ESMA has made digital innovation a European supervisory priority from 2027 and explicitly includes AI. European supervisory authorities have also highlighted dependencies on external technology providers and cyber risks. These are European signals; they do not by themselves create a new rule for a Swiss leasing company.
The operational questions are already immediate. Which documents reach the model? Who can see them? Where are prompts and outputs stored, and for how long? What happens when a provider or an interface fails?
A firm that waits until after a pilot to answer may have to rebuild a working process. I would map the data flow, permissions and fallback arrangements before using real customer files.
A policy alone cannot enforce a control. The control must work in the system and leave evidence that it did.
Could you draw the route a customer document takes through your AI workflow today?
Sources: https://www.esma.europa.eu/press-news/esma-news/esma-sets-new-supervisory-priority-digital-innovation-2027
https://www.eba.europa.eu/publications-and-media/press-releases/esas-call-vigilance-over-external-dependencies-cyber-threats-and-private-credit-risks