The Joint Committee of the European Supervisory Authorities, EBA, EIOPA and ESMA, has published its annual work programme for 2027. Key priorities are digital operational resilience, technological innovation, sustainable finance, securitisation and cross-sectoral risk monitoring. Under DORA the authorities will continue overseeing critical ICT third-party providers and will assess the implications of artificial intelligence. Consumer protection remains a central aim, alongside simplification of the regulatory framework.

What it means: The programme brings no new rules, but it shows where supervisors will focus next year, which is useful for anyone planning a compliance budget. The emphasis on DORA and critical ICT providers means the large cloud and software vendors serving banks and insurers will stay under constant scrutiny. For Greek software firms selling to financial institutions, client demands for documentation, resilience testing and exit plans will keep rising, even if the vendors themselves are never designated critical. The mention of artificial intelligence also matters. Supervisors want to understand how AI models affect credit scoring, insurance pricing and customer service, which could lead to guidance that complements the AI Act. The nod to simplification shows political pressure to reduce burden has reached the supervisors, although that rarely means less work for regulated firms in the short term. Compliance leads should build these themes into their plans for the coming year, starting with an updated register of ICT contracts.

Read the original on European Banking Authority (EBA)

Related service: myDATA integrations

Related stories