What does the audit produce?

A single rated report in six parts: an applicability map marking each instrument in, out or partial for the product; a posture rating for each applicable obligation group, with a one-line basis and a pinpoint citation; a prioritized register of the amber and red findings; the dated obligation calendar that reaches the product; the recommended engagement path; and a short note on what was done and why. It is delivered in English or in German.

How does the audit differ from a gap analysis?

The audit provides an initial overview of the laws that apply to a product and its compliance position under each. A gap analysis examines one framework in detail and sets out corrective work. A red rating in the audit can provide the starting point for that analysis.

Is the rating a legal opinion?

No. The rating helps prioritize further work and is reviewed by counsel. It is not a reasoned opinion on any single question. Each rating carries its own basis and its own citation, so any one of them can be checked against the text it rests on, and a question that needs a reasoned answer is scoped as its own deliverable.

Which instruments does the audit look at?

The laws relevant to the product's industry, drawn from those maintained in the regulatory tracker. The set is kept current with the tracker, so an instrument added there joins the audit without any change to the service. The instruments common to all three versions, the GDPR, the DSG, the AI Act and the two product-liability regimes, are rated in every audit.

Does GAWEL Legal need patient or customer data?

No. The audit works from product and process descriptions and from structural facts about the company. No patient data and no other particularly sensitive personal data enters the engagement, and the intake is built so that none is requested.

Regulatory posture audit

The regulatory posture audit is an initial review of the rules that apply to one product or product line placed on the Swiss or EU market. It determines which of the laws for the product's sector apply, among them the HMG, MDR, IVDR, MepV, IvDV, AI Act, CRA, NIS2, DSG, GDPR, PLD and PrHG, assesses compliance with each group of obligations, cites the relevant provisions and identifies the work needed to address each gap, for a capped fee.

Request a posture audit View scope

An initial view of one product

Applicable rules: Which laws apply
Current position: Ratings with legal references
Priorities: Gaps, deadlines and next steps

An initial assessment; detailed gap analysis and corrective work are scoped separately.

Who this is for

US and EU companies placing a product or a product line on the Swiss or EU market and unsure which laws apply
Companies facing additional regulatory requirements: an AI feature added to a device, a product that became connected, a first launch into Europe or Switzerland
Companies heading into a financing round, a partnership or a supply agreement where a counterparty requires an assessment of the applicable rules and compliance position
In-house teams that need an overview of the applicable rules and priorities before commissioning work under one framework

Scope

Applicability map:
each law covered by the chosen version marked as applicable, not applicable or partly applicable, with a brief reason
Posture rating:
each applicable obligation group rated green, amber or red, with a one-line basis and a pinpoint citation to the text the rating rests on
Prioritized gap register:
the amber and red findings only, ranked by exposure against the nearest deadline, each row naming the remediation it calls for
Obligation calendar:
the dated milestones that reach the product, drawn from the maintained source that the public regulatory tracker uses
Recommended next steps:
the deliverable or the retained arrangement that closes each priority gap, in the order the deadlines set. Where ongoing support is needed, the report may recommend a fractional counsel arrangement

Sector-specific scope

The audit has three versions, each covering the laws relevant to one sector. The applicable version is agreed at intake based on the product.

Biotech and pharma

For companies developing or placing a medicinal product on the Swiss or EU market, advanced therapies and orphan products included. The set covers the EU medicinal-products code in force (Directive 2001/83/EC and Regulation (EC) No 726/2004) and the EU Pharma Package that is to replace it, the HMG, the Swiss establishment license and the batch-release positions under the AMBV, clinical research under the CTR and the HFG, the GMP layer including its computerized-system and AI expectations, data protection under the GDPR and the DSG, any AI used in discovery, manufacturing records or safety under the AI Act, and the liability floor under the PLD and the PrHG. Where the company holds a Swiss establishment license for medicinal products, the ISG adds a duty to report a cyberattack to the BACS within 24 hours, because Art. 74b Abs. 1 lit. h ISG keys that duty to the license rather than to a sector label. The intake asks for the modality and development stage, the EU and Swiss market and manufacturing footprint, whether trials are sponsored, whether a marketing authorization or a Swiss establishment license is held, and where AI touches the product. Sector page: Biotech and pharma.

