By Antonio Tejeda Encinas | CEO, META Channel Corporation | President, CEA Digital Law (Euro-American Committee of Digital Law)
The European AI Act, the Digital Omnibus and the reality Europe can no longer ignore (Part II)
Yesterday, in my article “European AI Act, the Digital Omnibus and the reality that Europe can no longer ignore“, I explained how the Omnibus has once again got ahead of a market that is not yet ready. Today I want to focus on the immediate consequence of all this.
The Digital Services Omnibus does not arrive alone
It is the gateway to a second wave of regulation that will unfold between 2025 and 2026 and will, once again, put pressure on the same structural fault line: Europe legislates as if every company were a multinational, yet expects the same level of compliance from those that are not.
Between 2025 and 2026, what arrives is not new regulation but regulatory convergence. For the first time, the AI Act, DORA, MiCA, ESG and AML will require simultaneous, interlocking compliance. They are not isolated pieces you can tackle one after another: they form a mesh that only works if you manage it as a system.
Yesterday’s analysis of the Omnibus already revealed the pattern: rules that run ahead of the market’s real operational capacity, requirements designed for giant structures, and small print that makes no distinction between those with a global compliance department and those simply trying to stay afloat while they grow.
The problem is that the Omnibus is no exception. It comes alongside the full application of DORA, the implementation of the AI Act, the roll-out of MiCA, the new sustainability and ESG reporting standards and the strengthening of the anti-money laundering (AML) framework. Together they form a mesh that only those who were already operating in multinational mode before all this can manage well.
Three market levels, one regulation
To understand who can bear this mesh and who cannot, it is not enough to talk about “SMEs” or “innovative companies”. It is a convenient but useless label. What matters is not formal size but actual structure. And there, like it or not, the market operates on three levels.
First level: startups and early-stage companies. Speed, iteration, product. And almost no internal regulatory protection. When the Omnibus or the AI Act require traceability, data governance or sophisticated internal controls, the demand goes far beyond what a minimal structure can absorb without jeopardising its own survival.
Second level: exposed mid-caps. They are not small, they have clients, processes, sometimes an international presence. But they do not have a “multinational apparatus” behind them. They are the hardest hit by this model: too big to improvise, too small to replicate a global risk, legal and technology team in-house just to comply with the new regulatory ecosystem.
Third level: multinationals. Much of this regulation is, in effect, written for them. Distributed legal teams, constant monitoring of changes, the ability to redesign operations in several jurisdictions at once. They are the only ones playing on a field built to their measure.
The Omnibus and the 2025–2026 wave only widen this gap: the rules are uniform; the capacity to comply is not.
When five regulatory frameworks converge on the same operation
Let’s take a real case that is already happening: a European fintech that offers automated investment services with cryptoassets.
It collects personal data from its users to profile them (GDPR). It uses artificial intelligence algorithms for risk scoring and investment recommendations (AI Act, high-risk system). It handles stablecoins and utility tokens (MiCA). It processes digital payments and runs an online platform with more than 10,000 monthly active users (DSA). It has critical technology infrastructure for providing financial services (DORA). And it is required to report suspicious transactions and verify the source of funds (AML/CFT).
That company cannot deal with each regulation separately.
It cannot have a “GDPR project” that ends in March, an “AI Act project” that starts in April and a “MiCA project” that kicks off in June. Because all five regulations affect the same data, the same processes, the same automated decisions and the same technology infrastructure.
If you design your data governance with only the GDPR in mind, you will have to redo it when you face the AI Act’s traceability requirements. If you implement cybersecurity controls with only DORA in mind, you will find that MiCA’s risk management model requires something different. If you build your identity verification system with only AML in mind, you will discover that the DSA has specific transparency requirements for automated systems that you had not considered.
That is regulatory convergence: complying properly with one regulation means having understood how it intersects with the other four.
And this is not a theoretical problem. It is the day-to-day reality of any financial, technology or digital services company operating in Europe from now on. We are not talking about exotic sectors: we are talking about fintechs, insurtechs, SaaS platforms, marketplaces, cybersecurity firms, cloud providers — any business that uses AI to make automated decisions or handles sensitive data at scale.
And the problem is not that it is difficult. It is that it requires a compliance architecture designed as a system, not as a sum of parts.
That is exactly what the mid-market lacks. And what the large consulting firms do not know how to build for companies that are not already multinationals.
The gap that no one is filling
Between these three levels lies an operational space that almost no one is covering. Not for lack of talent, but because the current structure of the market makes it impossible to cover with traditional models.
Large consulting firms work in silos because they are designed to replicate multinational structures, not to create them from scratch. When your client already has a Chief Compliance Officer, a DPO, a CISO and a coordinated legal department, that model fits. When it doesn’t, you’re not buying solutions: you’re buying reports on why you need to hire more people.
It works when the client is already a corporation organised into compartments. But when the client is a startup or a mid-cap, that model no longer fits. Not just because of the cost: structurally, there is no point transferring a multinational architecture to someone who is not built to sustain it.
And at the same time, businesses cannot afford to improvise or fly blind. The regulatory wave arriving between 2025 and 2026 demands real capability, not good intentions. It demands translating rules designed for the “global tier” into manageable processes for companies that still have to sell tomorrow.
Where META Channel Corporation operates
That’s where we operate. Not as a substitute for large consulting firms or as a “low cost” solution. We operate with a multinational logic without compartments, but without the inertia that makes that model inaccessible to the majority of the market.
This allows us to work at both ends: with companies running transactions of more than a million euros — where there is no longer any room for regulatory error — and with growing companies that need a solid architecture before regulation catches up with them.
It’s not a question of size. It is a question of structure, speed and real ability to execute.
And this new regulatory framework is making it clear: that combination is almost nowhere to be found. That is exactly where we work: turning multinational-level requirements into real operations for companies that cannot stop to build a multinational.
The decision has already been made
Europe has already made its decision: to legislate as if we all operated on a multinational scale. What the market has not yet come to terms with is that this means that only those who can execute at that level will survive, regardless of their formal size.
META Channel Corporation does not solve the problem of European overregulation.
It solves the problem of how to operate within it without breaking the company, or having to become a multinational in order to comply.
