Articles on life sciences and technology law
The articles analyze Swiss and EU law on the contracts, regulation and cross-border questions that affect research, products and digital services.
These articles provide general information and are not legal advice.
Browse the articles
Search the articles or choose a topic.
A US sponsor, an EU licensee and a Swiss distributor answer to three pharmacovigilance regimes. Their safety data exchange agreement allocates the work but not the duty, and since February 2026 EU law prescribes what it must say.
After the EU Pharma Package, a biosimilar entrant plans against an 8+1-year baseline whose added years depend on the originator's own applications, and a launch bar that can lift in one Member State. Switzerland runs a separate ten-year clock.
Findata admits foreign sponsors to Finnish registry data for real-world evidence, but the analysis stays in a secure environment in the EU or EEA, and a login by the sponsor's US staff is a data transfer. The European Health Data Space rewrites the terms from 2029.
Denmark promises a phase I sponsor an approval or a request for information fourteen days after validation, Sweden and Finland run fast tracks of their own and Norway joins an EU pilot, but the four do not all count from the same moment.
The Swiss data protection act (DSG) attaches to the data category, not the entity holding it. A US health-SaaS or digital-therapeutics vendor mapped for HIPAA and the GDPR may still have to designate a Swiss representative, and the DSG's criminal fines fall on named individuals.
The Commission's December 2025 proposal would end MDR and IVDR certificate expiry, reclassify clinical software and loosen the evidence rules, but it is not law: the 2027 and 2028 transition deadlines and the EU medical device database EUDAMED still run on the unamended text.
The EU Pharma Package turns the hospital exemption for cell and gene therapies from a national carve-out into an approval notified to the EMA, with annual data on use, safety and efficacy, while Switzerland drafts a narrower exemption of its own.
A life-sciences group can fall under the EU due diligence directive as narrowed in 2026, Germany's supply chain act and the Swiss code of obligations; they differ on scope, depth, enforcement and liability. A broader draft Swiss act on sustainable corporate governance (NUFG) entered consultation in April 2026.
An AI-enabled device sold from Switzerland into the EU answers to two cybersecurity regimes that measure different things: the MDR secures the device in its IT environment, the AI Act the model against manipulation. Switzerland adds a 24-hour reporting clock.
The Digital Omnibus would make the GDPR's personal-data definition relative to the holder, put AI training on an express legitimate-interest footing, and route cookie consent into a new Art. 88a GDPR. None of it is yet law.
Opt-outs under Art. 83 of the Agreement on a Unified Patent Court, made in 2023 before the Court had ruled, can now be tested against three years of its decisions. Withdrawal is not always open: a patent drawn into a national action since the Court opened stays outside it permanently.
The EU-US Data Privacy Framework rests on the independence of three American institutions, and the 2026 Supreme Court ruling on at-will removal of Federal Trade Commission members unsettles that premise for companies that retired their standard contractual clauses.
The EU Digital Omnibus moves at two speeds: an adopted AI Act track defers high-risk deadlines to December 2027 and August 2028, while the GDPR, ePrivacy and Data Act rewrite remains an unagreed proposal.
The revised Swiss competition act (KG) replaces the qualified-dominance test of Art. 10(2) KG with an EU-style significant impediment to effective competition (SIEC) test, so merger review will reach US MedTech and pharma deals well short of monopoly. Notification thresholds are unchanged.
Switzerland forgoes a horizontal AI statute: the Federal Council plans to ratify the Council of Europe AI Convention and amend sector laws, with a consultation draft due by the end of 2026, while Swiss data protection law already governs AI. US firms active in both markets work under two frameworks.
From 7 August 2027 the EU Regulation on substances of human origin replaces the Blood and Tissues and Cells Directives, extending EU oversight of donated starting materials up to the manufacturer's door and requiring US cell and gene therapy sponsors to repaper supply agreements.
Germany's medical research act (Medizinforschungsgesetz) has, since 1 January 2025, tied relief from the statutory guardrails on negotiated drug prices and the option of a confidential reimbursement amount, bought with a nine percent discount, to where a company runs its trials and research.
