DORA Review, Tokenisation and Simplification: What the ESAs' 2027 Work Programme Signals

The Joint Committee of the European Supervisory Authorities published its nine-page 2027 Work Programme on 13 October 2026 (JC 2026 21). Much of it continues existing work. Three themes stand out for me as a compliance practitioner: ongoing DORA supervision and support for its review, tokenisation and AI, and efforts to simplify requirements and reduce burdens.

This article sets out what the programme says on each thread and where the text leaves questions open. My own reading is set apart from the source, mainly in the commentary on DORA and in the practical steps at the end.

1. What the Joint Committee is and why its programme matters

The Joint Committee is the forum through which the EBA, EIOPA and ESMA coordinate their cross-sectoral work. The European Commission and the European Systemic Risk Board participate in it, and national competent authorities take part through dedicated sub-structures.

A work programme does not create obligations for firms. It shows where the three authorities intend to spend their joint time in the coming year and what they expect to produce, which gives compliance functions an early view of the reports, standards and supervisory work likely to follow.

2. Simplification and burden reduction

The programme states that the Joint Committee will carry out its 2027 activities within the context of simplification and burden reduction. Where appropriate, joint work may contribute to reducing overlapping requirements, including in reporting, as well as fostering supervisory convergence and improving the usability and consistency of the EU regulatory framework.

It also reserves flexibility. The Joint Committee will remain attentive to the broader EU simplification agenda and may adapt priorities, timelines or approaches as necessary.

The PRIIPs entry shows how this works in a specific area. In 2027 the ESAs expect to work on drafting RTS and ITS based on the empowerments in the proposed amendments to the PRIIPs Regulation under the Commission's Retail Investment Strategy, including consumer testing and public consultation. In that work they intend to streamline and simplify the content of the Key Information Document, in particular the performance and cost sections. The expected output is a set of PRIIPs KID RTS, and the programme notes that the deadline may be in 2028, subject to the legislative process.

The programme does not identify which reporting overlaps it has in mind or when any reduction might take effect. The programme itself changes no existing reporting obligations.

3. DORA: ongoing supervision and support for the review

Digital operational resilience is the first substantive chapter of the programme. Most of it concerns continuing oversight and supervisory work, and support for the DORA review sits alongside that work.

Oversight of critical ICT third-party providers. Through the Oversight Forum, the ESAs will update the list of critical ICT third-party providers (CTPPs),conduct the risk assessment, prepare the annual and multi-annual oversight plans, carry out the planned examination activities for each designated CTPP and follow up on any recommendations issued in 2026. An annual report on the 2026 oversight activities is also listed as an output.

Supervisory convergence. Through the Joint Committee, and alongside competent authorities, resolution authorities, the ECB and the ESRB, the ESAs will continue to foster harmonised implementation of DORA. Under the steering of the Oversight Forum, they will also work with competent authorities to identify areas where supervisory practice needs greater convergence, using the most appropriate tools.

Incident data. The ESAs will keep collecting the ICT-related incidents reported by competent authorities, to inform both the supervision of ICT risk at financial entities and the oversight of CTPPs. With competent authorities, they will analyse the ICT cyber-threat landscape, including information from major ICT incidents, to identify the nature of the ICT risks affecting financial entities. The programme also lists an annual report on major ICT-related incidents, which the ESAs say they will develop. Our analysis of BaFin's TeamViewer fine looks at a case in which an ICT incident also became a disclosure question: when a cyberattack becomes inside information.

The register of information. Among the expected outputs is a feasibility study on the collection of Master Data for the collection of registers of information. The programme does not describe the study's scope or timing.

The DORA review. The ESAs will provide support and technical advice to the European Commission for the preparation of a potential legislative proposal in the context of the DORA review.

EU-SCICF. Under the pan-European Systemic Cyber Incident Coordination Framework, the work in 2025 and 2026 concentrated on framework design, tools and procedures. In 2027 the priority moves to testing, exercises and capacity building for members, including connectivity tests. The ESAs also plan to formalise links with complementary frameworks, naming EU-CyCLONe and the G7 Cyber Expert Group.

What this means in practice: The programme refers to a potential legislative proposal. The ESAs are supporting the preparation of a possible proposal, and nothing in the document changes current DORA obligations.

The Master Data study should be read with the same caution. The source does not explain what it covers, and it does not establish any new register obligation. The duty to maintain a register of information under Article 28(3) of DORA applies as before. Whatever the study concludes, an accurate and consistently maintained register is what the Regulation already requires, so data quality work done now is not wasted.

