<h3>What is the Timeline for the AI Act to Take Effect?</h3>
<p>On July 12, 2024, the EU AI Act (<a href="https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689" target="_blank" rel="noopener">Regulation (EU) 2024/1689</a>) was published in the EU&#8217;s Official Journal, which started the timeline for the Act to become effective. On August 1, 2024, it will enter into force. In general, the Act provides for a two-year transition period, but some rules will apply earlier and others later. Most importantly, on February 2, 2025, six months after the Act enters into force, the rules on prohibited AI practices will apply. Twelve months after the Act enters into force, the rules on general-purpose AI (GPAI) models become applicable.</p>
<p>The following table provides an overview of the timeline:</p>
<p><img decoding="async" src="https://cms.homburger.ch/wp-content/uploads/2024/07/Bulletin-MOL-Bild-1.jpg" /></p>
<h3>To Whom Does the AI Act Apply?</h3>
<p>The AI Act&#8217;s scope is exceptionally broad, in terms of both the persons in scope and the territorial reach. It applies not only to <strong>developers</strong> of AI systems and GPAI models and persons placing these on the market or putting them into service (referred to as «providers» in the Act), it also applies to all <strong>persons using</strong> an AI system in the course of their professional activities (referred to as «deployers»), and captures providers and deployers <strong>within the EU</strong> but also, to some extent, those <strong>outside the EU</strong> who access the EU market.</p>
<p>Specifically, the AI Act applies to, inter alia:</p>
<ol>
<li>Providers placing on the market or putting into service AI systems or placing on the market GPAI models in the EU, whether located within or outside the EU;</li>
<li>Deployers of AI systems within the EU;</li>
<li>Providers and deployers of AI systems outside the EU, where the output produced by the AI system is used in the EU;</li>
<li>Importers and distributors of AI systems;</li>
<li>Product manufacturers placing on the market or putting into service an AI system together with their product and under their own name or trademark.</li>
</ol>
<p>The AI Act is directly relevant for companies established in Switzerland because it applies to providers and deployers located in third countries: Swiss companies making AI systems or GPAI models available in the EU, who supply AI systems for use in the EU, or whose AI systems produce output used in the EU fall in the Act&#8217;s scope. Likewise, Swiss companies using AI systems as deployers to generate content used in the EU they are also subject to the Act.</p>
<p>Switzerland has taken a <a href="https://www.homburger.ch/de/insights/swiss-federal-council-launches-ai-regulatory-regime-review" target="_blank" rel="noopener">wait-and-see approach</a> to regulating AI. However, the Swiss Federal Council has instructed the Federal Department of Environment, Transport, Energy, and Communication to identify potential approaches to regulating AI by the end of 2024. Whether Switzerland follows suit and implements its own AI regulation remains to be seen.</p>
<h3>How Are AI Systems Defined?</h3>
<p>«AI systems» are defined broadly as machine-based systems <strong>designed to operate with varying levels of autonomy</strong>, that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, <strong>infer, from the input received, how to generate outputs</strong>, such as predictions, content, recommendations, or decisions that can influence physical or virtual environments. President Biden&#8217;s <a href="https://www.whitehouse.gov/briefing-room/presidential-actions/2023/10/30/executive-order-on-the-safe-secure-and-trustworthy-development-and-use-of-artificial-intelligence/" target="_blank" rel="noopener">executive order</a> (<em>see</em> our <a href="https://www.homburger.ch/de/insights/ai-regulation-update" target="_blank" rel="noopener">Bulletin</a>) and the <a href="https://oecd.ai/en/ai-principles" target="_blank" rel="noopener">OECD AI Principles</a> use similar definitions.</p>
<p>While the definition is broad, it should not be applied excessively. According to the AI Act&#8217;s recitals, the definition of an AI system is based on the key characteristics of the system, and AI systems are distinguished from traditional software systems, which are based on rules solely defined by natural persons to execute operations automatically. The key characteristic of an AI system is the capability to infer; i.e. to derive output from input in a manner not solely based on the rules given by the human programmer. The definition of an AI system therefore captures a broad range of AI-based applications, such as AI systems with a conversational interface enabling users to enter prompts for the AI system to generate output, but it does not capture traditional «if-then» algorithms for which the programmer predetermines the output based on programming logic. Traditional software programing or the use of formulas in spreadsheets accordingly would not qualify as AI systems, even if the relevant programs are executed automatically.</p>
