Staffing regulatory projects: the roles DORA, MiCA, the AI Act and AMLR require

Short answer: Regulatory project staffing has become a compliance task in its own right: DORA, MiCA, the AI Act and AMLR explicitly require responsible, suitably qualified people, not just new processes. Firms typically need legal counsel, regulatory specialists, compliance officers, AI and data protection specialists and contract lawyers at the same time. The next key dates are 2 December 2026 (AI Act) and 10 July 2027 (AMLR).

This guide is for legal and compliance leaders at banks, insurers, fintechs and industrial companies in Switzerland and Germany. It links the articles of our regulatory radar to one practical question: which roles does a project need, and how should you plan the staffing?

Four regimes, one bottleneck

The four regimes cover different subjects, but all of them require named responsible persons and adequately qualified staff. Examples from the legal texts:

• DORA (Regulation (EU) 2022/2554): the management body bears ultimate responsibility for ICT risk and sets clear roles for all ICT-related functions (Article 5(2)). ICT risk is assigned to an independent control function (Article 6(4)), and firms need a function or a senior manager to monitor arrangements with ICT third-party service providers (Article 5(3)).
• MiCA (Regulation (EU) 2023/1114): crypto-asset service providers employ staff with the necessary knowledge, skills and expertise (Article 68(5)) and maintain effective policies and procedures to ensure compliance (Article 68(4)).
• AI Act (Regulation (EU) 2024/1689): deployers of high-risk AI systems assign human oversight to people with the necessary competence, training and authority (Article 26(2)). Providers and deployers take measures to build their staff's AI literacy (Article 4).
• AMLR (Regulation (EU) 2024/1624): obliged entities appoint a member of the management body as compliance manager and a compliance officer for AML of sufficiently senior standing (Article 11(1) and (2)).

Because these obligations overlap in time, many legal and compliance teams hit a bottleneck: business as usual continues, while the projects need months of specialist knowledge that is either missing in-house or already fully booked.

Who is affected?

Financial institutions are affected most, because DORA, AMLR and often MiCA apply to them together. The AI Act reaches every sector that develops or uses AI systems, for example in HR, credit assessment or customer service. These EU regulations do not apply directly in Switzerland, but Swiss groups are affected when they have entities or clients in the EU. Swiss rules apply alongside them, such as FINMA Circular 2023/1 on operational resilience for banks, whose transitional periods ended on 1 January 2026.

Deadlines and status of the four regimes

DORA and MiCA already apply in full; for the AI Act and AMLR, the major dates are still ahead. The table shows the position on 11 November 2026.

Sources: legal texts on EUR-Lex and the Digital Omnibus on AI (Regulation (EU) 2026/1744), accessed 11 November 2026. For all dates at a glance, see the regulatory calendar for legal and compliance.

Role matrix: the roles DORA, MiCA, the AI Act and AMLR require

Most roles appear under several regimes; what differs is where the work lies. The matrix shows typical tasks per role and regime.

Legal counsel / regulatory lawyer

• DORA: Interpretation, contract standard for ICT agreements (Article 30)
• MiCA: Classifying tokens and services, white papers, client terms
• AI Act: Clarifying provider or deployer role, contracts with AI vendors
• AMLR: Interpretation, updating policies and client contracts

Contract lawyers (contract review)

• DORA: Remediating the ICT contract portfolio
• MiCA: Outsourcing agreements (Article 73)
• AI Act: Vendor contracts and terms of use
• AMLR: Contracts with third parties relied on for due diligence

Regulatory specialist

• DORA: Register of information, reports to the authority
• MiCA: Keeping the licence current, notifications, technical standards
• AI Act: Tracking guidelines and implementing acts
• AMLR: Gap analysis against the new standards

Compliance officer

• DORA: Controls and evidence
• MiCA: Conduct and client protection rules, conflicts of interest
• AI Act: Inventory, risk classes, AI literacy training
• AMLR: Compliance programme, reporting to the compliance manager

AML specialist, MLRO

• MiCA: Onboarding, transaction monitoring, client migration
• AMLR: Day-to-day implementation, suspicious transaction reports (Article 11(2)), KYC remediation

Data protection and AI governance specialist

• DORA: Data locations and data access in ICT contracts
• MiCA: Data protection in onboarding
• AI Act: Human oversight, impact assessment, data quality
• AMLR: Data protection in information sharing

Project lead / PMO

• DORA: Programme management across IT, procurement and legal
• MiCA: Remediation and client migration
• AI Act: AI programme across business units
• AMLR: Implementation programme up to 10 July 2027

Source: compiled by Alpinum Solutions from the legal texts, November 2026.