Since 1 April 2025 the Swiss information security act (ISG) requires operators of critical infrastructure to report cyberattacks to the federal cybersecurity office (BACS) within 24 hours of discovery, and its statutory catalog captures US subsidiaries by Swiss license rather than sector label.
Mandatory use of the first four modules of EUDAMED, the EU medical device database, began on 28 May 2026, putting actor registration upstream of conformity assessment for US device and IVD makers and setting backfill deadlines for devices already on the EU market.
The Foreign Subsidies Regulation imposes a mandatory pre-closing filing on qualifying EU acquisitions, and its EUR 50 million trigger measures financial contributions rather than subsidies, so US federal grants, government contracts and research tax credits all count.
Since 1 May 2026 only the EU block exemption lists utility models as technology rights and only the UK's lists database rights. Switzerland has no block exemption. A licensed dataset can sit inside the safe harbor in one territory and outside it in another.
The European Health Data Space compels holders to make health data available through health data access bodies, from 2029 for general records and 2031 for genomic and clinical-trial data; a US biotech's EU subsidiary may itself be a holder.
Switzerland has been a third country for medical devices since May 2021, and the Swiss-EU Bilaterals III protocols signed in March 2026 leave the devices chapter of the mutual recognition agreement to an undated Committee decision, so dual authorized representation persists.
The AI Act's obligations for general-purpose AI models have bound providers, wherever established, since 2 August 2025; the Commission's power to investigate and fine arrives 2 August 2026, a date the high-risk deferral did not move.
AI-enabled medical software that needs a notified body under the MDR reaches high-risk status through the AI Act's Annex I product route rather than Annex III, so its obligations attach in 2027 and are assessed as a second layer inside MDR conformity assessment.
Germany's Digital Act rewrote § 134 of the health insurance code (SGB V) so that from 2026 at least 20 percent of the negotiated price of a digital health application (DiGA) turns on measured outcomes, and the directory of the regulator BfArM now admits class IIb software on stricter evidence terms.
One informed-consent form under the Swiss human research act (HFG) does not automatically discharge the duties the data protection act (DSG) attaches to the same sensitive health data. For US sponsors, the open question surfaces in protocol design and site contracts, not during the trial.
Directive (EU) 2024/2853 governs products placed on the market from 9 December 2026, so two batches of one medicine can fall under different regimes. The new rules let courts presume a defect in defined cases, order disclosure and allow claims for up to twenty-five years.
The EU Health Technology Assessment Regulation has required a Joint Clinical Assessment for new oncology medicines and cell and gene therapies since 12 January 2025; it harmonizes the clinical dossier, not national pricing, and the outcome turns on comparators chosen at trial design.
The Swiss therapeutic products act (HMG) and Directive 2001/83/EC bar public advertising of prescription medicines, and Swiss ordinances reach disease-awareness material, hospitality and samples. Several launch programs built for the FDA's Office of Prescription Drug Promotion (OPDP) are unlawful on arrival.
Shortage prevention plans and a Union list of critical medicines become standing law, while joint antimicrobial procurement stays voluntary. The duties fall on whoever holds the marketing authorization, whether a US sponsor's EU subsidiary or its distributor.
The EU Pharma Package replaces the 8+2(+1) regime with an 8+1 baseline, mutually exclusive conditional extensions capped at eleven years, and orphan exclusivity recoded onto the active substance. The qualifying choices are fixed years before a US sponsor files.
Austria's cybersecurity act, the NISG 2026, transposes NIS2 late and applies from 1 October 2026. In-scope entities, pharmaceutical R&D included, must register with a new federal authority within three months, file a self-declaration within a year and prove implementation on request.
The EU Cyber Resilience Act makes cybersecurity a condition of market access: products with digital elements must carry the CE marking and stay supported with security updates, and the vulnerability reporting duty starts 11 September 2026.
Regulation (EU) 2024/1860 extends legacy IVD deadlines to 2027, 2028 and 2029, but only for unchanged devices that meet qualifying steps falling due from 2025 to 2027. The Swiss in vitro diagnostics ordinance (IvDV) mirrors those dates but requires its own Swiss representative and registration.
The EU Data Act has applied since 12 September 2025 to any provider serving Union customers, wherever established, and its switching, access and unfair-terms rules override much of what standard US cloud and Internet of Things (IoT) contracts still say.