<h3>What Are the Key Features of the AI Act?</h3>
<p>The AI Act adopts a risk-based approach, meaning that the regulatory obligations applicable to a specific AI system depend on the risks associated with such system.</p>
<ul>
<li><strong>Prohibited practices:</strong> Certain practices are prohibited because they are considered to pose an unacceptable level of risk. Prohibited are practices include using AI purposefully to manipulate a person&#8217;s consciousness with subliminal techniques, exploiting individual vulnerabilities due to age, disability, or a specific social or economic situation, evaluating or classifying people based on social behavior, and, subject to certain exceptions, remotely identifying people using biometric information for law enforcement purposes. These prohibitions apply from February 2, 2025.</li>
<li><strong>High-Risk AI Systems:</strong> An AI system is considered to be a high-risk system if it either is a safety component of a product regulated by specific EU laws that must undergo a conformity assessment (such as toys, elevators, radio equipment, medical devices, etc.), or if it falls into one of the categories listed in Annex III of the AI Act. High-risk AI systems are subject to detailed regulations, as outlined below.The categories listed in Annex III include a range of AI systems with specific uses, including:
<p>&#8211; Biometrics, such as remote biometric identification or emotion recognition;<br />
&#8211; Critical infrastructure, such as AI systems intended to be used as a safety component in critical digital infrastructure, road traffic, or in the supply of water, gas, heating, or electricity;<br />
&#8211; Educational and vocational training, such as to determine access or admission to educational and vocational training institutions;<br />
&#8211; Employment, workers&#8216; management, and access to self-employment, such as for recruitment;<br />
&#8211; Law enforcement, such as to evaluate the reliability of evidence;<br />
&#8211; Migration, asylum, and border control management, such as to assess a risk posed by a natural person entering the EU; and<br />
&#8211; Administration of justice and democratic processes, such as the use of AI systems by judicial authorities to assist in researching and interpreting the facts and the law.</p>
<p>As an exception to AI systems falling within one of the categories listed in Annex III, an AI system is not considered as high-risk AI system if it does not pose a significant risk of harm to the health, safety, or fundamental rights of natural persons, including if it does not materially influence the outcome of relevant decision making that affects fundamental rights.Accordingly, not every AI system used in an application listed in Annex III is <em>per se</em> a high-risk AI system.</p>
<p>According to the AI Act, except in the event of profiling of a natural person, an AI system is presumed not to pose a significant risk. That is, in the event that the AI system only performs a narrow procedural task—such as improving the result of a previously completed human activity, detecting decision-making patterns or deviations therefrom—and provided it is not meant to replace or influence human assessment without proper human review, or only performs preparatory tasks, it will not be classified as high risk.</li>
</ul>
<ul>
<li><strong>AI Systems Subject to Transparency Obligations:</strong> For certain AI systems that are neither prohibited nor qualify as high-risk AI systems, the Act imposes transparency obligations. These transparency obligations capture AI systems intended to interact directly with natural persons or that generate synthetic audio, image, video, or text. AI-generated content must be marked as such. The rules on transparency for these normal AI systems apply to both, providers and deployers of such AI systems. Practically speaking, this will be relevant for companies using AI systems in day-to-day applications, such as for chatbots in client interaction, or to generate content like images, videos, and the like. Such companies must ensure that it is transparent to users that they are interacting with an AI system or that the content is generated artificially. The rules are intended, <em>inter alia</em>, to prevent people from being misled by undisclosed deep fakes.</li>
