GDPR, MiCA and the AI Act: the EU Compliance Stack

If you build AI or blockchain products for the European market, you are now under three overlapping regimes with three separate timetables — and several of those dates have moved. Compliance plans written in 2025 are, in specific ways, wrong.

Here is the current state, with dates.

#The dates that matter right now

Two of these deserve emphasis because they are widely misread.

#The AI Act: relief on one track, a live deadline on another

The Digital Omnibus on AI has been adopted and is in force. It postponed the high-risk obligations: Annex III standalone systems to 2 December 2027, Annex I product-embedded systems to 2 August 2028.

Most coverage stopped at "the AI Act was delayed". That is the dangerous summary, because Article 50 transparency obligations took effect on schedule and were not deferred.

In practice Article 50 requires you to:

• tell a person when they are interacting with an AI system rather than a human
• mark AI-generated or AI-manipulated content in a machine-readable way
• label deepfakes

If you shipped a customer-facing assistant in 2025 on the assumption that nothing bit until 2027, that assumption expired three weeks ago.

What the deferral actually bought you: engineering time on high-risk classification and conformity assessment — the expensive part. It did not buy time on disclosure. Treat them as two separate workstreams with two separate clocks.

#MiCA: the transition is over

MiCA's substantive rules for crypto-asset service providers applied from 30 December 2024, with an 18-month transitional window for providers already licensed nationally. That window has now closed.

There is no extension mechanism. ESMA's statement was unambiguous: providers still relying on national transitional arrangements after that date must stop serving EU clients immediately. Operating without authorisation is now a breach of EU law, and the penalty framework reaches around €5m for illegal provision of services.

The upside for authorised firms is real: MiCA authorisation passports across the EU, which is a genuine improvement on the pre-2025 country-by-country patchwork.

The classification trap. MiCA does not cover everything with a token in it. If your token represents a share in a vehicle, profit rights or a claim on an underlying asset, it is likely a financial instrument under MiFID II — a stricter, older regime with prospectus, custody and trading-venue implications. Teams that budget for a MiCA authorisation and discover they need a securities process lose months. Get the classification opinion in writing before you build.

#GDPR: unchanged text, moving interpretation

GDPR has not been amended. What changed is how regulators apply it to AI.

The EDPB has adopted guidelines on web scraping in the context of generative AI (still open to public consultation at the time of writing). The core positions:

• Consent is generally not workable as a legal basis for scraping at scale.
• Legitimate interest is the primary route, but requires a documented three-part test: a legitimate purpose, necessity of the processing, and a balancing exercise confirming the interest is not overridden by individuals' rights.
• The test must be documented before processing, not reconstructed after a complaint.

Enforcement is not evenly distributed. Italy's Garante has been the fastest-escalating authority in Europe and issued the first AI-training-data fine. For companies operating in Italy, that is the most relevant enforcement risk on this list.

For AI products specifically, three GDPR obligations do most of the work:

1. Lawful basis, documented — especially for training data.
2. DPIA before deployment where processing is likely to be high risk.
3. Deletion that actually works — a right-to-erasure request must reach your vector store, your logs and your fine-tuning set, not just the primary database. This is an architecture decision made long before the request arrives.

#How to tell which rules you are under

Run your product through four questions:

1. Does it process personal data of people in the EU? → GDPR, regardless of where you are established.
2. Does a person interact with it, or does it generate content? → AI Act Article 50, live now.
3. Does it make or materially inform decisions in an Annex III domain (employment, credit, education, essential services, law enforcement)? → high-risk track, December 2027, design for it now.
4. Does it issue, custody or exchange crypto-assets? → MiCA if the token is a crypto-asset; MiFID II if it is a financial instrument. Get this in writing.

Most products answer yes to more than one. The obligations stack; they do not substitute for each other.

#What compliance-by-design means concretely

Not a policy document. Six architectural decisions:

• Disclosure in the UI, not the terms of service — Article 50 is satisfied by what the user sees.
• A data map that can answer "where does this person's data live" in minutes.
• Deletion that propagates across derived stores, embeddings and backups.
• Immutable audit logs of automated decisions, with inputs and rationale.
• Jurisdiction-aware processing so EU data stays where you promised.
• Documented lawful basis for every processing purpose, written before launch.

Retrofitting any of these after launch costs multiples of designing them in — and in the case of deletion propagation, sometimes cannot be done at all without a migration.

#Sources

• AI Omnibus enters into force — European Commission
• EU AI Omnibus enters into force, amending the AI Act — White & Case
• Postponed high-risk deadlines — Gibson Dunn
• The end of MiCA's transitional period — Elliptic
• MiCA and CASP rules for VASPs
• EDPB web scraping guidelines for generative AI — Reed Smith
• GDPR enforcement heat map — Secure Privacy