Question 1

When does the EU AI Act apply outside the EU?

Accepted Answer

The EU AI Act can apply outside the EU where an AI system or general-purpose AI model is placed on the EU market, where an EU-based deployer uses the system, or where output produced by a third-country provider or deployer is used in the EU. Purely personal non-professional use, certain research and testing before market placement, and military, defence or national-security uses are excluded in specified circumstances.

Question 2

What counts as an AI system under the EU AI Act?

Accepted Answer

An AI system is a machine-based system designed to operate with varying levels of autonomy, which may adapt after deployment, and which infers outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments. The legal test focuses on function, autonomy, and output, not on whether a product is marketed as “AI”.

Question 3

Which AI practices are prohibited in the EU?

Accepted Answer

Prohibited AI practices include materially manipulative or exploitative systems causing or likely to cause significant harm, social scoring, certain criminal-risk assessments based solely on profiling or personality traits, untargeted scraping to build facial-recognition databases, workplace or education emotion recognition except for medical or safety reasons, sensitive-trait biometric categorisation, and real-time remote biometric identification for law enforcement except under narrow conditions.

Question 4

When is an AI system high-risk under the EU AI Act?

Accepted Answer

An AI system is generally high-risk where it is a regulated product or safety component requiring third-party conformity assessment, or where it falls within an Annex III high-risk use case. Some Annex III systems may be excluded where they do not pose significant risk or materially influence decision-making, but Annex III systems that perform profiling of natural persons remain high-risk.

Question 5

What transparency duties apply to chatbots and AI-generated content?

Accepted Answer

Direct interaction with an AI system must be disclosed unless it is obvious in the circumstances. Synthetic audio, image, video, or text outputs must be marked in machine-readable and detectable form where required, and deployers may need to disclose deepfakes or AI-generated public-interest text, subject to statutory exceptions.

Question 6

What obligations apply to general-purpose AI models?

Accepted Answer

Providers of general-purpose AI models must keep technical documentation, provide information to downstream AI-system providers, maintain a copyright-compliance policy, and publish a sufficiently detailed summary of training content using the AI Office template. The open-source exception is limited and does not apply to general-purpose AI models with systemic risk.

Question 7

How do data-protection rules interact with AI regulation?

Accepted Answer

The EU AI Act does not replace GDPR, ePrivacy, or other privacy and data-protection rules. Personal data used for training, inference, monitoring, profiling, or automated decision-making may separately require a lawful basis, transparency, minimisation, security controls, and a data protection impact assessment where the processing is likely to result in high risk.

Question 8

What does MiCA regulate?

Accepted Answer

MiCA creates uniform EU market rules for crypto-assets that are not already regulated under existing financial-services legislation. It covers, among other things, crypto-asset issuance and trading, transparency and disclosure requirements, authorisation, and supervision of crypto-asset service providers.

Question 9

How are crypto-assets classified under MiCA?

Accepted Answer

MiCA starts with the definition of a crypto-asset: a digital representation of value or rights that can be transferred and stored electronically using distributed-ledger or similar technology. It then distinguishes categories such as asset-referenced tokens, e-money tokens, and utility tokens; tokenised financial instruments may fall under separate financial-services regimes.

Question 10

Which crypto services can require CASP authorisation in the EU?

Accepted Answer

Crypto-asset services include custody and administration, trading-platform operation, exchange against funds or other crypto-assets, order execution, placing, reception and transmission of orders, advice, portfolio management, and transfer services. Article 59 MiCA prohibits providing crypto-asset services in the Union unless authorised as a CASP or otherwise allowed as an eligible financial entity.

Question 11

What does a CASP passport allow in the EU?

Accepted Answer

A CASP authorisation must specify the crypto-asset services covered. Within that authorised scope, a CASP may provide services throughout the Union through establishment, a branch, or freedom to provide services, without needing a physical presence in the host Member State.

Question 12

When can payment or e-money activity require EU authorisation?

Accepted Answer

Payment institutions and electronic-money institutions are authorised by national competent authorities, while account information service providers may be registered rather than authorised. PSD2 application materials vary by service and can include the programme of operations, business plan, initial capital, safeguarding arrangements, governance and internal controls, and suitability information for controllers and managers.

Question 13

When do AML and Travel Rule requirements apply to crypto transfers?

Accepted Answer

EU Travel Rule requirements apply to transfers of funds and certain crypto-asset transfers involving payment service providers, intermediary payment service providers, crypto-asset service providers, and intermediary crypto-asset service providers. EBA guidance addresses required accompanying information, missing or incomplete information, and procedures for handling deficient transfers, with application from 30 December 2024.

Question 14

When can crypto marketing become a UK financial promotion?

Accepted Answer

UK cryptoasset promotions can fall within the financial-promotion regime when communicated to UK consumers through channels capable of having effect in the UK. Promotions not made through one of the permitted routes breach section 21 FSMA, and qualifying cryptoasset promotions must meet FCA standards such as being fair, clear, and not misleading.

Question 15

When do DORA operational-resilience and ICT-outsourcing rules apply?

Accepted Answer

DORA applies to EU financial entities and sets requirements for ICT risk management, ICT third-party risk, digital operational-resilience testing, ICT-related incident reporting, information sharing, and oversight of critical ICT third-party providers. It entered into application on 17 January 2025 and covers multiple categories of financial entities and ICT service providers.

Regulatory guidance for global technology companies

A clearer path from product idea to live in market

AI Regulatory Readiness

Fintech Licence Pathfinding

Regulator-Ready Document Kit

Company Incorporations

AI Compliance Tools

Tailored Solutions

Three ways to start

Monthly Compliance Subscription

Compliance intelligence, productised

Answers to the questions we get most

Latest insights

Ready to launch without the regulatory guesswork?