Typical project phases and how capacity changes

Regulatory projects do not need the same headcount throughout: the gap analysis and, above all, implementation take the most capacity. A typical pattern:

1. Scoping and gap analysis: a few experienced specialists establish which entities, products and systems are in scope and where the gaps are. Senior experience matters more than headcount here.
2. Design and planning: policies, responsibilities and timeline are agreed and the budget secured. Regulatory specialists and a project lead join.
3. Implementation: contracts, processes, controls and documentation are updated. This phase takes the most capacity, often with junior and mid-level teams, for example for contract remediation under DORA or KYC remediation under AMLR.
4. Testing and evidence: controls are tested and evidence compiled for supervisors and internal audit.
5. Handover to business as usual: knowledge passes to the line; project roles wind down and permanent functions stay in-house.

How long each phase takes and how many people it needs depends on volumes: the number of contracts, AI systems, client files or entities. Measure these at the outset, because they drive capacity more than the regulation itself. For how a programme runs from horizon scanning to evidence, see regulatory change management: implementing new rules reliably.

In-house, consultancy or interim specialists?

The three options are not mutually exclusive; the choice depends on who directs the work and how long the expertise is needed.

For a detailed comparison, see consulting firm or interim specialists: staffing compliance projects.

How to plan the staffing

Good staffing plans start with volumes and end with handover. A proven approach:

1. Measure volumes: count contracts, systems, files and entities in scope.
2. Derive roles from the matrix: for each phase, set the role, level and workload required.
3. Check internal capacity: who can contribute how much time alongside business as usual?
4. Fill gaps for a defined period: add missing roles through staff leasing or freelancing, part-time or full-time.
5. Set direction and handover: name an internal project owner and plan the handover to business as usual from day one.

How interim support helps

Interim specialists bring expert knowledge into your own team for the life of the project. The company directs the work and keeps responsibility for implementation; Alpinum does not provide legal advice.

Alpinum Solutions provides legal counsel, contract lawyers, regulatory specialists, compliance officers, AML specialists and project teams through staff leasing and freelancing, from junior to senior level. Alpinum Solutions typically presents two to four profiles per search; shortlisted profiles are usually available within 48 hours, and the start date is agreed between the client and Alpinum. Specialists can also hold formal functions, such as money laundering reporting officer. For how companies bring in specialist expertise for a defined period, see project and subject-matter experts. The radar articles explain the duties under DORA, MiCA, the AI Act and AMLR.

Frequently asked questions about regulatory project staffing

Which roles does a DORA project need?

A DORA project usually needs legal counsel for interpretation, contract lawyers to remediate ICT agreements under Article 30, regulatory specialists for the register of information and reporting, and a project lead. DORA also requires an independent control function for ICT risk (Article 6(4)) and a function to monitor ICT third-party providers (Article 5(3)); both should be anchored permanently in-house.

How much capacity does the AI Act take?

It depends on how many AI systems a company develops or uses and whether any are high-risk. The first step is an inventory with risk classes; it determines the effort for documentation, human oversight and training. Demand rises significantly once high-risk obligations for Annex III systems apply from 2 December 2027.

When is an interim project team worth it?

An interim team pays off when a phase has to handle large volumes, such as hundreds of contracts or client files, and the full breadth of expertise is not needed after the project. The company directs the team and can scale it down as needed. Permanent functions such as the AML compliance officer or the ICT control function belong in your own organisation over the long term.

Do DORA, MiCA, the AI Act and AMLR apply in Switzerland?

Not directly. Swiss companies are affected when they have entities or clients in the EU or provide services to EU financial institutions. Swiss rules apply alongside, such as FINMA Circular 2023/1 on operational resilience and the Anti-Money Laundering Act. That is why firms look for specialists who know both EU law and Swiss supervisory practice.

Which roles should stay in-house?

Roles the law assigns to a member of the management body should stay in-house, such as the compliance manager under Article 11(1) AMLR and overall responsibility for ICT risk under Article 5(2) DORA. Interim specialists support these people and can take on operational functions where supervisory rules and the law allow.

Next step

Alpinum Solutions is the leading provider of interim legal & compliance in Switzerland and Germany and staffs roles for DORA, MiCA, AI Act and AMLR projects, from a single specialist to a project team. Tell us the regime, volumes and timeline, and we will show you suitable profiles.

• Regulatory compliance and regulatory change: specialists for new rules
• Project and subject-matter experts: specialist expertise for your team
• Regulatory change management: implementing new rules reliably
• Regulatory radar: all articles on regulatory change
• Discuss your needs

Last updated: 11 November 2026.