MedTech

For device and IVD manufacturers placing a product on the EU or Swiss market. The set covers the MDR and the IVDR with their Swiss counterparts, the MepV and the IvDV; the AI Act where an AI feature makes the device high-risk through the existing notified-body route (Art. 6(1), Annex I AI Act), which is the overlap most device makers meet first; device security under the software and IT-security requirements of the MDR and the IVDR, with the CRA only for a companion product outside them and, for an entity in scope, NIS2, with the ISG reaching a device maker only where its hardware or software is used by Swiss critical infrastructure and either has remote-maintenance access or controls operational systems (Art. 74b Abs. 1 lit. u ISG); clinical investigations and performance studies under the MDR and the IVDR and, in Switzerland, the HFG and the KlinV-Mep; data protection under the GDPR and the DSG; and liability under the PLD and the PrHG. The intake asks for the class and the basis of the classification, software-as-a-medical-device status, the route to each market and whether a CH-REP is appointed, the AI and connectivity surface, and the clinical status. Sector page: MedTech and diagnostics.

ICT and digital health

For SaaS, platform, digital-therapeutic and connected-product companies. The set covers data protection under the GDPR and the DSG, including the stricter rules that apply to health data as particularly sensitive personal data; security under NIS2 and the CRA, with the ISG reaching a cloud, data-center or digital trust-service provider only where it has a seat in Switzerland (Art. 74b Abs. 1 lit. t ISG); AI systems under the AI Act and the risk tier they fall into; and the MDR and the MepV where a software function meets the medical-device definition. Liability sits under the PLD and the PrHG. The intake asks for the product and the data categories it processes, the EU and Swiss transfer footprint, the role AI plays in it, whether any function meets the device definition, and the supply-chain surface. Sector page: Technology and digital health.

What the audit does not cover

The audit does not:

draft or remediate any document; each of those is its own deliverable, priced separately;
provide a full gap analysis under a single framework; a red rating identifies where that further work is needed;
correspond with an authority or a notified body;
cover a group-wide or multi-entity roll-out;
perform technical, quality-system or conformity-assessment work;
address questions requiring factual investigation beyond the intake.

The rating helps prioritize further work. It is not a reasoned legal opinion on any single question; that is a separate deliverable, and the audit names it where one is needed.

Information for the review

A description of the product or product line and the structural facts around it: the markets it is placed on, the legal entity that places it, the route to each market, where AI and connectivity sit in it, and the clinical or research status
One scoping call, usually under an hour, to clarify any questions remaining after the questionnaire
The audit uses product and process descriptions only: no patient data and no other particularly sensitive personal data (Art. 5 lit. c DSG, Art. 9 GDPR) enters the engagement, and the intake is built so that none is requested.

How the work proceeds

Intake The questionnaire for the chosen version and a short scoping call establish the product and its structural facts.
Applicability and rating The audit checks which laws apply to the product and rates each group of obligations against the current legal texts, with any uncertainty recorded for review.
Legal review Every applicability call and every rating is confirmed or corrected, the flagged points are resolved, and the priority order is set.
Final checks Sources and citations, consistency between ratings, and the legal reasoning are checked.
Delivery The rated report, the method note and the recommended engagement path.

An example report

The example below shows the summary and the first entries in the prioritized list of findings.

Illustrative excerpt

Scope. One product line. A Class IIa patient-monitoring system: a body-worn sensor and a cloud application that scores trend data and flags clinical deterioration for a clinician to review. CE marked through a notified body under the MDR, with Swiss market entry already scheduled. The manufacturer is seated outside the EU and Switzerland, the application is hosted in the United States, and no clinical investigation is running.

Posture summary

2 red
3 amber
2 green
5 out of scope

Twelve instruments assessed. Each one recorded as out of scope carries the trigger that would bring it back in, and the event on which it is tested again.

