Grandfathering under MiCA member-state transitional arrangements ended 1 July 2026. As Servatius von Tatzenberg writes today, Swiss crypto-asset service providers that were relying on those arrangements to access EU retail clients are now either registered as CASPs or out. The text is unambiguous on third-country providers; the open question is enforcement sequencing. FINMA has been quietly consistent in its own supervisory posture — the January 2026 guidance on crypto segregation is still the domestic standard — but FINMA's regime and MiCA are not substitutes. Swiss firms distributing into the EU need an EU entity or an EU-registered partner, full stop.

Casimir von Firn's piece today makes the point that compliance teams keep missing: the AI Office will look at the Art. 53 documentation first, not the model. Technical documentation, training data summaries, copyright compliance policy — these are the drawers regulators will open in August. If you are building or distributing a GPAI model into the EU and those drawers are thin, the deadline is not moving.

Connected: Switzerland's sectoral AI path, also covered today, means Swiss-only deployments escape GPAI. But any Swiss firm with EU distribution does not escape regardless of where the model was built or hosted. The bilateral frame creates no documentation exception.

The Cyber Resilience Act's 24-hour active exploitation reporting obligation goes live 11 September. Von Firn writes today that the window runs from discovery, not confirmed attribution — which is a different and shorter clock than teams used to GDPR are modelling. If your incident-detection workflow has not been tested against the CRA template and your ENISA notification draft is not ready, September is going to be uncomfortable. Start now.

The revised Product Liability Directive closes the software-is-not-a-product gap. Member states transpose by 9 December 2026. Von Firn's piece today maps what it means for SaaS providers and embedded-software manufacturers selling into the EU. The liability structure mirrors the CRA: defect is presumed if the manufacturer cannot produce technical records. GPAI, CRA, Product Liability — three instruments, one answer. The documentation file is the risk, not the technology.

The Bundesgericht's 4A_70/2025 ruling resolves an Art. 340 OR question that had been dividing employment counsel. Servatius von Tatzenberg explains today what the decision confirms: where fault for the breakdown is shared between employer and employee, the clause is not automatically lifted. Full employer-caused justified exits remain a different matter — Art. 340c para. 2 OR still operates there; the clause lapses by operation of statute, not judicial discretion. If you want a partial-fault exit to release the clause, draft it explicitly. Courts will not imply it. Standard employment templates should be reviewed before the autumn hiring cycle — particularly for senior roles where non-competes are actually intended to hold.

The EU Listing Act entered into force 5 June — four weeks ago. Von Firn's piece today covers the simplified prospectus regime for SME growth markets and the secondary-issuance framework. If you have an EU capital markets transaction in H2 2026, your counsel should already be working from post-Listing Act templates. The old structure remains valid — it is just now more expensive than necessary.

Connected to the Kapitalband piece also out today: Swiss companies raising domestically can use the authorized capital band under Art. 653s–653v OR for equivalent financing flexibility — different instrument, no EU nexus required, same practical objective.

Von Tatzenberg's piece today on the year-end consultation confirms the Federal Council's direction: sectoral regulation, not a single AI act. That sounds simpler than it is. For in-house counsel, it means monitoring separate AI governance tracks in banking, insurance, health, and transport, with no unified compliance framework to anchor against. For multinationals straddling both jurisdictions, substantial EU equivalence is expected without formal adoption — which means the GPAI documentation obligations from August 2 apply to EU distribution regardless of Swiss regulatory status, and the Swiss framework arrives separately.

Von Firn today provides the drafting map for the authorized capital band under the 2023 OR revision: floor, ceiling, shareholder exclusion resolutions, board delegation mechanics. The band is genuinely useful for pre-IPO bridge financing. The failure mode is an articles provision that does not actually permit what the board wants to do when the round closes — at which point renegotiating the articles takes longer than the financing window. This work belongs in the current AV, not in next quarter's extraordinary general meeting agenda.

The CJEU's Brillen Rottler ruling establishes the leading CJEU framework for when a DSAR refusal qualifies as legitimate under Art. 12(5) GDPR — including, now, even a first request made with abusive intent — and it is the standard a court will apply when evaluating whether that refusal was legitimate. Von Tatzenberg's piece today translates the ruling into a practical checklist. The requirements: case-by-case assessment, documented grounds, identified disproportionality. A blanket refusal policy remains wrong. The ruling gives controllers something real — use it correctly or the defence fails.

FINMA notified on 16 June an update to the Russia/Ukraine Ordinance (SR 946.231.176.72, Annex 8). Not individually alarming — but a reminder that any programme running monthly or quarterly screening is structurally behind: the lists move faster than that. We covered the UN-1267 gap for ISIL and the December 2025 Iran ordinance in detail earlier; the Russia change does not alter the framework, but does require a fresh name-matching run if your last screen predates 16 June.

FINMA will relocate its Zurich office from the city centre to Zurich-Oerlikon. The official reasons are cost and working conditions. For practitioners who attend enforcement hearings or pre-application meetings in Zurich: Oerlikon is about 20 minutes from the Paradeplatz cluster by tram. If you are still booking travel to the Wasserwerkstrasse 12 address, update the default. Minor — but less minor if you miss the first tram.

Law.com reports continued downsizing by the largest foreign law firms in Hong Kong. For Swiss multinationals using international firms for HK-seated arbitration or listing work: thinner HK coverage typically means work is handled from Singapore or London, with the attendant time-zone and cost implications. If your group has HK-incorporated entities or uses the territory as an entry point for mainland deal flow, a panel conversation this quarter is worth having before you need the capacity and find it has moved.