI governance in investment business, and it flagged ESMA's intent to monitor whether further action is required.

## Use cases it governs

- [Customer-facing chatbots](https://www.bankingnewsai.com/ai-regulation/by-use-case#customer-chatbots)
- [Trading & capital markets](https://www.bankingnewsai.com/ai-regulation/by-use-case#trading-markets)
- [Generative & agentic AI](https://www.bankingnewsai.com/ai-regulation/by-use-case#generative-agentic-ai)
- [AI governance (general)](https://www.bankingnewsai.com/ai-regulation/by-use-case#governance-general)
- [Third-party & vendor AI](https://www.bankingnewsai.com/ai-regulation/by-use-case#third-party-vendors)

## What does ESMA35-335435667-5924 require of banks using AI for investment services?

ESMA's May 2024 public statement expects investment firms, including credit institutions providing investment services, to keep applying MiFID II obligations when they use AI: act in the client's best interest, be transparent on the role of AI and disclose AI use in client interactions such as chatbots, and keep management-body oversight of AI as part of governance and risk management. Firms should test and monitor AI systems proportionately, ensure input data is relevant and representative, apply outsourcing due diligence to third-party AI, put ex-ante and ex-post accuracy controls on information delivered through AI, train staff and keep records of AI use, data sources, algorithms, modifications and complaints. The statement also covers staff use of third-party tools such as ChatGPT without management approval. It is guidance, not a new rule.

| Rule | Authority | What it requires | Status | Source |
| --- | --- | --- | --- | --- |
| Paragraph 2 — Management body responsibility | [ESMA](https://www.bankingnewsai.com/ai-regulation/esma) | Firms' decisions remain the responsibility of the management body regardless of whether taken by people or AI tools. | Published 30 May 2024 | [ESMA AI statement ESMA35-335435667-5924](https://www.bankingnewsai.com/ai-regulation/documents/esma-public-statement-ai-investment-services-2024) |
| Paragraphs 7 to 9 — Client best interest and information | [ESMA](https://www.bankingnewsai.com/ai-regulation/esma) | Act in clients' best interest, present information on AI use clearly, fairly and not misleadingly, and disclose AI use in chatbot and automated client interactions. | Published 30 May 2024 | [ESMA AI statement ESMA35-335435667-5924](https://www.bankingnewsai.com/ai-regulation/documents/esma-public-statement-ai-investment-services-2024) |
| Paragraphs 10 to 13 — Governance and risk management | [ESMA](https://www.bankingnewsai.com/ai-regulation/esma) | Ensure management-body understanding and oversight of AI, robust governance, regular testing and monitoring, representative input data and documented AI-specific risk management. | Published 30 May 2024 | [ESMA AI statement ESMA35-335435667-5924](https://www.bankingnewsai.com/ai-regulation/documents/esma-public-statement-ai-investment-services-2024) |
| Paragraph 14 — Third-party AI and outsourcing | [ESMA](https://www.bankingnewsai.com/ai-regulation/esma) | Apply MiFID II outsourcing requirements and due diligence to AI solutions bought from third-party providers. | Published 30 May 2024 | [ESMA AI statement ESMA35-335435667-5924](https://www.bankingnewsai.com/ai-regulation/documents/esma-public-statement-ai-investment-services-2024) |
| Paragraph 16 — Accuracy controls | [ESMA](https://www.bankingnewsai.com/ai-regulation/esma) | Establish ex-ante controls on information supplied to AI and sufficiently frequent ex-post controls on information delivered through AI to prevent misleading advice. | Published 30 May 2024 | [ESMA AI statement ESMA35-335435667-5924](https://www.bankingnewsai.com/ai-regulation/documents/esma-public-statement-ai-investment-services-2024) |
| Paragraphs 17 and 18 — Staff training | [ESMA](https://www.bankingnewsai.com/ai-regulation/esma) | Train relevant staff and control functions on AI operation, risks, ethics and regulatory implications. | Published 30 May 2024 | [ESMA AI statement ESMA35-335435667-5924](https://www.bankingnewsai.com/ai-regulation/documents/esma-public-statement-ai-investment-services-2024) |
| Paragraphs 19 to 22 — Conduct of business | [ESMA](https://www.bankingnewsai.com/ai-regulation/esma) | For advice and portfolio management, align AI-driven recommendations with suitability and product governance, run quality assurance and stress tests, and protect client data. | Published 30 May 2024 | [ESMA AI statement ESMA35-335435667-5924](https://www.bankingnewsai.com/ai-regulation/documents/esma-public-statement-ai-investment-services-2024) |
| Paragraphs 23 and 24 — Record keeping | [ESMA](https://www.bankingnewsai.com/ai-regulation/esma) | Keep comprehensive records of AI use in investment services, data sources, algorithms, modifications and related client complaints. | Published 30 May 2024 | [ESMA AI statement ESMA35-335435667-5924](https://www.bankingnewsai.com/ai-regulation/documents/esma-public-statement-ai-investment-services-2024) |

The statement works through the lens of existing MiFID II rules; footnote 4 says it is without prejudice to the broader EU digital governance framework, including the AI Act and DORA. It cross-refers to ESMA's suitability guidelines (ESMA35-43-3172) for robo-advice.