<li><strong>Other AI Systems:</strong> AI systems that do not fall into any of the foregoing categories, and that do not qualify as GPAI models, are not regulated by the AI Act.</li>
</ul>
<h3>Which Rules Apply to High-Risk AI Systems?</h3>
<p>The AI Act addresses the risks resulting from high-risk AI systems in several ways. First, it defines certain requirements for high-risk AI systems. Second, it stipulates certain obligations for providers and deployers of high-risk AI systems and for certain other third parties. Third, it establishes a conformity assessment procedure for high-risk AI systems.</p>
<ul>
<li>The requirements applicable to <strong>high-risk AI systems</strong> include a risk management system, appropriate data governance and management practices for training models, technical documentation demonstrating compliance, automatic logging to ensure a level of traceability appropriate to the AI system&#8217;s intended purpose, and transparency sufficient to enable deployers to interpret the system&#8217;s output. In addition, the AI Act requires high-risk AI systems to be designed and developed in a way that natural persons can adequately oversee them to prevent or minimize the risks to health, safety, or fundamental rights. High-risk AI systems must also be designed and developed such that they achieve an appropriate level of accuracy, robustness, and cybersecurity based on benchmarks and measurement methodologies that the EU Commission will develop.</li>
<li><strong>Providers of high-risk AI systems</strong> must ensure compliance with the requirements applicable to high-risk AI systems. In addition, providers must provide information sufficient to identify them as the provider of the high-risk AI system, implement a quality management system, maintain documentation, keep logs, and ensure that the high-risk AI system undergoes the required conformity assessment procedure, that the conformity declaration is drawn up, and that the system bears the requisite «CE» mark demonstrating conformity with EU health and consumer safety regulation.<br />
In addition, on request from a competent authority, providers of high-risk AI systems must demonstrate that the system conforms with the requirements in the Act. Whether or not the conformity assessment requires the involvement of a third party performing the assessment (referred to as a «notified body») or whether it can be done by the provider internally, depends on the specific high-risk AI system. Only a limited number of high-risk AI systems require providers to involve a notified body to conduct the assessment.</li>
<li><strong>Deployers of high-risk AI systems</strong> must take appropriate technical and organizational measures to ensure that they use the systems pursuant to the user instructions and they must assign natural persons who have the necessary competence, training, and authority, as well as the necessary support, to oversee use of the high-risk system.<br />
To the extent it is able to do so, deployers must also ensure that input data is relevant and sufficiently representative in view of the intended purpose of the high-risk AI system. In addition, the Act requires deployers to monitor the operation of high-risk AI systems and to report certain risks and incidents to the provider of the system. The requirements further include record keeping obligations and transparency obligations vis-à-vis workers.</li>
</ul>
<h3>How Are GPAI Models Defined?</h3>
<p>The regulations regarding GPAI models were added during the legislative process to account for the launch of AI models, such as the various versions of GPT, Gemini, and Mistral. GPAI models are defined as AI models that display <strong>significant generality</strong> and are capable of competently performing a <strong>wide range of distinct tasks</strong> regardless of the way in which the models are placed on the market. They <strong>can be integrated into a variety of downstream systems or applications</strong>. AI models that are used for research, development, or prototyping activities before they are placed on the market are excluded from the Act.</p>
<p>The term «AI model» as used in the definition of the GPAI model is not defined, but this term generally refers to an algorithmic model that uses statistics, machine learning, and similar techniques to create an output based on an input, and which must be combined with further components (such as a user interface) to become an AI system.</p>
<h3>Which Rules Apply to GPAI Models?</h3>
