EU AI Act Meets MiCA in 2026: Compliance Requirements US AI-Crypto Projects Cannot Ignore

US relevance up front: Neither the EU AI Act nor MiCA has a US federal analog — but both reach US companies directly. A Delaware-incorporated AI-crypto project with no European office can be pulled into both regimes simultaneously: into the AI Act because its model output is used in the Union (Regulation (EU) 2024/1689, Art. 2(1)(c)), and into MiCA because it solicits EU clients (Regulation (EU) 2023/1114, Art. 59). With MiCA’s transitional grandfathering window under Art. 143(3) closed as of July 1, 2026 and the AI Act’s Annex III high-risk obligations now phasing in, US teams building AI agents, AI-driven trading tools, or AI-scored lending on-chain are in the first cohort to face overlapping enforcement. This guide maps where the two regimes actually intersect, and what US counsel should do about it.

Key Takeaways

• Extraterritorial reach is the trigger, not incorporation. AI Act Art. 2(1)(a) and 2(1)(c) capture non-EU providers and deployers whose systems are placed on the EU market or whose output is used in the Union. MiCA Art. 59 requires authorization to offer crypto-asset services in the EU, and the Art. 61 reverse-solicitation carve-out is drafted narrowly and read narrowly by ESMA.
• Most AI crypto-trading bots are not high-risk under the AI Act — but that is not a safe harbor. Algorithmic trading does not appear in Annex III. The binding obligations for those systems come from MiCA (Arts. 66, 68, 92) and DORA, not from AI Act Chapter III.
• AI-based creditworthiness scoring is the crypto use case that is high-risk. Annex III, point 5(b) covers AI used to evaluate the creditworthiness of natural persons — squarely relevant to undercollateralized DeFi lending and CeFi credit lines offered to EU consumers.
• “AI washing” is enforceable on both continents. In the EU it is a MiCA white paper and marketing-communications problem (Arts. 6, 7, 15); in the US it is a Securities Act §17(a) / Advisers Act §206(4) problem, as the SEC’s Delphia and Global Predictions settlements (March 2024) established.
• The hardest unresolved question is who counts as the “provider.” AI Act Art. 3(3) and Art. 25 assume an identifiable entity that places a system on the market under its own name. Decentralized AI compute and model networks have no such entity, and no EU guidance yet resolves it.

Two Regimes, One Product

The EU AI Act (Regulation (EU) 2024/1689) is product-safety legislation. It classifies AI systems by risk tier and imposes engineering, documentation, and governance duties on the entity that builds the system (the “provider,” Art. 3(3)) and lighter duties on the entity that uses it professionally (the “deployer,” Art. 3(4)).

MiCA (Regulation (EU) 2023/1114) is financial-services legislation. It regulates who may issue crypto-assets and who may provide crypto-asset services, and it is technology-agnostic — MiCA does not care whether your order-routing engine is a neural network or a spreadsheet macro. It cares that the service is authorized, governed, and free of market abuse.

The compliance burden falls in the overlap. A US firm running an AI portfolio-management service for EU retail clients needs MiCA authorization under Art. 59 for the service, must meet the suitability and competence requirements of Art. 81 for the advice, must satisfy AI Act Art. 50 transparency if clients interact with a chatbot, and must comply with DORA (Regulation (EU) 2022/2554) for the ICT resilience of the model stack — including third-party AI vendors, who become regulated ICT third-party service providers.

Where the AI Act Actually Bites for Crypto

Prohibited practices (Art. 5). The highest penalty tier — up to €35 million or 7% of global annual turnover (Art. 99(3)) — attaches to Art. 5, which bans subliminal or manipulative techniques and exploitation of vulnerabilities that materially distort behavior and cause significant harm. Gamified, AI-personalized trading interfaces that push retail users toward higher-risk positions are the crypto fact pattern regulators have publicly flagged. This is the exposure most product teams underestimate.

High-risk (Art. 6, Annex III). For crypto businesses the live entries are Annex III point 5(b), creditworthiness evaluation of natural persons, and Annex III point 4, employment and worker management (relevant to any firm using AI screening, regardless of sector). Classification as high-risk triggers the full Chapter III stack: risk management (Art. 9), data governance (Art. 10), technical documentation (Art. 11), automatic logging (Art. 12), transparency to deployers (Art. 13), human oversight (Art. 14), accuracy and cybersecurity (Art. 15), conformity assessment (Art. 43), an EU declaration of conformity (Art. 47), and registration in the EU database (Art. 49). Deployers pick up Art. 26 duties, including human oversight by competent staff and log retention. Art. 6(3) offers a derogation for systems performing narrow preparatory or filtering tasks, but Art. 6(4) requires documenting and registering that assessment — the derogation is not self-executing.

Transparency (Art. 50). Applies regardless of risk tier. Users must be told they are interacting with an AI system; synthetic audio, image, video, and text must be marked in machine-readable format. AI-generated marketing copy, token documentation, and support agents all sit here.

General-purpose AI models (Arts. 51–55). Providers of GPAI models owe technical documentation, downstream information, a copyright policy, and a sufficiently detailed public summary of training content (Art. 53). Art. 51(2) presumes systemic risk above 10²⁵ FLOP of cumulative training compute. Art. 53(2) exempts models released under a free and open-source license, absent systemic risk — a meaningful carve-out for open-weight decentralized AI projects, though it does not extend to systems built on top of those weights.

AI literacy (Art. 4). Often missed: providers and deployers must take measures to ensure a sufficient level of AI literacy among staff operating AI systems. It applies across risk tiers and has been in force since February 2, 2025.

