knowledge 20 October 2026 |

The 2027 EU Regulatory Roadmap: Digital Resilience, Simplification and AI Governance

Key takeaways

• Simplification and burden reduction: this is an overarching theme. The supervisory authorities aim to reduce overlapping requirements, including in reporting, and may adjust priorities as the wider EU simplification agenda develops.
• Digital operational resilience: this remains a top priority, with continued oversight of critical technology providers and support for a possible legislative proposal arising from the review of the EU’s digital resilience rules.
• Savings and investment union: the supervisory authorities will take forward a number of actions to implement EU reforms giving effect to the savings and investment union, including in relation to the PRIIPs Regulation and the Securitisation Regulation.
• Artificial intelligence (“AI”) and tokenisation: these will be special areas of focus for the supervisory authorities’ innovation forum.

Digital operational resilience

Supervisors will continue to oversee the technology providers designated as critical to the EU financial sector under the Digital Operational Resilience Act (“DORA”). In 2027 they will:

• update the list of critical technology providers and carry out planned examinations, following up on recommendations issued in 2026;
• collect reports of major technology-related incidents and publish an annual report on them;
• study the feasibility of collecting “master data” for firms’ registers of information on their technology arrangements;
• support the European Commission on a possible legislative proposal arising from the review of DORA; and
• focus on testing and capacity-building under the EU’s systemic cyber incident coordination framework and formalise links with other EU and G7 cyber crisis networks.

Consumer protection and retail investment

Subject to the progress of the EU’s Retail Investment Strategy, the supervisory authorities expect to draft new technical rules for the key information document required under the PRIIPs Regulation, with consumer testing and public consultation. The stated aim is to streamline the document, particularly its performance and cost sections. The deadline for these rules may be in 2028, depending on the legislative process.

Sustainable finance

While the review of the Sustainable Finance Disclosure Regulation (“SFDR”) continues, the supervisory authorities will prepare for any new mandates. In the meantime, they will keep monitoring compliance with existing obligations and provide clarifications where needed.

Securitisation

The European Commission’s June 2025 reform package proposed amendments to the Securitisation Regulation (amongst other legislation). Negotiations between the EU institutions began in June 2026, with implementation expected in the first half of 2027. Preparatory work on new transparency rules stemming from the proposals has already started given the compressed timeline. Supervisors will also:

• continue developing a common understanding of the most effective EU-level supervisory approach, in light of their roles under the legislative proposal, with a view to further strengthening supervisory convergence;
• monitor the involvement of non-bank financial intermediaries in securitisation markets, including third-party risk financing for collateralised loan obligations;
• track US and UK regulatory developments for divergence that could affect cross-border investment; and
• begin data collection for a review of the European Green Bond Standard expected in December 2028.

Financial conglomerates

Under the Financial Conglomerates Directive, the supervisory authorities will publish the 2027 list of identified financial conglomerates. A public consultation on a new capital adequacy reporting template is planned for the first quarter of 2027, with the final standard expected by the end of 2027.

Innovation, AI and tokenisation

The supervisory authorities’ innovation forum will run its third data collection exercise on Big Tech firms and mixed activity groups providing financial services in the EU. It will also support coordination between financial sector sandboxes and the AI regulatory sandboxes that Member States must establish under the EU AI Act. Supervisors have noticed a rise in innovation hub enquiries about smart contracts, distributed ledger technology and tokenisation, which may signal growing market interest in tokenised products and services. A factsheet on innovation trends, with a dedicated section on AI and tokenisation, is planned.

Other developments

• Risk monitoring: supervisors will publish twice-yearly reports on cross-sectoral risks and vulnerabilities, set against a backdrop of heightened geopolitical tension.
• Credit ratings: supervisors will continue mapping the credit assessments of newly registered rating agencies for regulatory capital purposes.
• European Single Access Point: supervisors will support implementation of the EU’s central portal for company and financial information.

Conclusion

The 2027 Work Programme confirms that digital resilience, simplification and innovation will shape the EU supervisory agenda in the year ahead. The continued focus on simplification and burden reduction is likely to be welcomed, but the supervisory authorities have signalled that priorities and timelines may change as the wider EU simplification agenda develops. Key dates to watch include the consultation on the financial conglomerates capital adequacy reporting template in the first quarter of 2027 and the expected implementation of the securitisation reforms in the first half of 2027. Businesses should therefore keep the changing legislative and regulatory position under review, both to remain compliant and to take advantage of any opportunities that arise.

How can McCann FitzGerald LLP help?

Our Financial Regulation Group regularly advises banks, insurers, investment firms, fund managers and other financial services businesses on EU regulatory developments, including DORA, PRIIPs, sustainable finance disclosures, securitisation and financial innovation. For further information on any of the matters discussed in this briefing or for assistance in understanding how the European Supervisory Authorities’ 2027 priorities may affect your business, please contact any of the key contacts below or your usual contact at McCann FitzGerald LLP.