MiCA, DORA, the AI Act and NIS2: How the EU Rulebook Is Pricing Start-Ups and Small Companies Out of Europe

I make my living from EU regulation. Clients come to us because MiCA, the anti-money-laundering rules and the rest of the European rulebook are too much to handle alone, and we handle it for them. So this is not a complaint from someone who loses when Brussels writes a new law. If anything, I gain.

And still, looking at what has landed on small and medium-sized businesses (SMEs) over the last few years, I think Europe is making a mistake. It is not one badly written act. It is the sum of all of them, the speed at which the EU corrects itself, and the fact that the bill lands on the companies least able to pay it. Our position on AI regulation specifically is set out in a separate piece; this one is about the pattern across the whole rulebook.

One Layer on Top of Another

Here is what EU regulation now asks of a European company, depending on what it does.

• GDPR for anyone who holds personal data.
• The Digital Services Act and the Digital Markets Act for online platforms and marketplaces.
• The Data Act for connected devices and cloud contracts.
• NIS2 and the Cyber Resilience Act for cybersecurity and for products with software inside.
• MiCA for crypto-asset services.
• DORA for banks, payment and crypto firms, and the IT suppliers who serve them.
• The AI Act for anyone who builds AI systems or uses them in their business.
• The new AML Regulation with an EU-level supervisor, AMLA.
• eIDAS 2.0 with its digital identity wallets.
• Reporting duties on crypto transfers (the travel rule), crypto tax data (DAC8), sustainability (CSRD) and supply chains (CSDDD).

None of these is minor. Each has its own definitions, forms, supervisor and fines. A fintech with twelve employees can sit under five or six of them at once.

Each Law Is Defensible. The Pile Is Not

Taken alone, each of these laws answers a real question. Customer money should not vanish when a crypto exchange collapses, a bank should not stop working because its cloud provider had a bad night, and nobody wants software deciding who gets a loan with no human able to check the result. Argue against any one of these laws on its own and you lose, as you should.

The problem is the sum, and the problem is the clock. The Commission proposed the AI Act in April 2021 and the EU adopted it in 2024. Its main rules for high-risk AI, such as systems used in hiring, credit scoring or education, were due to apply on 2 August 2026. In July 2026, weeks before that date, the EU passed a correction called the Digital Omnibus on AI. It pushed the rules to December 2027, and to August 2028 for AI built into regulated products. The official reason was that the technical standards and the national supervisors were not ready. Five years after the proposal, the machinery meant to enforce the law did not exist. Companies that had spent two years preparing for August had been preparing for a date that moved.

That is what slow means in practice. The laws arrive. The corrections arrive two or three years after everyone can see the problem, in the form of yet another regulation.

Why the Same Rules Cost a Small Business More

This is the part that bothers me most. The cost of compliance barely depends on the size of the company. A policy manual, a register of IT suppliers, an incident-reporting procedure, an external audit, a licence application: these cost roughly the same whether you serve 50 clients or 5 million.

DORA is the clearest case. In Deloitte’s survey of financial institutions across 28 European countries, published in March 2025, about two thirds of the respondents expected to spend between €2 million and €5 million on compliance, and only one in ten expected to stay under €2 million. A large bank absorbs that. A payment institution with twenty employees cannot, and for the smallest firms the compliance bill can exceed what the EU market is worth to them.

MiCA tells the same story in numbers. Before MiCA, by industry counts, more than a thousand companies held national crypto registrations across the EU. The transitional period ended on 1 July 2026, and by October 2026 ESMA’s register listed about 370 authorised providers. Some of the missing firms deserved to go. Many others were small, local and legal, and they went because a MiCA licence (CASP authorisation) costs six figures in advisers, capital and management time that a two-founder exchange does not have. I have looked at what MiCA did to Europe’s crypto start-ups separately; here it is one example of a wider pattern.

The large players rarely complain. For a well-funded incumbent each new act is a moat: the compliance team is already there, the lawyers are on retainer, and every new rule raises the entry ticket for anyone who wants to compete. Regulation written to protect consumers ends up protecting market share.

