By Antonio Tejeda Encinas | CEO of Meta Channel Corporation | President of the Euro-American Committee of Digital Law - CEA Digital Law
The European AI Act, the Digital Omnibus and the reality Europe can no longer ignore (part II)
Yesterday, in my article ‘AI Act europeo, el Digital Ómnibus y la realidad que Europa ya no puede ignorar’, I explained how the Omnibus has once again run ahead of a market that is not yet ready for it. Today I want to dwell on the immediate consequence of all this.
The Digital Services Omnibus does not arrive alone
It is the gateway to a second regulatory wave that will unfold between 2025 and 2026 and will once again strain the same structural fault line: Europe legislates as if every company were a multinational, yet expects the same level of compliance from those that are not.
What arrives between 2025 and 2026 is not new regulation but regulatory convergence. For the first time, the AI Act, DORA, MiCA and the ESG and AML rules will require simultaneous, interlocking compliance. These are not isolated pieces you can deal with one after another: they form a mesh that only works if you manage it as a system.
Yesterday’s analysis of the Omnibus already revealed the pattern: rules that outpace the market’s real operational capacity, requirements designed for giant structures, and small print that makes no distinction between a company with a global compliance department and one that is simply trying to stay afloat while it grows.
The problem is that the Omnibus is no exception. It arrives alongside the full application of DORA, the implementation of the AI Act, the roll-out of MiCA, the new sustainability and ESG reporting standards and the strengthening of the anti-money laundering (AML) framework. Together they form a mesh that can only be managed well by those who were already operating in multinational mode before any of this began.
Three market tiers, a single set of rules
To understand who can cope with that mesh and who cannot, it is not enough to talk about ‘SMEs’ or ‘innovative companies’. These are convenient but useless labels. What matters is not formal size but actual structure. And there, like it or not, the market operates on three tiers.
Tier one: start-ups and early-stage companies. Speed, iteration, product. And almost no internal regulatory armour. When the Omnibus or the AI Act demands traceability, data governance or sophisticated internal controls, the requirement goes far beyond what a minimal structure can absorb without jeopardising its own survival.
Tier two: exposed mid-caps. They are not small: they have clients, processes and sometimes an international presence. But they have no ‘multinational machinery’ behind them. They are the hardest hit by this model: too big to improvise, too small to replicate a global risk, legal and technology team in-house just to comply with the new regulatory ecosystem.
Tier three: multinationals. Much of this regulation is, de facto, written for them. Distributed legal teams, constant monitoring of changes, the capacity to redesign operations across several jurisdictions at once. They are the only ones playing on a pitch tailored to them.
The Omnibus and the 2025–2026 wave only widen this gap: the rules are uniform; the capacity to comply is not.
When five regulatory frameworks converge on a single operation
Take a real case, one that is already happening: a European fintech offering automated investment services in crypto-assets.
It collects its users’ personal data in order to profile them (GDPR). It uses artificial intelligence algorithms for risk scoring and investment recommendations (AI Act, high-risk system). It handles stablecoins and utility tokens (MiCA). It processes digital payments and runs an online platform with more than 10,000 monthly active users (DSA). It relies on critical technology infrastructure to provide financial services (DORA). And it is required to report suspicious transactions and verify the source of funds (AML/CFT).
That company cannot deal with each set of rules separately.
It cannot run a ‘GDPR project’ that ends in March, an ‘AI Act project’ that starts in April and a ‘MiCA project’ that kicks off in June, because all five regulations affect the same data, the same processes, the same automated decisions and the same technology infrastructure.
If you design your data governance with only the GDPR in mind, you will have to redo it when you come up against the AI Act’s traceability requirements. If you implement cybersecurity controls with only DORA in mind, you will discover that MiCA’s risk management model demands something different. If you build your identity verification system with only AML in mind, you will find that the DSA has specific transparency requirements for automated systems that you had not anticipated.
That is regulatory convergence: when complying properly with one regulation means having understood how it intersects with the other four.
And this is not a theoretical problem. It is the daily reality of any financial, technology or digital services company operating in Europe from now on. We are not talking about exotic sectors: we are talking about fintechs, insurtechs, SaaS platforms, marketplaces, cybersecurity firms and cloud providers – any business that uses AI to make automated decisions or handles sensitive data at scale.
And the problem is not that it is difficult. It is that it requires a compliance architecture conceived as a system, not as the sum of its parts.
That is exactly what the mid-market lacks. And it is what the big consultancies do not know how to build for anyone who is not already a multinational.
The gap nobody is filling
Between these three tiers lies an operational space that almost nobody is covering. Not for lack of talent, but because the current structure of the market prevents it from being covered by the traditional models.
The big consultancies work in silos because they are designed to replicate multinational structures, not to create them from scratch. When your client already has a Chief Compliance Officer, a DPO, a CISO and a coordinated legal department, that model fits. When it does not, you are not buying solutions: you are buying reports on why you need to hire more people.
It works when the client is already a corporation organised in compartments. But when the client is a start-up or a mid-cap, the model no longer fits. Not just because of the cost: structurally, there is no point in transplanting a multinational architecture into an organisation that is not built to sustain it.
At the same time, businesses cannot afford to improvise or operate blind. The regulatory wave arriving between 2025 and 2026 demands real capability, not good intentions. It demands translating rules designed for the ‘global tier’ into manageable processes for companies that have to keep selling tomorrow.
Where META Channel Corporation operates
That is where we operate. Not as a substitute for the big consultancies, nor as a ‘low-cost’ solution. We work with a multinational logic but without the compartments, and without the inertia that puts that model out of reach for most of the market.
This allows us to work at both ends of the spectrum: with companies handling operations worth more than one million euros – where there is no longer any room for regulatory error – and with companies that are growing and need a solid architecture before regulation catches up with them.
It is not a question of size. It is a question of structure, speed and real capacity to execute.
And this new regulatory framework is making it clear: that combination is available almost nowhere. That is precisely where we work: turning multinational requirements into real operational capability for companies that cannot stop to build a multinational.
The decision has already been made
Europe has already made its decision: to legislate as if we all operated at multinational scale. What the market has yet to accept is that this means only those able to execute at that level will survive, regardless of their formal size.
META Channel Corporation does not solve the problem of European overregulation.
It solves the problem of how to operate within it without breaking the company, and without having to become a multinational in order to comply.
النشرة
فعاليات وأخبار وتحليلات في القانون الرقمي تصلك على بريدك، ولا نراسلك إلا حين يكون لدينا جديد.