Where MiCA Bites

Disclosure and AI washing. MiCA Art. 6 requires a crypto-asset white paper to be fair, clear, and not misleading; Art. 7 extends that to marketing communications; Art. 15 attaches civil liability to white paper information. A token marketed on AI capabilities that do not exist creates a documented, dated, publicly filed misstatement. The same facts in the US supported the SEC’s settled charges against Delphia and Global Predictions in March 2024 and Rimar Capital later that year.

Governance and conduct. Art. 66 requires CASPs to act honestly, fairly, and professionally in clients’ best interests. Art. 68 requires sound governance arrangements and, read with DORA, resilient ICT systems. A poorly monitored AI execution model is a governance failure under Art. 68 well before it is an AI Act failure.

Market abuse. Title VI (Arts. 86–92) prohibits insider dealing and market manipulation. Art. 92 requires persons professionally arranging or executing transactions to maintain effective systems to prevent and detect market abuse and to report suspicions. MiCA contains no intent requirement that would excuse an autonomous agent: if an AI system’s trading pattern constitutes manipulation under Art. 91, the operator’s lack of manipulative intent is a mitigation argument, not a defense.

The Data Layer: GDPR and Immutability

GDPR sits underneath both regimes and is where blockchain-specific tension is sharpest. Art. 22 restricts solely automated decisions producing legal or similarly significant effects — directly implicated by automated credit or eligibility scoring. Art. 17 erasure rights collide with on-chain immutability; the EDPB’s 2025 draft guidelines on blockchain processing take the position that controllers should avoid placing personal data on-chain in the first place, which effectively forecloses several on-chain AI-training designs. Art. 35 DPIAs will be required for most high-risk deployments, and can be run jointly with the AI Act Art. 27 fundamental rights impact assessment where that applies.

How This Reads Against the US Framework

The US has no horizontal AI statute. The SEC’s 2023 predictive data analytics proposal (Rel. Nos. 34-97990; IA-6353) was formally withdrawn in June 2025, leaving enforcement to run through existing antifraud and supervisory authority: Securities Act §17(a), Exchange Act §10(b) and Rule 10b-5, Advisers Act §206(4) with Rules 206(4)-1 and 206(4)-8, FINRA Rules 2210 and 3110 (see FINRA Regulatory Notice 24-09), and CFTC staff guidance on AI use in regulated markets. On the crypto side, the GENIUS Act (enacted July 18, 2025) settled payment stablecoins federally, while comprehensive market structure legislation remains unfinished.

State law is where US divergence is emerging: Colorado’s SB 24-205, Texas’s HB 149 (TRAIGA), and California’s SB 53 create obligations that partially rhyme with the AI Act but are not interoperable with it. The practical consequence for US AI-crypto firms is favorable in one respect: the AI Act Art. 11 technical file, Art. 12 logs, and Art. 9 risk-management records are strong evidence of reasonable supervision under FINRA Rule 3110 and of a reasonable basis under the Marketing Rule. Build the documentation once; use it in both jurisdictions.

Areas of Genuine Regulatory Uncertainty

• Provider identification in decentralized systems. Art. 25 shifts provider status to anyone who puts their name on a system, substantially modifies it, or changes its intended purpose. Applied to a DAO governing an AI model, that could sweep in delegates and contributors — the same unbounded-liability problem the CFTC pressed in CFTC v. Ooki DAO (N.D. Cal. 2022). No EU guidance addresses it.
• Autonomous agent wallets. Whether an AI agent transacting on a user’s behalf makes the operator a CASP performing transfer or execution services under MiCA Arts. 78 and 82 is unresolved.
• Timeline volatility. The Commission’s Digital Omnibus package proposed deferring certain Annex III high-risk obligations. Confirm the enacted application dates for your specific Annex III category before finalizing any remediation calendar — do not rely on the original Art. 113 schedule.
• Sectoral guidance gap. ESMA and the EBA have not issued MiCA-specific AI guidance. The closest signal is ESMA’s May 2024 public statement on AI in retail investment services, framed under MiFID II.

What to Do Now

1. Run a jurisdictional trigger test first. Document whether EU users receive your model’s output (AI Act Art. 2(1)(c)) and whether you solicit EU clients (MiCA Art. 59). If both are no, document that conclusion and stop. If either is yes, proceed — and do not rely on reverse solicitation without written analysis.
2. Inventory every AI system and assign a role and a tier. For each system, record: provider or deployer under Arts. 3(3) and 3(4); risk tier under Arts. 5, 6, and 50; and whether a GPAI model is involved. Where you claim the Art. 6(3) derogation, document the assessment as Art. 6(4) requires.
3. Audit AI claims in every public document. Reconcile the white paper, website, pitch decks, and marketing against what the model actually does. Discrepancies are simultaneously a MiCA Art. 6/7/15 exposure and a Securities Act §17(a) exposure.
4. Instrument logging and human oversight before you need them. Automatic, tamper-evident logs (Art. 12) with defined retention, plus named humans with authority to halt the system (Art. 14). These records are also the evidentiary backbone for a MiCA Art. 92 market-abuse defense.
5. Map AI vendors into your DORA register. Third-party model and inference providers are ICT third-party service providers. Contracts need DORA-compliant terms and exit plans.
6. Run the GDPR analysis in parallel, not after. Complete the Art. 35 DPIA jointly with any Art. 27 fundamental rights impact assessment, and confirm no personal data is written on-chain.
7. Deliver Art. 4 AI literacy training and keep attendance records. It is the cheapest obligation in the regulation and the easiest to be caught having skipped.

This content is for informational purposes only and does not constitute legal advice. Consult with a qualified US attorney for guidance specific to your situation.