ESAs name DORA oversight, AI and private credit among 2027 joint priorities
The three European Supervisory Authorities have published their Joint Committee work programme for 2027. It signals where cross-sectoral supervisory attention will fall next year: critical ICT third-party oversight under DORA, the implications of AI, consumer protection, sustainable finance and securitisation. This is the forward map of coordinated EU supervision, and the point at which firms can see which shared files the three authorities intend to push together.
- The Joint Committee of the EBA, EIOPA and ESMA published its Annual Work Programme for 2027 on 13 October 2026.
- Priorities include digital operational resilience under DORA, AI and technological innovation, consumer protection, sustainable finance and securitisation.
- The programme aligns with the Commission's Savings and Investment Union objectives and a simplification agenda to reduce regulatory burden.
Executive summary — the whole item, if you read nothing else
On 13 October 2026 the Joint Committee of the EBA, EIOPA and ESMA published its Annual Work Programme for 2027. Priorities span digital operational resilience, technological innovation including AI, sustainable finance, securitisation and cross-sectoral risk monitoring. Under DORA, the ESAs will continue oversight of critical ICT third-party service providers and work on cyber preparedness. Consumer protection remains central, as does consistent application of the EU sustainability framework. The programme is aligned with the Commission's Savings and Investment Union objectives and a simplification agenda aimed at reducing regulatory burden. The document states priorities rather than new obligations; firms should read it as the coordination agenda shaping 2027 supervisory activity across all three sectors.
Detailed analysis
What happened — reported fact
The Joint Committee of the three European Supervisory Authorities — the European Banking Authority, the European Insurance and Occupational Pensions Authority, and the European Securities and Markets Authority — published its Annual Work Programme for 2027 on 13 October 2026. The document sets out priorities for addressing cross-sectoral risks and strengthening coordination across the EU financial sector.
The programme identifies areas where cooperation among the three ESAs is described as essential to support financial stability, consumer protection and effective supervision. Named priorities are digital operational resilience, technological innovation, sustainable finance, securitisation and cross-sectoral risk monitoring.
Under the Digital Operational Resilience Act (DORA), the ESAs state they will continue oversight activities relating to critical ICT third-party service providers and work towards strengthening the financial sector's preparedness against cyber threats. The Joint Committee will also assess the implications of technological developments, including the growing use of artificial intelligence and other digital innovations.
Consumer protection is described as remaining a central priority, with the ESAs continuing joint work on issues affecting retail consumers, aimed at helping them make informed financial decisions and promoting confidence in EU financial markets. On sustainable finance, the Joint Committee says it will continue to support consistent application of the EU's sustainability framework across sectors.
The programme states it reflects the Joint Committee's role in ensuring a coordinated supervisory response to cross-sectoral challenges. It also notes alignment with the European Commission's objectives to build an efficient Savings and Investment Union and advance a simplification agenda intended to foster more effective regulation and supervision while reducing unnecessary regulatory burdens.
The Joint Committee is a forum established to strengthen cooperation between the EBA, EIOPA and ESMA, coordinating cross-sectoral supervisory work and promoting consistent supervisory practices across the EU. The underlying document is referenced as JC 2026 21.
The announcement situates the 2027 programme alongside recent ESA work, including a September 2026 statement on external dependencies, cyber threats and private credit risks, a proposal on bilateral margin requirements, and earlier work on ICT risks from frontier AI models in the EU financial sector.
Our view — interpretation, not fact
The most telling line is the pairing of the ESAs' expanding oversight agenda with the Commission's simplification drive — two objectives that pull in opposite directions and will have to be reconciled file by file through 2027. A work programme that lists DORA critical-third-party oversight, AI assessment, consumer protection, sustainable finance and securitisation is not a lightening of the load, yet it explicitly invokes the goal of reducing unnecessary regulatory burden. The practical question for firms is which of these priorities translates into fresh data requests and joint supervisory action, and which gets absorbed into the simplification narrative. The DORA strand is the one with teeth: oversight of critical ICT third-party providers is already operational and generates concrete obligations, so continued activity there means continued demand on firms' resilience documentation and incident reporting. The AI and sustainable-finance strands are framed as assessment and consistent application rather than new rulemaking — a signal that firms should expect interpretive convergence, not a wave of new text. The real test will be whether the three authorities move in genuine lockstep or whether sectoral priorities reassert themselves, as they have before, leaving cross-sectoral coordination more aspirational than operational.
The other side
A work programme is a signalling document, not a binding instrument, and the ESAs would reasonably argue that flagging simplification alongside continued oversight is exactly the balance the Commission has asked for: fewer redundant requirements, sharper focus on genuinely cross-sectoral risks. The agenda could be read as consolidation rather than expansion.
What to do
Resilience and ICT teams should track the DORA critical-third-party oversight workstream for concrete deliverables in 2027; compliance leads across banking, insurance and securities should watch for joint ESA output on AI governance and sustainable-finance application rather than treating these as siloed files.
Source documents
https://www.esma.europa.eu/press-news/esma-news/european-supervisory-authorities-set-priorities-2027Read by Regulus 13 Oct 2026 at 14:04 UTC
15 factual claims checked against this document · 0 unsupported
Cited and linked; extract quoted under fair dealing