The Joint Committee of the European Supervisory Authorities published its Annual Work Programme for 2027 on 13 October 2026, under document reference JC 2026 21, naming five priorities for the coming year: digital operational resilience, technological innovation, sustainable finance, securitisation and cross-sectoral risk monitoring.

For trading desks and compliance functions across the EU, the document is a planning signal. It maps where supervisory attention — and associated data requests, oversight activity and reporting expectations — will concentrate through 2027.

What does the programme mandate?

Nothing in the programme itself creates new rules. It is a coordination agenda, published annually by the Joint Committee, the forum that binds together the European Banking Authority (EBA), the European Insurance and Occupational Pensions Authority (EIOPA) and the European Securities and Markets Authority (ESMA).

The committee stated that in 2027 it will focus on areas "where cooperation among the three ESAs is essential to support financial stability, consumer protection and effective supervision." That phrasing separates intent from obligation: the operative rules remain DORA, the sustainability framework and existing sectoral legislation. The programme directs joint supervisory effort, not new compliance deadlines.

Where does DORA oversight continue?

Under the Digital Operational Resilience Act (DORA), the framework governing ICT risk in EU financial entities, the ESAs will continue oversight activities relating to critical ICT third-party service providers.

This is the workstream with the most direct execution and technology consequences. Firms relying on designated critical providers — cloud infrastructure, market data vendors, connectivity and hosting services — should expect sustained scrutiny of contractual arrangements, exit strategies and concentration risk. The programme also commits the ESAs to strengthening the financial sector's preparedness against cyber threats.

How will AI and innovation be assessed?

The Joint Committee will assess the implications of technological developments, including the growing use of artificial intelligence and other digital innovations. The commitment is analytical rather than rule-making: an assessment, not a consultation, not a technical standard.

For firms deploying AI in trading, surveillance or client-facing tools, the signal is that supervisory interest is broadening beyond DORA's ICT perimeter. The assessment work will feed a cross-sectoral view of how machine-driven processes interact with existing conduct and operational requirements.

What stays on the consumer and sustainability files?

Consumer protection remains a central priority. The ESAs will continue joint work on issues affecting retail consumers, aiming to help them make informed financial decisions and promote confidence in EU financial markets.

In sustainable finance, the Joint Committee will continue to support consistent application of the EU's sustainability framework across sectors — a continuation of existing convergence work rather than a new mandate.

The programme also aligns with two European Commission objectives: building an efficient Savings and Investment Union, and advancing a simplification agenda intended to foster more effective regulation and supervision while reducing unnecessary regulatory burdens. Whether that simplification delivers measurable burden reduction remains to be tested against the Commission's legislative output in 2027.

Why the Joint Committee matters

The Joint Committee exists to strengthen cooperation among the three ESAs, coordinate cross-sectoral supervisory work and promote consistent supervisory practices across the EU. Where a risk crosses banking, insurance and securities perimeters — third-party ICT concentration, AI adoption, securitisation exposure — it is the committee that carries the coordination.

The 2027 programme is available as a public PDF on ESMA's website. Firms with multi-entity EU footprints should read it as a supervisory-attention forecast: resilience oversight and technology assessment lead the list, and the desks most exposed are those dependent on shared critical service providers.