<p>The regulations applicable to GPAI models depend on their classification. Pursuant to the AI Act, GPAI models are classified as either posing systemic risk, normal, or normal and released under an open source license. A GPAI model is classified as posing a systemic risk if it has high-impact capabilities, which are presumed if the model has more than 10^25 FLOPs.</p>
<p>The following table illustrates the regulations applicable to the three categories:</p>
<p><img decoding="async" src="https://cms.homburger.ch/wp-content/uploads/2024/07/Bulletin-MOL-Bild-2.jpg" /></p>
<p>Providers of GPAI models with systemic risk must perform model evaluations pursuant to standardized protocols, assess and mitigate systemic risks, document serious incidents and corrective measures, and ensure an adequate level of cybersecurity protection.</p>
<p>Importantly, the specific rules governing GPAI models apply in addition to, and not in lieu of, the general rules governing AI systems. Thus, a provider of a GPAI model that is also a high-risk AI system must comply with the rules governing the GPAI model as well as with those governing the specific high-risk AI system.</p>
<h3>How is the AI Act Enforced?</h3>
<p>The AI Act provides for supervisory and enforcement bodies at the EU and Member-State level. At the EU level, the AI Act provides for an AI Office and a European Artificial Intelligence Board. With respect to GPAI models, the European Commission has the exclusive supervisory and enforcement power. At the Member-State level, each Member State shall establish or designate as national competent authorities at least one notifying authority and at least one market surveillance authority for the purposes of the AI Act.</p>
<h3>What Sanctions Apply for Non-Compliance?</h3>
<p>Member States will establish rules for penalties and other enforcement measures. Engaging in a prohibited AI practice as described above is subject to administrative fines of up to EUR 35 million or, if the offender is a company, up to 7 percent of total worldwide annual turnover, whichever is higher. Violation of certain of the obligations associated with high-risk AI systems can give rise to fines of EUR 15 million or, if the offender is a company, up to 3 percent of its total worldwide annual turnover. Supplying incorrect, incomplete, or misleading information is also a fineable offense.</p>
<p>The fine amount will be determined based on all the relevant circumstances, including the nature, gravity, and duration of the infringement, prior misconduct, the annual turnover and market share of the offender, and any other aggravating or mitigating factors.</p>
<h3>Next Steps</h3>
<p>Companies that develop or use AI for their business activities should determine whether their activities are covered by the AI Act, the risk associated with those activities, and then ascertain the corresponding regulatory requirements. Specifically, this will require companies to consider the following:</p>
<ul>
<li><em>First</em>, whether they have a nexus to the EU that triggers the application of the AI Act, such as being located in the EU, placing AI systems or GPAI models on the market in the EU, or providing AI-system outputs in the EU.</li>
<li><em>Second</em>, whether the risk associated with AI activities, including whether they provide or use high-risk AI systems, provide GPAI models, or use AI to generate content or interact with individuals.</li>
<li><em>Third</em>, depending on the outcome of this risk assessment, identify and ensure compliance with the applicable regulatory obligations under the AI Act, which may range from transparency obligations to more stringent regulations and compliance requirements.</li>
</ul>
<p>This initial exercise, required to determine whether the Act applies and if so how, is critical, but depending on the nature of one&#8217;s AI use, it may only be a first step toward compliance. Indeed, whether the Act applies or not, providers and deployers of AI systems will also have to ensure that the data they use for their AI is accurate, consistent, and appropriate to be used. They will also have to ensure that the data collected and used complies with applicable data protection, data privacy, and intellectual property laws and regulations.</p>
<p>Providers and deployers will also have to review and consider their data retention and related policies, particularly as it relates to the Act&#8217;s logging requirements, but also more generally with respect to their AI use. Further, providers and deployers will want to revisit their risk management policies and procedures to identify potential data risks and to develop strategies to mitigate them. Finally, providers and deployers will want to develop training programs regarding best practices regarding AI use, data governance, and compliance.</p>


