ESMA regulates AI in banks indirectly, through how MiFID II applies when banks provide investment services. Its Public Statement of 30 May 2024 (ESMA35-335435667-5924) says firms' decisions remain the responsibility of management bodies irrespective of whether people or AI tools take them, and sets expectations on client best interest, transparency, governance, risk management, staff training, record keeping and oversight of staff use of third-party AI tools. On 23 September 2026 ESMA announced a new Union Strategic Supervisory Priority on digital innovation from 2027, initially focused on AI and tokenisation.
| Full name | European Securities and Markets Authority (ESMA) |
| Role | EU securities-markets authority that issues non-binding statements and convergence tools on how existing securities rules apply to AI |
| Force on banks | Supervisory guidance |
| Applies to | Investment firms and credit institutions providing investment services under MiFID II, with national competent authorities supervising; ESMA's 2024 statement states that 'investment firms' also encompasses credit institutions providing investment services |
| Key document | ESMA Public Statement on the use of Artificial Intelligence in the provision of retail investment services (30 May 2024, ESMA35-335435667-5924) |
| Latest move | 23 September 2026: ESMA announced a new Union Strategic Supervisory Priority on digital innovation from 2027, with an initial focus on how supervised entities use AI and tokenisation |
| Documents tracked | 1 · all documents → |
ESMA's 2024 statement is initial guidance rather than a new rule: it reads existing MiFID II organisational, conduct-of-business and best-interest obligations in light of AI, notes that it is without prejudice to the AI Act and DORA, and says ESMA and national competent authorities will keep monitoring to decide whether further action is needed. It covers AI tools developed by the firm, bought from third parties, or used by staff without management's knowledge (the statement names ChatGPT and Google Bard as examples).
On 31 July 2026 ESMA, with the EBA and EIOPA, published a joint statement (JC 2026 25) on a consistent, risk-based approach to ICT risks from frontier AI models, and on 23 September 2026 it announced that a digital innovation Union Strategic Supervisory Priority will run from 2027 alongside the existing cyber and operational resilience priority.
What has the ESMA actually published on AI?
| Date | Document | Status |
|---|---|---|
| May 30, 2024 | ESMA AI statement ESMA35-335435667-5924 — Public Statement on the use of Artificial Intelligence (AI) in the provision of retail investment services | Final |
| Date | Type | Document / event |
|---|---|---|
| Sep 23, 2026 | Milestone | ESMA announces digital innovation Union Strategic Supervisory Priority from 2027. ESMA will launch a new Union Strategic Supervisory Priority to help embrace innovation while protecting investors, with an initial focus, in collaboration with national competent authorities, on how supervised entities use artificial intelligence and tokenisation. It will run alongside the cyber and operational resilience priority in place since 2025. |
| May 30, 2024 | Guidance | ESMA AI statement ESMA35-335435667-5924 — Public Statement on the use of Artificial Intelligence (AI) in the provision of retail investment services. ESMA's Public Statement ESMA35-335435667-5924, published on 30 May 2024, gives initial guidance to firms, including banks providing investment services, on using AI in retail investment services under MiFID II. source ↗ |
- Start of the digital innovation USSP in 2027 and the supervisory convergence work with national competent authorities on AI
- Whether ESMA turns its May 2024 'initial guidance' into further guidance, as the statement says ESMA and national authorities will keep monitoring to decide whether further action is needed
- Interaction of MiFID II expectations with the EU AI Act and DORA, which the statement says it is without prejudice to
Does ESMA's AI statement apply to banks?
Yes, where they provide investment services. Footnote 3 of the statement says that when it refers to 'investment firms' it also encompasses credit institutions providing investment services.
Is the ESMA public statement on AI binding?
It is a public statement providing initial guidance on how existing MiFID II requirements apply, not a new legal obligation. National competent authorities supervise firms' compliance with MiFID II.
What is ESMA's 2027 digital innovation priority?
A Union Strategic Supervisory Priority announced on 23 September 2026, to start in 2027, aimed at ensuring supervisors can oversee new technologies, with an initial focus on supervised entities' use of artificial intelligence and tokenisation.
Follow every move these regulators make
when one of these regulators moves, the next morning's brief says so · six sourced stories · 7 am ET · free
plus every tracker, bank and agent page update, the morning after · leave any morning