When a supervisor writes about AI, a fund firm needs one answer: does this
change what we must document, test or sign off? This page tracks the AI rules, supervisory
statements and enforcement actions that reach fund managers, administrators and depositaries.
What appears: laws, rules, supervisory statements and enforcement
actions that a regulator, supervisor or legislator has published, with a date. Each links to the issuer's own document.
What does not: commentary on a rule, which is not a rule.
Coverage: the EU, UK, Luxembourg, Ireland, Jersey and Guernsey first. Other
jurisdictions appear when their statements reach fund firms here.
For AI that fund firms have deployed, see AI news for
funds. For the controls that apply job by job, see the use cases.
As at 2026-10-12 · Source: the issuer's document linked on each item (dated per item) ·
Limitations: coverage starts with the EU, UK, Luxembourg, Ireland, Jersey and Guernsey.
EU AI Act: which dates apply
The EU AI Act applies in steps. The prohibited practices and the AI literacy duty
have applied since February 2025; the high-risk rules come later.
1 Aug 2024In force The AI Act enters into force.
2 Feb 2025AppliesProhibited practices and the AI literacy duty. Firms that deploy AI take measures to give their staff a sufficient level of AI literacy (Article 4).
2 Aug 2025Applies Obligations for providers of general-purpose AI models.
27 Jul 2026In force The AI Omnibus amends the timetable for the high-risk rules.
2 Dec 2027NextHigh-risk rules for the Annex III areas.
2 Aug 2028Later High-risk rules for AI built into regulated products.
Who it affectsCompliance and riskFund operationsTechnology
The AI Act entered into force on 1 August 2024. The prohibited practices and the AI
literacy obligation have applied since 2 February 2025, and the general-purpose AI model
obligations since 2 August 2025. The AI Omnibus has been in force since 27 July 2026. It
moves the rules for high-risk systems in the Annex III areas to 2 December 2027, and for AI
built into regulated products to 2 August 2028. In practice: the AI literacy duty already applies to
any fund firm whose staff use AI tools. A training record per team is the evidence a
supervisor or auditor will ask for first.
Who it affectsCompliance and riskPortfolio management
ESMA's public statement expects firms that use AI to comply with the existing MiFID II
requirements. It points to organisational arrangements, conduct of business and the duty to
act in the client's best interest. No new rulebook: the AI tool sits inside
the controls the firm already has. In practice: for a manager with MiFID top-up permissions,
an AI tool used in advice or portfolio management gets the governance, outsourcing and
record-keeping treatment of any other system. It needs a named owner.
How to read a regulatory item
Is it binding? A regulation or a rule change binds. A speech, a discussion
paper or a "Dear CEO" letter shows where supervision is heading.
Who does it reach? Many AI statements are written for banks or retail
investment firms. They reach a fund manager through its MiFID top-up permissions or its
delegates.
What evidence does it imply? Most statements end in a request for a
register, a policy, a training record or a named owner.
In practice: keep one AI register per firm, listing each tool, its owner, the data it
touches and where the human sign-off sits. That register is the document these statements
end up asking for.
To verify
AI literacy after the Omnibus: the Commission's November 2025 Omnibus proposal would have moved the Article 4 literacy duty from firms to Member States and the Commission. Confirm the adopted text in the Official Journal before relying on the literacy duty as it stands above.