Homburger Bulletin

EU AI Act Enters Into Force on August 1, 2024

<h3>Federal Council Proposes to Align Current Rules With the EU Corporate Sustainability Reporting Directive</h3>
<p>On June 26, 2024, the Swiss Federal Council opened a consultation process regarding potentially stricter corporate sustainability reporting for Swiss companies. The proposed amendment (the <strong>Draft Amendment</strong>) of articles 964a &#8211; 964c of the Swiss Code of Obligations (<strong>CO</strong>) is intended to bring the current Swiss non-financial matter reporting provisions in line with the EU Directive 2022/2464 of December 14, 2022 on corporate sustainability reporting (Corporate Sustainability Reporting Directive, <strong>CSRD</strong>). The consultation process lasts until October 31, 2024.</p>
<p>Rather than fully replicate the CSRD, the Federal Council has proposed modifying the existing reporting requirements on non-financial matters under the CO, including by broadening its scope of application, with the effect that more companies will be required to prepare and publish a report on sustainability aspects. According to the Federal Council, whereas the existing reporting obligations affect around 300 companies, the proposed rules would obligate approximately 3,500 companies to report on risks relating to the environment, human rights, and corruption, and the measures they are taking to mitigate these risks.<a href="#_ftn1" name="_ftnref1">[1]</a></p>
<p>The main changes proposed by the Draft Amendment are summarized in the table under Section A, followed by a more detailed discussion of key aspects of the Draft Amendment.</p>
<h3>A. Overview of Key Changes to the Existing Rules</h3>
<h4>1. Scope:</h4>
<p><img decoding="async" src="https://cms.homburger.ch/wp-content/uploads/2024/06/Tabelle-Scope-1.jpg" /></p>
<h4>2. Content:</h4>
<p><img decoding="async" src="https://cms.homburger.ch/wp-content/uploads/2024/06/Tabelle-Content-1.jpg" /></p>
<h4>3. Reporting standard:</h4>
<p><img decoding="async" src="https://cms.homburger.ch/wp-content/uploads/2024/06/Tabelle-Reporting-1.jpg" /></p>
<h4>4. Audit / assurance requirements:</h4>
<p><img decoding="async" src="https://cms.homburger.ch/wp-content/uploads/2024/06/Tabelle-Audit-1.jpg" /></p>
<h4>5. Approval requirements:</h4>
<p><img decoding="async" src="https://cms.homburger.ch/wp-content/uploads/2024/06/Tabelle-Approval-1.jpg" /></p>
<p>&nbsp;</p>
<h3>B. Key Aspects of the Draft Amendment</h3>
<h4>1. Extended Scope</h4>
<p>The proposed modified sustainability reporting provisions would apply to the following entities:</p>
<ol>
<li>«Public interest entities» (<em>Gesellschaften des öffentlichen Interesses</em>);</li>
<li>Companies that exceed two of the following figures in two consecutive financial years: (i) total assets of CHF 25 million; (ii) revenue of CHF 50 million; (iii) 250 full-time employee positions per year on average;</li>
<li>Companies obliged to prepare consolidated financial statements and that exceed two of the thresholds in (b) above in two consecutive financial years.</li>
</ol>
<p>As of today, only «public interest entities» with at least 500 full-time equivalents on annual average in two consecutive financial years that exceed either the relevant balance sheet total (CHF 20 million) or revenue threshold (CHF 40 million) in two consecutive financial years are subject to the non-financial matters reporting requirements.</p>
<p>Under the Draft Amendment, «public interest entities» are generally subject to the new reporting requirement, regardless of whether they meet any of the quantitative thresholds described in item (b) above, unless they qualify as an exempted small company (as further described below). In addition, any company, irrespective of whether it qualifies as a «public interest entity», that satisfies two of the three quantitative thresholds described in item (b) above on a standalone or a consolidated basis would also have to establish a sustainability report. The Draft Amendment also contemplates reducing the «full-time equivalents» from 500 to 250.</p>
<p>Companies that would otherwise have to report but are controlled by another company that prepares a Swiss law sustainability report or an equivalent report under foreign law are exempt. Also exempt are small companies that alone or together with domestic or foreign companies that they control do not exceed two of the applicable thresholds (viz. total assets of CHF 450,000, sales revenue of CHF 900,000, 10 full-time employees on annual average in two consecutive years).</p>
