AI and Investment Services in EU Law: the Case for MiFID III

Abstract The financial sector’s growing reliance on Artificial Intelligence (AI) raises important questions about whether current European Union (EU) regulations can handle the risks involved. This article examines how well existing EU rules work for the use of AI in investment services. Since AI’s impact shows up primarily through information handling—customer profiling and regulatory reporting—and suitability assessments for client investments, we identified three key risk areas specific to investment services: (1) data quality problems; (2) mismatches between clients and suitable investments; and (3) broader market structure effects. When we tested these risks against current EU regulations, we found some significant gaps. In particular, MiFID II, which is technologically neutral, lacks binding AI provisions and relies on fragmented soft-law guidelines from European Securities and Markets Authority (ESMA); meanwhile, the AI Act does not classify most investment services as ‘high risk,’ meaning stricter governance requirements do not apply. Although ESMA’s guidance and the AI Act overlap in some useful ways, notable gaps remain—particularly around traceability, auditability, and oversight of AI-driven operations. This leaves regulators with two main options: either expand the AI Act to cover more investment services as high risk, or build AI-specific safeguards directly into financial services law. We argue for the latter—updating MiFID II with explicit, binding AI provisions that align with the AI Act’s principles while addressing sector-specific risks, fairness concerns, and market integrity issues.