IOSCO Final Report: Supervisory Toolkit for AI Use in Capital Markets

Why It Matters

The toolkit equips regulators with a practical framework to manage AI‑driven risks, promoting market integrity and investor protection as AI adoption accelerates in capital markets.

Key Takeaways

• Toolkit spans AI lifecycle from development to deployment
• Covers traditional ML, GenAI, and emerging Agentic AI
• Provides supervisory questions on governance, outsourcing, disclosure, reporting
• Suggests indicators and data sources for AI monitoring
• Applies across regulatory models, non‑prescriptive for global use

Pulse Analysis

The International Organisation of Securities Commissions (IOSCO) has taken a decisive step toward standardising AI oversight in the financial sector. By issuing a supervisory toolkit that is both practical and non‑prescriptive, IOSCO acknowledges the rapid diffusion of artificial intelligence—from conventional machine‑learning algorithms to cutting‑edge generative and agentic models—within capital‑market participants. This move aligns with a broader regulatory push worldwide to embed technology risk management into the core of securities supervision, ensuring that AI does not compromise market fairness or systemic stability.

The toolkit’s three‑layer structure offers regulators a clear roadmap. The first layer outlines key supervisory considerations, helping authorities pinpoint high‑risk AI applications. The second layer delivers actionable tools for evaluating governance, third‑party risk, disclosure, and record‑keeping, complete with sample questions for supervisory dialogues and examinations. Finally, the third layer suggests concrete indicators and data‑collection techniques—ranging from targeted surveys to on‑site inspections—to monitor AI adoption trends. By covering the full AI lifecycle, the guidance enables supervisors to assess everything from model development and validation to ongoing monitoring and remediation, fostering a more resilient oversight ecosystem.

For market participants, the toolkit signals an expectation of heightened transparency and robust risk controls around AI deployments. Firms will likely need to formalise AI governance frameworks, document third‑party dependencies, and maintain detailed audit trails to satisfy supervisory inquiries. As regulators worldwide adopt similar approaches, the IOSCO toolkit could become a de‑facto benchmark, shaping global best practices and influencing how capital‑market firms design, implement, and report AI systems. This coordinated oversight may ultimately boost investor confidence and encourage responsible AI innovation across the industry.