<h4>2. Annual Sustainability Report: Format</h4>
<p>Companies subject to the Draft Amendment would continue to be obliged to produce an annual sustainability report. The annual sustainability report may be prepared as a separate report or, in alignment with the CSRD, it may be integrated into the management report pursuant to article 961c CO. The report must be in an electronic reporting format established in accordance with an internationally recognized standard, namely the one used by the EU member states.</p>
<h4>3. Reporting Requirements</h4>
<p>Compared to the existing non-financial matter reporting, the Draft Amendment further expands and specifies the scope of the information on sustainability. The current law&#8217;s terminology would largely be replaced with new terms that have a similar meaning. The information to be reported on is described as follows:</p>
<ul>
<li>Environmental factors (<em>e.g.</em>, climate protection &#8211; including greenhouse gas emissions, water and marine resources, resource utilization and the circular economy, soil, water, and air pollution, and biodiversity and ecosystems &#8211; as well as human health and safety and the use of renewable and non-renewable energy, including exposure to coal and oil-and gas-related activities);</li>
<li>Social aspects, including employee matters (<em>e.g.</em>, measures to protect various interest groups (such as shareholders, employees, and customers), working conditions, diversity, measures against violence and harassment, disability accommodations, and work-life balance);</li>
<li>Human rights aspects; and</li>
<li>Governance aspects (<em>e.g.</em>, the role of the board of directors and management in respect of sustainability aspects, the strategy for linking incentives for board and management members to sustainability aspects, internal controls and risk management systems related to sustainability, policies and measures to combat corruption).</li>
</ul>
<p>In line with the reporting requirements under the Federal Ordinance on Reporting on Climate of November 23, 2022, which became effective on January 1, 2024, the Draft Amendment requires in-scope companies to report on the statues regarding achieving the net-zero greenhouse gas emissions target by 2050 to limit global warming to 1.5°C above pre-industrial levels. This will include reporting on Scope 1, Scope 2 and, where applicable, Scope 3 greenhouse gas emissions in accordance with the current GHG Protocol Corporate Accounting and Reporting Standard.</p>
<p>The Draft Amendment would also expressly require reporting on governance matters, beyond reporting on the combat of corruption.</p>
<p>Like the existing law, the Draft Amendment continues to list specific sustainability aspects that must be described in the report in more detail, such as the company&#8217;s business model and strategy, applied due diligence processes in respect of sustainability aspects, material risks the company faces with respect to sustainability aspects or material financial, and non-financial performance indicators. However, the list included in the Draft Amendment adds new items, such as a description of the time-bound sustainability targets that the company has set itself, a description of the role of the board of directors in relation to sustainability, or information on any incentive systems linked to sustainability that are offered to directors and executives.</p>
<p>The most significant change to current non-financial matter reporting is that all information must be provided in compliance with the standards used in the EU (<em>i.e.</em>, the European Sustainability Reporting Standards (ESRS)) or another equivalent standard for sustainability reporting (the explanatory report also mentions the IFRS Sustainability Disclosure Standards or the Global Reporting Initiative (GRI) as examples). The selected standard must be adopted in its entirety. The Federal Council will designate the standards that are equivalent to the ESRS in an ordinance.</p>
<p>Under the Draft Amendment, the applicable standard will be determined by the board of directors; however, the standard may also be determined based on a shareholder vote at a general meeting.</p>
<p>Further information regarding the specific reporting matters is available in the Federal Council&#8217;s related explanatory report.<a href="#_ftn1" name="_ftnref1">[1]</a></p>
<h4>4. Double Materiality Principle</h4>
