AI in action · Regulation

The World's Securities Regulators Now Have a Shared Playbook for Supervising AI

In May 2026 IOSCO, the global body of securities regulators, published a supervisory toolkit for AI in capital markets: non-binding, but the first common framework for how national regulators should examine the AI systems that brokers, exchanges and fund managers use.

Oct 16, 2026

The International Organization of Securities Commissions (IOSCO) brings together the securities regulators of more than 130 jurisdictions, including the SEC, ESMA's members and the FCA. On May 25, 2026, its Fintech Task Force published the final report Supervisory Toolkit for AI Use in Capital Markets, according to Norton Rose Fulbright's Regulation Tomorrow, which covers the full lifecycle of AI systems from traditional machine learning to generative and agentic AI.

The toolkit is explicitly "practical, non-binding, non-prescriptive" and is written for regulators rather than firms. It has three layers. The first identifies the areas where supervisors should focus their attention. The second sets out detailed tools in four areas — governance and risk management, third-party and outsourcing risk, disclosure, and recordkeeping and reporting — with example questions for supervisory dialogue and examination planning. The third suggests indicators for monitoring AI adoption and the ways to gather them: on-site inspections, targeted surveys, requests for documentation and data.

The documents the report lists as examples of what supervisors can ask for tell firms what to prepare: an AI risk management framework, an inventory of AI systems with technical descriptions, independent model validation reports and incident response procedures.

Why it matters to investors: AI rules in financial markets are being written by national regulators — FINRA's 2026 oversight report in the United States, ESMA's February briefing on algorithmic trading in Europe — and this is the first attempt to give them a common vocabulary. A broker that can show a model inventory and validation reports is one whose AI has been checked by someone other than its own marketing team.

The toolkit builds on IOSCO's 2025 consultation on AI use cases, risks and challenges; the next phase looks at industry practices in governance, disclosure and recordkeeping. Nothing in it is a rule yet. It is, however, the checklist the rules are likely to be built from.

Sources: Norton Rose Fulbright, Regulation Tomorrow — IOSCO final report: Supervisory Toolkit for AI Use in Capital Markets (May 26, 2026); IOSCO — Supervisory Toolkit for AI Use in Capital Markets, final report FR/02/2026 (May 2026)