An annual report on major ICT-related incidents would give the ESAs a consolidated EU view of incident patterns. The programme does not say whether it will be published. Either way, classification decisions that are documented and consistent with the DORA criteria are easier to explain if a supervisor reviews them against a wider set of incidents.

4. Tokenisation and AI: the 2027 innovation focus

The European Forum for Innovation Facilitators (EFIF) brings together national innovation facilitators under the Joint Committee framework. For 2027, the programme states that special focus will be given to artificial intelligence and tokenisation.

Interest in tokenisation. In 2026, the ESAs noticed an increase in innovation hub enquiries about use cases for smart contracts, distributed ledger technology and tokenisation. That increase was not accompanied by a rise in crypto-asset issuance and offering activities. The ESAs say this may suggest a shift towards tokenisation, which they will explore further in 2027. The observation concerns enquiries to innovation hubs. It is not presented as evidence of market growth.

AI and sandboxes. EFIF members will continue sharing experience of AI use cases and of the AI regulatory sandboxes being established under the AI Act. The ESAs will also support coordination between existing financial sector sandboxes and those AI sandboxes. Presentations from industry and consumer or investor associations will complement the discussions. Our earlier article on frontier AI governance under DORA looks at what the ESAs have already said about AI and risk committees.

Outputs. The innovation trends factsheet will include a thematic section on AI and tokenisation, describing use cases and summarising opportunities and risks. Separately, the ESAs will run a third data collection exercise on BigTechs and mixed activity groups providing financial services in the EU, followed by a short report or factsheet, subject to EFIF members' steer. The programme notes that the concrete deliverables and focus areas may change following further discussions with EFIF members.

For firms exploring tokenised instruments or DLT-based processes, it is worth considering early engagement with a national innovation facilitator to clarify regulatory questions while the design is still open.

5. What the programme leaves open

Several points that matter for planning are either absent from the document or depend on decisions taken elsewhere.

No date for a potential DORA proposal. The programme refers to a potential legislative proposal but gives no date for it. The statutory timetable is set by DORA itself. Under Article 58(1) of Regulation (EU) 2022/2554, the Commission must, after consulting the ESAs and the ESRB as appropriate, carry out a review by 17 January 2028 and report to the European Parliament and the Council, accompanied where appropriate by a legislative proposal. That is a deadline for the review and report, not a date on which any new rules would take effect. The EBA's Single Programming Document for 2026 to 2028 also refers to the Commission's review of DORA foreseen by 17 January 2028.

No description of the Master Data study. The programme names the feasibility study but says nothing about its scope or expected conclusions.

No specific reporting overlaps. Burden reduction in reporting is named as a possibility, without identifying which requirements are in scope.

EFIF deliverables may change. The innovation outputs remain subject to further discussion with EFIF members.

SFDR work depends partly on the legislative review. While observing the legislative procedure to review the SFDR, the ESAs will, if required, deliver technical standards or technical advice, possibly including some consumer testing of the changes coming from the revised framework. The expected output is preparation for future empowerments or mandates in a reviewed SFDR. In parallel, the ESAs will continue to monitor the application of existing SFDR obligations to promote supervisory convergence and provide guidance on practical application where necessary.

No anti-money laundering content. AML does not feature in the programme.

6. Practical steps for 2027

These steps are my own response to the programme rather than anything it requires.

1. Keep the register of information accurate. Review its data quality and ownership before the next submission cycle, rather than correcting it under time pressure.

2. Document incident classifications. Check that each classification decision is recorded and consistent with the DORA criteria, including decisions that an incident was not major.

3. Assign ownership for the DORA review. Someone in the second line should track Commission and ESA publications on the review, with the Article 58(1) date of 17 January 2028 in view, so that any proposal is assessed when it appears.

4. Monitor proposed PRIIPs KID changes. If your firm manufactures or distributes PRIIPs, follow the Retail Investment Strategy negotiations and any draft standards from the ESAs. Avoid committing to KID changes that depend on the final legislative text. Updates required under the existing PRIIPs rules still need to be made as they fall due.

5. Record the analysis behind tokenisation projects. If your firm is exploring DLT or tokenised instruments, document the regulatory analysis for each use case and consider whether an innovation facilitator could help clarify open questions.

Know what is coming before it arrives. CPDs.Academy publishes regulatory analysis like this alongside CPD seminars built for compliance professionals at EU regulated firms.

Explore seminars at cpds.academy

Sources

This article is provided for information and CPD purposes only. It does not constitute legal or regulatory advice.