Where the Founders Go

Start-ups are mobile in a way that banks are not. A founder with an idea and a laptop compares countries the way the rest of us compare flights. When Apple and Meta decided in 2024 to hold back new AI features from EU users, citing the Digital Markets Act and an “unpredictable” regulatory environment, the headlines were about two giants. The quieter effect fell on every European developer who wanted to build on those models and now had to wait, or move.

In my own work the pattern is less dramatic but just as steady. The question founders ask has shifted from “can we get a licence in Estonia” to “is a European licence worth it at all compared with Dubai, Singapore or a US state”. A few years ago that second question was rare. Today it is routine, and I cannot always argue them out of it.

The numbers say the same. A European Investment Bank study published in January 2026 found that between 2008 and 2021 nearly 30% of European unicorns, start-ups valued at over $1 billion, moved their headquarters out of the EU. Most went to the United States, and digital technology, AI and biotech led the way. Mario Draghi said the rest in his September 2024 report on European competitiveness: the regulatory burden puts too many constraints on innovation and makes it hard for start-ups to grow. Two years on, by the count of the Draghi Observatory at the European Policy Innovation Council, only 16% of the measures it tracks had been fully implemented. The diagnosis is accepted. The treatment is slow.

Why Tallinn Cannot Fix What Brussels Wrote

Estonia is a good place to watch this from. It is small, digital and generally sensible about business. On this issue it is also close to powerless.

MiCA, DORA and the AI Act are regulations, not directives. A directive sets a goal and lets each country write its own law; a regulation applies word for word in every member state, and no parliament in Tallinn, Vilnius or Lisbon can soften a single article. The national margin runs in one direction only: a country can always be stricter than Brussels, but it cannot be lighter.

So when a founder tells me that Estonia should “just fix this”, I have to explain that the fix sits with 27 governments, a Commission, a Parliament and a legislative cycle measured in years. Since the start of 2025 the Commission has tabled twelve “omnibus” packages, each amending several laws at once, and promised to cut administrative burden by at least 25%, and by 35% for SMEs, before the end of its mandate. Business associations say the result so far is nowhere near those figures. I believe them, because I read the texts.

Europe Is De-Risking Itself

Anyone who has dealt with a bank in the last few years knows the word de-risking. A client looks slightly unusual, the cost of monitoring him exceeds the fees he pays, and the account is closed. No fraud, no breach, just a cheaper decision for the bank. The client goes to find another bank, often in another country, and the bank’s risk report looks better than before.

I increasingly think the European Union does the same thing with whole sectors. Crypto looked risky, so Europe built MiCA and watched most of the nationally registered firms drop out. AI looks risky, so Europe wrote the world’s first comprehensive AI law before it had an AI industry large enough to argue back. Each time the risk goes down, and each time the activity that carried the risk goes down with it. On a balance sheet that counts only risks avoided, this is a success. On one that counts companies founded and jobs created, it is not.

There is a quieter mechanism underneath. An institution whose output is measured in regulations will produce regulations. Each act needs guidelines, technical standards and Q&As, then a supervisor to apply them, then an omnibus to repair what the guidelines broke. Every step adds staff who will be needed for the next act. Nobody in this chain acts in bad faith. The process simply has no built-in reason to stop, and nobody inside it pays for the start-up that was never founded.

Three Scenarios for European Start-Ups

To make this concrete, here is where I think the start-up side of the European economy is heading. The baseline comes from Dealroom: roughly 14,800 start-ups are founded in the EU each year, about 4,400 of them raise outside funding, and the EU is home to around 450 unicorns. Europe as a whole, the UK included, took a record 19% of global venture capital in 2023 and 16% in 2024, while the United States took 57%.

Why a decline rather than a collapse in the first scenario? Because the rulebook hits founders at the decision point, not existing companies. A bank in Frankfurt does not leave over DORA. A three-person AI start-up in Tartu simply registers in Delaware instead and keeps the developers at home. The EU loses the headquarters, the tax base and the exit, and keeps the payroll for a while.

And why is the third scenario not a fantasy? Because its figures are close to where Europe already stood at its best: a 19–20% share of global venture capital is the level reached a few years ago, before the current layer of rules started to apply. Writing EU regulation with small businesses in mind would not have cost Europe its consumer protection. It would have cost it a few paragraphs of drafting.