Swiss market entry is blocked until two steps are taken. The manufacturer has no seat in Switzerland, so the product may not be placed on the Swiss market until a person seated in Switzerland holds a written mandate, and the required particulars must reach Swissmedic before the first placing.
Model updates are reaching the field outside the change-control route. The scoring model has been retrained twice since the certificate issued. A change to the approved device that could affect its safety or performance needs the notified body's approval first, and neither release was put to it.
CRA scope. The CRA does not reach this product at all, because it does not apply to a product the MDR applies to. No separate CRA work is required for this product. This conclusion is limited to the assessed product: a companion wearable falling outside the MDR would come back under the CRA, and as an important product at that.

Recommended next steps. The two red findings are addressed first and in that order, because both concern planned activity: the Swiss mandate and the registration before any Swiss placing, then the change-control route before the next model release. The AI Act work follows these steps, because the obligations for a system on this route apply from 2 August 2028, after the current certificate falls due for renewal.

Prioritized gap register, first three entries

Red: Swiss authorized representative, and registration before the first placing

The manufacturer has no seat in Switzerland. A product whose manufacturer is seated abroad may be placed on the Swiss market only where a person seated in Switzerland has been given a written mandate. Separately, the manufacturer or that representative must register the required particulars with Swissmedic before the product is placed on the market for the first time, a duty in force since 1 July 2026. Neither step has been taken, and the Swiss launch is scheduled.

Art. 51 Abs. 1 and Art. 55 Abs. 1 MepV

Follow-up service: CH-REP advisory
Red: Change control over the scoring model

The model has been retrained twice since the certificate issued, and both releases changed how deterioration is flagged. A change to the approved device requires the approval of the notified body that issued the certificate wherever the change could affect the safety or the performance of the device, and neither release was submitted to it. The issue affects each release until the change-control procedure is in place.

Annex IX, Section 4.10 MDR

Follow-up service: MDR and IVDR compliance
Amber: High-risk classification of the scoring function under the AI Act

The scoring function is not caught by the carve-out for AI used solely for convenience, performance optimization or quality control, because its failure would endanger health and safety. It is therefore a safety component, and the system is high-risk by operation of law rather than by any choice the manufacturer makes. Nothing is overdue: for a system on this route the obligations apply from 2 August 2028, which is why this entry sits below the two red findings rather than above them.

Art. 6(1b), Annex I AI Act, and Art. 113(c)(ii) AI Act

Follow-up service: EU AI Act compliance

Illustrative excerpt based on fictional facts, not a client matter. A full report also includes the applicability map, the remaining register entries, the obligation calendar, the method note and the attorney's sign-off.

Fees

Capped fee

The fee depends on the number of laws to be reviewed and on whether more than one product line or legal entity is in scope. If priority handling is expressly agreed, a 50 percent uplift applies.

Questions

What does the audit produce?: A single rated report in six parts: an applicability map marking each instrument in, out or partial for the product; a posture rating for each applicable obligation group, with a one-line basis and a pinpoint citation; a prioritized register of the amber and red findings; the dated obligation calendar that reaches the product; the recommended engagement path; and a short note on what was done and why. It is delivered in English or in German.
How does the audit differ from a gap analysis?: The audit provides an initial overview of the laws that apply to a product and its compliance position under each. A gap analysis examines one framework in detail and sets out corrective work. A red rating in the audit can provide the starting point for that analysis.
Is the rating a legal opinion?: No. The rating helps prioritize further work and is reviewed by counsel. It is not a reasoned opinion on any single question. Each rating carries its own basis and its own citation, so any one of them can be checked against the text it rests on, and a question that needs a reasoned answer is scoped as its own deliverable.
Which instruments does the audit look at?: The laws relevant to the product's industry, drawn from those maintained in the regulatory tracker. The set is kept current with the tracker, so an instrument added there joins the audit without any change to the service. The instruments common to all three versions, the GDPR, the DSG, the AI Act and the two product-liability regimes, are rated in every audit.
Does GAWEL Legal need patient or customer data?: No. The audit works from product and process descriptions and from structural facts about the company. No patient data and no other particularly sensitive personal data enters the engagement, and the intake is built so that none is requested.

Discuss your matter

Briefly describe the matter and the legal advice you need.

Request a posture audit