Since 2024 ESMA has moved from guidance towards supervisory convergence: on 31 July 2026 the ESAs published a joint statement on ICT risks from frontier AI models (JC 2026 25), and on 23 September 2026 ESMA announced a digital innovation Union Strategic Supervisory Priority from 2027, with an initial focus on AI and tokenisation.

### What this means in practice

- Keep a register of AI tools used in investment services, including unsanctioned third-party chatbots employees use.
- Disclose AI use to clients in chatbot and automated interactions and review marketing statements about AI for clarity and fairness.
- Add ex-ante and ex-post accuracy checks for AI-assisted advice and client information.
- Include AI in outsourcing due diligence, product governance and suitability processes.
- Retain records on AI model changes, data sources and complaints that relate to AI-driven services.

## FAQ

### Does the ESMA public statement on AI apply to banks?

Yes, to the extent they provide investment services. Footnote 3 states that the term 'investment firms' also encompasses credit institutions providing investment services.

### Is ESMA35-335435667-5924 binding?

No. It is a public statement providing initial guidance on how MiFID II requirements apply when firms use AI. The MiFID II obligations it refers to are binding, and national competent authorities supervise them.

### What are the penalties under the ESMA AI statement?

The statement sets no penalties of its own. Breaches of the underlying MiFID II obligations are a matter for the competent authorities under the applicable national and EU sanctions regimes.

### How does the ESMA statement compare with the EU AI Act?

The statement applies existing MiFID II requirements to AI in investment services and says it is without prejudice to the AI Act and DORA. The AI Act is separate, binding horizontal legislation; AI used for creditworthiness assessment of natural persons is high-risk under it, which the ESMA statement does not address.

## Related documents

- [AB 1609](https://www.bankingnewsai.com/ai-regulation/documents/ca-ab-1609-2026) — Customer Service Chatbots (Right to Human Customer Service Act) (Sep 28, 2026)
- [Colorado AG proposed ADMT rules](https://www.bankingnewsai.com/ai-regulation/documents/co-ag-admt-proposed-rules-2026) — Proposed Automated Decision-Making Technology and Conversational AI Service Rules (Notice of Rulemaking Hearing) (Aug 11, 2026)
- [Regulation (EU) 2026/1744 (Digital Omnibus on AI)](https://www.bankingnewsai.com/ai-regulation/documents/eu-digital-omnibus-ai-regulation-2026-1744) — Regulation (EU) 2026/1744 amending Regulation (EU) 2024/1689 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI) (Jul 24, 2026)
- [Commission guidelines on AI Act Article 50 transparency](https://www.bankingnewsai.com/ai-regulation/documents/eu-commission-guidelines-ai-act-article-50-transparency-2026) — Commission Guidelines on the implementation of the transparency obligations for certain AI systems under Article 50 of Regulation (EU) 2024/1689 (AI Act) (Jul 20, 2026)
- [RBI draft Guidance on Regulatory Principles for Model Risk Management](https://www.bankingnewsai.com/ai-regulation/documents/rbi-model-risk-management-guidance-2026) — Guidance on Regulatory Principles for Model Risk Management, 2026 (draft released for public comments) (Jun 24, 2026)
- [HB 26-1263](https://www.bankingnewsai.com/ai-regulation/documents/co-hb26-1263) — Conversational Artificial Intelligence Service Operator Requirements (Chatbot Safety Act) (May 29, 2026)
- [IOSCO FR/02/2026](https://www.bankingnewsai.com/ai-regulation/documents/iosco-ai-capital-markets-fr02-2026) — Supervisory Toolkit for AI Use in Capital Markets: Final Report (May 25, 2026)
- [SB 26-189](https://www.bankingnewsai.com/ai-regulation/documents/co-sb26-189) — Automated Decision-Making Technology Act (repeal and reenactment of the Colorado AI Act) (May 14, 2026)

Last reviewed Oct 5, 2026. Cite the official text (https://www.esma.europa.eu/press-news/esma-news/esma-provides-guidance-firms-using-artificial-intelligence-investment-services) for the rule and this page for the summary and dates.

---

Canonical page: https://www.bankingnewsai.com/ai-regulation/documents/esma-public-statement-ai-investment-services-2024
Part of [BankingNewsAI](https://www.bankingnewsai.com/) — a free daily brief on AI in banking, an AI regulation tracker (41 authorities, 237 documents) and AI-strategy profiles of the 120 largest US banks. Markdown versions of every reference page: append `.md` to the page URL; index at https://www.bankingnewsai.com/llms.txt.