<p>The Draft Amendment clearly establishes the principle of «dual materiality» in line with the CSRD. The sustainability report must therefore disclose the information necessary to understand the impact of the company&#8217;s activities on sustainability issues and the impact of sustainability issues on the company&#8217;s business, financial performance, and position.</p>
<p>In contrast with the current law, in which the principle of «double materiality» already applies, the proposed draft seeks to clarify that, in accordance with EU law, information must be disclosed that is material under both aspects as well as information that is material under only one aspect.</p>
<h4>5. «Comply or Explain»</h4>
<p>The option available under the current law to waive reporting on certain sustainability topics under certain conditions («comply or explain») would no longer be available under the Draft Amendment. The «comply or explain» approach is also not available under the CSRD framework.</p>
<h4>6. New Auditing and Assurance Requirements</h4>
<p>The current law does not impose any audit or assurance requirements on the reporting of non-financial matters. By contrast, under the Draft Amendment, the sustainability information included in the report must be made subject to assurance. Either independent audit firms<a href="#_ftn2" name="_ftnref2">[2]</a> or conformity assessment bodies (<em>Prüfgesellschaft</em>) may provide assurance.</p>
<p>The Federal Council will determine, taking into account international developments, including EU law, whether any assurances from audit or conformity assessment bodies should take the form of a «positive» / reasonable assurance or a «negative» / limited assurance. The EU contemplates introducing a positive reasonable assurance requirement by October 1, 2028.</p>
<p>In addition, in respect of companies subject to an ordinary audit pursuant to article 728a CO, the Draft Amendment would require the statutory auditor to conduct an audit on whether there are material inconsistencies between the information in the sustainability report and the audited standalone and consolidated financial statements. This audit review does not include a material audit of the accuracy of completeness of the information published in the sustainability report.</p>
<h4>7. Shareholder Vote</h4>
<p>The Draft Amendment maintains the requirement that the sustainability report be approved by shareholders at each annual general meeting. The CSRD does not require shareholder approval of sustainability reports. The explanatory report to the Draft Amendment expressly states that the shareholder vote on the sustainability report is binding, and not advisory, contrary to the currently prevailing practice under the existing law.<a href="#_ftn3" name="_ftnref3">[3]</a></p>
<h4>8. Criminal Law Provisions</h4>
<p>The criminal law sanctions for an inaccurate or incomplete report remain unchanged in substance. A fine of up to CHF 100,000 will be imposed on anyone who intentionally makes false statements in the reports, fails to make the required reports, or fails to comply with the legal obligation to keep and store the report.</p>
<h4>9. Timeline</h4>
<p>The Federal Council will determine the date on which the new provisions become effective. Companies will then have two years to adapt to the new law. During this two-year transition period, the current law will apply.</p>
<h6><a href="#_ftnref1" name="_ftn1">[1]</a>   <em>See </em>Federal Council, «Änderung des Obligationenrechts (Transparenz über Nachhaltigkeitsaspekte): Erläuternder Bericht zur Eröffnung des Vernehmlassungsverfahrens», 25-33 (<em>available at </em><a href="https://www.newsd.admin.ch/newsd/message/attachments/88435.pdf">https://www.newsd.admin.ch/newsd/message/attachments/88435.pdf</a>).</h6>
<h6><a href="#_ftnref2" name="_ftn2">[2]</a>   Pursuant to article 6a of the Auditor Oversight Act of December 16, 2005</h6>
<h6><a href="#_ftnref3" name="_ftn3">[3]</a>   <em>See </em>Federal Council, «Änderung des Obligationenrechts . . .» at 36-37.</h6>
<h6><a href="#_ftnref1" name="_ftn1">[1]</a>   <em>See </em>Federal Council, &#8222;Nachhaltige Unternehmensführung: Bundesrat schlägt strengere Regeln für Berichterstattung vor&#8220; (June 26, 2024), <em>available at </em><a href="https://www.admin.ch/gov/de/start/dokumentation/medienmitteilungen.msg-id-101585.html">https://www.admin.ch/gov/de/start/dokumentation/medienmitteilungen.msg-id-101585.html</a>.</h6>
<p>&nbsp;</p>


