EU regulations that affect startups in 2026
The AI Act, DSA, Data Act, DORA, MiCA and GDPR on one page: who each regulation hits, the key dates, and where to start.
EU regulations apply directly in every member state - they don't wait for a Bulgarian act to bind you. For most startups the question isn't whether they apply, but which ones and from when. This page is the map; the detail is in the individual articles.
If you also need the Bulgarian laws every startup meets, see Bulgarian laws every startup should know.
Which regulation hits whom
| Regulation | It applies to you if... | In depth |
|---|---|---|
| GDPR | You process personal data - in practice, every startup | DPAs in supplier contracts |
| AI Act | You build or use AI systems | The EU AI Act |
| DSA | Users upload content or sell through you | The DSA for startups |
| Data Act | Your product is connected or you offer cloud services | The EU Data Act |
| DORA | You sell software to banks, insurers or fintechs | DORA for vendors |
| MiCA | You issue tokens or provide crypto-asset services | MiCA in Bulgaria |
| ECSPR | You raise capital through a crowdfunding platform | Equity crowdfunding |
The key dates
| Date | What applies |
|---|---|
| 25 May 2018 | GDPR |
| 10 November 2021 | The crowdfunding regulation (ECSPR) |
| 17 February 2024 | DSA - for all intermediaries |
| 30 December 2024 | MiCA - in full, including crypto-asset service providers |
| 17 January 2025 | DORA |
| 2 February 2025 | AI Act - banned practices and the "AI literacy" duty |
| 2 August 2025 | AI Act - rules for general-purpose AI models |
| 12 September 2025 | Data Act - users' data access rights |
| 19 June 2026 | The online withdrawal button at EU level (Directive (EU) 2023/2673) |
| 1 July 2026 | End of the transition period for existing crypto firms in Bulgaria |
| 2 August 2026 | AI Act - transparency for chatbots and generated content (Art. 50) |
| 12 September 2026 | Data Act - "access by design" for new connected products |
| 12 September 2027 | Data Act - unfair-terms rules extend to existing contracts |
The deadlines for high-risk AI systems may be pushed back by the EU's so-called "Omnibus" package. Check the current status before you plan around them.
GDPR: the base layer for everyone
If you collect emails, profiles or behavioural data, GDPR applies from day one. The most common startup gap is supplier contracts: everyone who processes personal data on your behalf needs a data processing agreement (DPA) under Article 28. The text: GDPR on EUR-Lex.
AI Act: it regulates use, not technology
The same model can be out of scope in one application and tightly regulated in another. Step one is working out which risk tier each system falls in and whether you are a provider or a deployer. More on the AI Act.
DSA: if you host content or sales
If users can upload photos, listings or comments, or sell through your product, the DSA already applies to you - not once you grow, but now. Small enterprises get relief, but not a full exemption. More on the DSA.
Data Act: your product's data isn't only yours
If your product has a sensor or your service collects telemetry, your customer has a legal right to that data, for free. And cloud providers can no longer charge freely for switching away. More on the Data Act.
DORA: a condition of selling to finance
DORA binds banks and financial institutions, but they pass the requirements on to their vendors. If you sell them software, you are a "third party" - and compliance is a condition of the deal. More on DORA.
MiCA: crypto now has a regulatory address
Issuing a token, running an exchange and custody now need a clear regime and, for service providers, an FSC license. The transition period for existing firms in Bulgaria ended on 1 July 2026. More on MiCA.
Where to start
- List your products and tools and mark which regulations touch each one - the table above is a good start.
- Check supplier contracts: a GDPR DPA, AI warranties, DORA requirements.
- If you sell to consumers, add online store compliance.
This page is general information as of October 2026, not individual legal advice. EU deadlines shift - check the current text of each regulation.