The Case for the Other Side

I would not deserve to be taken seriously if I pretended the rulebook had no upside, so here it is. One MiCA licence lets a company serve clients in all 30 EU and EEA countries; before it, a crypto firm needed 27 separate conversations with 27 regulators. GDPR became the global template for privacy law. A single AML regulation should, in theory, end the situation where a client accepted in one member state is rejected in the next. Harmonisation is a real good, and I benefit from it every day.

The honest trade-off is this. Harmonisation at European scale is bought with speed, and with a cost structure that falls hardest on the smallest. Europe has decided, mostly by default, that it prefers a safe market to a fast one. That is a legitimate choice. I just think it should be made openly, with the price attached, instead of being discovered one omnibus at a time.

What Europe Should Do Instead

My position is not that Europe should stop regulating. It is that Europe should stop regulating a three-person start-up as if it were a bank. A small team cannot run a compliance department, and a law that quietly assumes one is not a safety rule but a barrier to entry. Six changes would remove most of the damage, and none of them is radical: each has a precedent somewhere in EU law already.

1. Real size thresholds, written into the act. Below the EU’s own definition of a small enterprise (fewer than 50 staff and under €10 million in turnover) the heavy obligations should not apply at all, or should apply in a short, fixed form. GDPR already does this for record-keeping under Article 30(5), which exempts most organisations with fewer than 250 employees, and in 2025 the Commission proposed widening that exemption. The same logic belongs in DORA, NIS2 and the AI Act.
2. Standards before the law applies. No obligation should take effect until the technical standards exist and at least one supervisor in each member state is ready to apply them. The AI Act delay proved the point the hard way. The rule should be written down, so that the next act does not need an omnibus to rescue it.
3. Sandboxes first, enforcement second. A new sector should get a supervised testing period in which a company can operate with the regulator watching before full licensing is required. The AI Act promises such sandboxes, but they were postponed to August 2027, after some of the obligations. The order should be the other way round.
4. One supervisor per company. A fintech with twelve people may today answer separately to the financial supervisor, the FIU, the data protection authority and soon an AI authority. GDPR’s one-stop-shop, where a single lead authority handles a company, shows the model. It should be extended across the rulebook.
5. An expiry date in every act. If a regulation lapses unless it is re-confirmed after a real review of its costs, correction becomes mandatory rather than a political favour. The omnibus becomes the rule, not the rescue.
6. Count the company that was never founded. Every EU impact assessment measures the cost to existing businesses. None measures the start-ups that chose Delaware, Dubai or Singapore instead. Until that number is on the table, the people drafting the next act will keep underestimating what it costs.

None of this means copying the United States, which still has no comprehensive federal AI law and only a patchwork of state rules, or the UK, which has so far chosen not to pass a single AI act and asks its existing regulators to apply a set of principles instead. It means admitting that these are the places a European founder now compares Europe against. Add EU Inc., the single European company form proposed in March 2026, with registration in under 48 hours for less than €100 and no minimum capital, as the Commission promises, and Europe would have an offer that a small team can actually take up.

What I Tell Founders

My advice to founders has become boringly practical. Treat compliance costs as a line in your cost of goods, not as a one-off legal fee. Choose your EU country by the quality of its regulator and the speed of its register, because the rules themselves will be the same everywhere. Use the transition windows and omnibus delays as time to build rather than as permission to ignore the law; the AI Act’s high-risk rules were postponed, not cancelled. And if your business model only works outside the EU rulebook, admit it early, before the licence application rather than after.

Building a Company in Europe Despite the Rulebook

Europe is still a good place to run a company, and I tell clients that every week. The point of this piece is not to talk anyone out of Estonia or the EU. It is to say that EU regulation is a real cost and should be priced in from the first day. The right structure, the right licence route and the right country inside the EU make a bigger difference now than they did five years ago. If you are weighing those choices for a new or existing company, our team at Eesti Firma can walk you through what the rules will actually mean for your case, from company formation to licensing.

Send a Request