Liability caps and other terms US counsel use in US-Swiss R&D collaborations rest on assumptions Swiss and EU law do not share. Swiss partnership law, mandatory trial-injury cover, joint-patent rules and the limits of US bankruptcy law can each defeat them.
Art. 332 of the Swiss code of obligations (OR) sorts employee inventions into three categories a standard US invention-assignment clause does not track, and one of them carries a statutory compensation claim the employment contract cannot waive.
A statutory sandbox in the EU Pharma Package lets the Commission adapt authorization requirements for products that cannot meet the standard rules, such as cell and gene therapies and AI-enabled medicines. FDA expedited programs speed a fixed pathway; the sandbox changes the requirements themselves.
For antimicrobials, the EU Pharma Package extends environmental risk assessment to active-ingredient sites outside the EU. Unaddressed risks can lead to refusal or revocation of the marketing authorization. Supplier contracts rarely secure the effluent data.
The transferable voucher adds a year of EU data protection, usable on another product only if its annual EU sales stayed within EUR 490 million in its first four years. For most US developers working on antimicrobial resistance (AMR) it is unlikely, alone, to reverse the build-or-abandon decision.
Art. 85 of the EU Pharma Package Directive extends the Bolar exemption to health technology assessment, pricing and reimbursement, and tender filings. Generics and biosimilars can be launch-ready at patent expiry, so US originators may lose EU revenue sooner.
Art. 56a of the EU Pharma Package Directive lets a Member State demand a launch; non-compliance can strip regulatory market protection in that territory. For US originators, selective EU launch strategy now carries a direct exclusivity cost.
EU orphan exclusivity will run on one clock per holder and active substance, and new orphan indications can extend it by a year at most twice. The two-year pediatric orphan reward will end, and earnouts keyed to orphan exclusivity will track a changed right.
Two of the four 12-month extensions of EU market protection require the EU filing to come first or within 90 days of the first filing outside the Union. A US sponsor that files with the FDA first and in the EU more than 90 days later loses both.
Swiss, EU and US rules on trials with pregnant participants read alike but differ on who reviews a trial, the father's consent, who pays if a child is harmed and fetal adverse event reporting. The ICH E21 guideline will leave those differences in place.
US policy encourages trials with pregnant participants, but the rules have not moved. Subpart B binds only research HHS conducts or supports; for other FDA trials it is a draft-guidance recommendation. No general federal scheme compensates trial injury.
Art. 33 of the EU Clinical Trials Regulation allows pregnant participants in trials on additional conditions, yet fewer than 0.4 percent of EU trials include them. Ethics review in each Member State, national compensation rules and insurers without data to price the risk explain the gap.
Swiss law allows pregnant participants in clinical trials on additional conditions, yet most sponsors exclude them. Unpublished ethics-committee expectations, a debated burden of proof for trial injuries and insurers without data to price the risk explain why.
Denmark, Finland and Sweden enforce NIS2 on different dates through different authorities, while Norway and Iceland have yet to implement it. A US pharma group with R&D across the region faces a different authority in each country.
Austria targets 35 days for approving a single-country trial and pays a refundable 14 percent research premium even to companies not yet profitable; the proposed EU Biotech Act would add a year of supplementary protection. Each benefit carries conditions the headline numbers do not show.
AI built and used purely for research can sit outside the AI Act, but the exclusion ends once a system is tested on patients or placed on the market. High-risk duties then apply from August 2026 or, for AI in medical devices, from August 2027.
Switzerland's three-year price review cut prices by about 11 percent on average across some 300 products a year in 2023–2025. For US companies with research there, the OECD minimum tax can partly reverse cantonal tax incentives such as the patent box.
Most milestone dollars promised in biotech M&A earnouts are never paid. Recent Delaware decisions show how drafting choices shape the disputes that follow.
Since the Swiss-EU mutual recognition agreement lapsed for medical devices in May 2021, Swiss makers need an EU authorized representative and EU makers a Swiss one, with registration in both device databases from mid-2026. Restoration under the Bilaterale III treaties may not come before 2028.
