Is this legal advice or a guarantee of compliance?

No. Block Consulting produces technical evidence, architecture hardening, and assurance artefacts. Licensed counsel interprets the law and files. We do not claim any organisation is fully compliant after reading this page.

Who typically buys this overlay?

Developer agencies shipping into EU, UK, US or UAE licensed markets, and the regulated end client (bank, CASP, AI provider/deployer, VASP) whose CISO or counsel is blocking go-live.

What happens if the end client cannot evidence DORA, MiCA or the EU AI Act?

Go-live and licence packs stall; procurement can force a remediator onto the stack; MSAs can trigger liability. Fines usually target the regulated entity — the builder still loses the account and unpaid scope expands. Indicative EU maximums include EU AI Act up to €35m or 7% turnover, GDPR up to €20m or 4%, NIS2 often cited up to €10m or 2% for essential entities. Actual penalties are decided by authorities.

EU AI Act, DORA & MiCA compliance consulting

EU AI Act and DORA compliance consulting — technical evidence overlays for MiCA, NIS2, operational resilience, GDPR security of processing, VARA, and US frameworks. Counsel files; we deliver engineering evidence.

Why this is a delivery problem, not only a legal one

Regulators and large buyers no longer accept “we have a lawyer” or an ISO logo as proof that the software is resilient. If the end client’s revenue or licence depends on an EU, UK or UAE regulator, compliance evidence is on the critical path of the build — even when the original statement of work only said “ship the app.”

Legal counsel interprets the law. Block Consulting produces the technical evidence those filings and questionnaires need. We work with legal partners where filings are required. We are not the client’s law firm.

Frameworks we evidence

EU AI Act

Typically hits: Providers and deployers of AI into the EU — agents, RAG, scoring, KYC/biometrics, copilots, GPAI-facing products.

What Block delivers: Risk-class intake, gap analysis, logging / human-oversight / cybersecurity evidence, and an AI Launch Review. Not legal advice.

DORA

Typically hits: EU financial entities and in-scope CASPs; ICT third parties supporting them — including developer agencies on the critical path.

What Block delivers: ICT third-party / technical evidence pack, gap review of the live stack, hardening recommendations, and testing artefacts counsel can use.

MiCA

Typically hits: Crypto-asset issuers and CASPs — wallet, exchange, custody, brokerage, and token builds for Europe.

What Block delivers: Technical overlay: custody/wallet security design, resilience, market-integrity surfaces, smart-contract review where on-chain, annex for licence packs.

NIS2

Typically hits: Essential and important entities and their supply chains (sector-dependent).

What Block delivers: Supply-chain and ICT control evidence on EU enterprise deals.

UK FCA / PRA operational resilience

Typically hits: UK financial-services firms and critical suppliers.

What Block delivers: ICT-style evidence for change-advisory and outsourcing reviews.

GDPR / UK GDPR

Typically hits: Controllers and processors whenever EU/UK personal data is in the stack.

What Block delivers: Security-of-processing technical notes that support DPIA and subprocessor work. Legal remains counsel.

VARA / UAE VASP regimes

Typically hits: VASPs and related digital-asset activity in the UAE.

What Block delivers: Technical control mapping and security testing aligned to licence expectations.

SOC 2 / ISO 27001 / PCI / HIPAA

Typically hits: US enterprise, payments, and health export buyers who put these in RFPs.

What Block delivers: Engineering evidence and scoped architecture/testing — we are not a certification body.

Consequences of not complying

Figures below are indicative of published EU/UK-style maximums — not legal advice and not a prediction for any case. National authorities decide actual penalties. Commercial pain for the builder usually hits first.

EU AI Act — up to €35 million or 7% worldwide turnover (prohibited / serious); €15m or 3% for other core obligations; €7.5m or 1.5% for incorrect information to authorities. Product may not be sold or deployed as claimed.
DORA — supervisory measures, remediation orders, ICT restrictions, national administrative fines; critical ICT third parties can face ESA oversight. Weak evidence → the builder is replaced.
MiCA — licence refusal, suspension or withdrawal; administrative fines; stop-orders. Token, wallet or exchange builds without custody and resilience evidence do not get to EU market.
NIS2 — often cited up to €10m or 2% (essential) / €7m or 1.4% (important).
GDPR / UK GDPR — up to €20m or 4% (serious); €10m or 2% (lower tier).
UK FCA / PRA — skilled-person reviews, restrictions on business, enforcement fines.
VARA / UAE — licence refusal, suspension or revocation.
SOC 2 / HIPAA / PCI — deals die at security review; HIPAA civil penalties; PCI can mean loss of card acceptance.

What this page does not do

It is not an article-by-article DIY control checklist.
It is not a substitute for licensed counsel.
It does not teach an audit programme you can run without specialist assurance.

Frequently asked questions

Is this legal advice or a guarantee of compliance?: No. Block Consulting produces technical evidence, architecture hardening, and assurance artefacts. Licensed counsel interprets the law and files. We do not claim any organisation is fully compliant after reading this page.
Who typically buys this overlay?: Developer agencies shipping into EU, UK, US or UAE licensed markets, and the regulated end client (bank, CASP, AI provider/deployer, VASP) whose CISO or counsel is blocking go-live.
What happens if the end client cannot evidence DORA, MiCA or the EU AI Act?: Go-live and licence packs stall; procurement can force a remediator onto the stack; MSAs can trigger liability. Fines usually target the regulated entity — the builder still loses the account and unpaid scope expands. Indicative EU maximums include EU AI Act up to €35m or 7% turnover, GDPR up to €20m or 4%, NIS2 often cited up to €10m or 2% for essential entities. Actual penalties are decided by authorities.

Next step

Pick one live export project. 30-minute call on licence type, go-live date, and questionnaire pressure. Then NDA and a scoped SOW.