A Swiss sponsor with trial sites in Switzerland, the EU and the UK deals with three authorization regimes, and nothing synchronizes their amendments or safety reporting. Agreements drafted for a Swiss-EU world may leave liability and data transfers unresolved.
NIS2 does not bind Swiss device makers directly, but EU hospitals it covers must address supplier security risks, in practice through procurement contracts. Swiss suppliers may need to comply as if NIS2 bound them, and Swiss law may add its own reporting duty.
The MDR requires security to be built into software as a medical device (SaMD) and maintained for its life, and notified bodies treat the international standard IEC 81001-5-1 as the state of the art. A security patch can itself need notified-body review, and one incident can start five reporting clocks.
A US CLOUD Act order can reach data a US provider controls wherever it is stored, and complying may breach Art. 271 of the Swiss criminal code (StGB), the ban on unauthorized official acts for a foreign state. A choice-of-law clause displaces neither the Swiss data protection act nor the GDPR.
AI-generated drug candidates raise unresolved inventorship questions. Patent offices require human inventors, but how much human contribution suffices?
Since 2021, Switzerland and the EU have treated each other as third countries for medical devices, so a manufacturer selling in both runs two compliance systems. It needs a representative in the other market; legacy certificates face 2027 and 2028 deadlines.
For AI devices that need a notified body, the AI Act adds high-risk duties to the MDR, and the Swiss medical devices ordinance (MepV) has no AI-specific provisions. The FDA allows changes pre-specified in an authorized change control plan, but no framework yet admits continuous learning.
Competition law can void some clauses of a biotech license, and the Swiss code of obligations (OR) codifies no license contract that would fill its gaps. Clauses on scope, grant-backs, change of control and termination decide what the license covers and what survives its end.
Software as a medical device (SaMD) can lose accuracy on a new scanner or patient group, or change with an update, without any visible injury. Post-market surveillance under the MDR and the Swiss medical devices ordinance (MepV) must detect that, and the AI Act adds monitoring for high-risk AI devices.
Under the EU MDR, clinical evidence for software as a medical device rests on valid clinical association, analytical and clinical validation, a burden many software makers underestimate.
Switzerland has no statutory sandbox for digital health. Derogations, clinical investigations, and regulator dialogue give limited flexibility for market entry.
Art. 321 of the Swiss criminal code (StGB) makes revealing professional secrets a crime and Art. 271 StGB restricts gathering evidence in Switzerland for foreign proceedings, but a US court may sanction a refusal to produce. In-house counsel's protection turns on pre-dispute choices.
A Swiss patent can block parallel imports of a price-regulated medicine even from the European Economic Area, but only while it and its supplementary protection last. Swiss antitrust law treats contract clauses barring such imports as hard-core restraints.
The classification of software as a medical device under EU MDR creates regulatory exposure developers discover post-launch. Marketing claims often inadvertently determine regulatory status.
Cell and gene therapies developed under hospital exemption face uncertain boundaries. Scale, geography, and commercial intent determine where the authorization line falls.
Since mutual recognition with the EU lapsed for devices, a Swiss manufacturer needs an EU authorized representative. If the manufacturer breaches its MDR or IVDR obligations, the representative is liable alongside it, so the mandate also allocates liability.
When a contaminated batch harms a patient, any party in the supply chain may face a claim. From December 2026 the new EU Product Liability Directive reaches more of them and eases proof, while the Swiss statute is still modeled on the 1985 directive.
A trial with EU and Swiss sites must satisfy both the GDPR and the Swiss data protection act (DSG). Consent to take part in a trial is not the same as consent to process the data, and whether Swiss trial consent meets the DSG for health data remained unsettled as of September 2025.
For a cell or gene therapy made under good manufacturing practice (GMP), the EU authorizes the finished product, while Switzerland may authorize the manufacturing process instead. They diverge on the hospital exemption, cross-border cell tracing, process changes and contract manufacturing.
When a compound fails late in clinical testing, the collaboration agreement decides who carries the loss. Under Swiss law, a pharma-academic alliance can be treated as a simple partnership with shared losses rather than as a license.
You can suggest a subject for a future article by email to contact@gawel.ch.
For advice on a particular matter, please get in touch.
Make an enquiry