Homburger_Illu_ZPO_BH_Preview_2020_10 (2)

Swiss Corporate Sustainability Reporting

<h3>Implications for Swiss Companies</h3>
<p>On May 24, 2024, the Council of the EU adopted the Corporate Sustainability Due Diligence Directive. The Directive, which is part of the EU&#8217;s transition to a climate-neutral and green economy, lays down rules to ensure that companies operating in the EU respect human rights and the environment throughout their operations and value chains.</p>
<p>The Directive represents a significant shift in the EU regulatory framework on sustainable corporate governance, and will have a substantial impact on Swiss companies that operate in the EU market or that are part of a group that does. We summarize the Directive&#8217;s main features and highlight the implications for affected Swiss companies.</p>
<h3>A. Scope</h3>
<p>The Directive applies extraterritorially to non-EU companies with annual net turnover exceeding €450 million in the EU (or the ultimate parent company of a group that reaches this threshold). It also covers EU and non-EU franchisors and licensors (or the ultimate parent company of a group) with annual royalties over €22.5 million and a net EU turnover exceeding €80 million.</p>
<p>Additionally, Swiss companies not directly covered may also be impacted indirectly as business partners of upstream or downstream in-scope entities.<a href="#_ftn1" name="_ftnref1">[1]</a> In-scope financial institutions, for example, are required to conduct due diligence on their own operations and upstream business partners, such as investors, but not downstream business partners, such as borrowers.</p>
<p>Swiss companies that fall within these categories, are part of a group that does, or do business with in-scope entities, will be, directly or indirectly, subject to the Directive&#8217;s obligations.</p>
<h3>B. Obligations</h3>
<p>In-scope companies must integrate risk-based due diligence into their policies and risk management systems, covering both human rights and environmental impacts. These obligations are more detailed than and go beyond the due diligence obligations in the Swiss Ordinance on Due Diligence and Transparency, which are limited to child labor and certain minerals and metals.</p>
<p>The core due diligence obligations in the Directive include identifying and assessing actual and potential adverse human rights and environmental impacts, preventing and mitigating these impacts, monitoring effectiveness, and providing remediation.</p>
<p>In addition, in-scope companies must implement a climate transition plan, aligned with the Paris Agreement&#8217;s goal of limiting global warming to 1.5°C, and including time-bound and science-based targets for 2030 and five-year steps up to 2050. Companies must develop actions to achieve these targets and update their transition plans annually.</p>
<p>The Directive also requires companies to communicate publicly regarding their due diligence efforts, with annual statements on their websites, and to engage with stakeholders, establish a notification mechanism and complaints procedure, and monitor the effectiveness of their due diligence measures.</p>
<h3>C. Penalties for Non-compliance</h3>
<p>Member States will impose pecuniary and non-pecuniary penalties for breaches. Maximum fines shall be not less than 5 percent of net worldwide turnover in the preceding financial year. Non-compliant companies may also be barred from participating in public contracts and tenders, and authorities may publicly «name and shame» companies that fail to meet due diligence obligations.</p>
<p>Companies may also be liable for civil damages if their failure to conduct proper due diligence harms people or the environment. This reverses the typical burden of proof in favor of claimants, who may be individuals, groups, or organizations affected by the adverse impacts. The statute of limitations for such civil claims is five years, or not lower than the minimum period under national regimes for general civil liability.</p>
<h3>D. Compliance Timeline</h3>
<p>The Directive will enter into force twenty days after its official publication in the EU&#8217;s Official Journal, after which Member States will have two years to transpose the Directive into national laws.</p>
<p>For in-scope non-EU companies, compliance and reporting obligations will phase in depending on size and turnover. For those with annual net EU turnover exceeding €1.5 billion, compliance will begin three years after entry into force (2027); more than €900 million, after four years (2028); more than €450 million, after five years (2029).</p>
<h3>E. Next Steps</h3>
<p>Swiss companies potentially within the Directive&#8217;s scope should assess their current policies and practices against the Directive&#8217;s requirements and prepare to implement the necessary due diligence measures and transition plans. All Swiss companies should evaluate their role in the value chain of in-scope companies and anticipate potential requests for information or cooperation from their business partners.</p>
<p>Swiss companies should also monitor the development and implementation of the Directive&#8217;s requirements and further guidance from the EU, as well as the possible further development of due diligence legislation in Switzerland.</p>
<h6><a href="#_ftnref1" name="_ftn1">[1]</a> In-scope EU entities include companies formed under the laws of a Member State that have over 1,000 employees on average during the course of a financial year and an annual net worldwide turnover exceeding €450 million.</h6>


Jonathan
Silberstein-Loeb

Bar Registration

EU AI Act Enters Into Force on August 1, 2024

Swiss Corporate Sustainability Reporting

EU Corporate Sustainability Due Diligence Directive

Caveat Emptor and Sandbagging: U.S. Law and Swiss Practice

Making News: Historical Perspectives on the Political Economy of the Press in Great Britain and the United States since 1700

The Transatlantic Origins of the Business Trust

Join the Team

Jonathan Silberstein-Loeb

Career

Languages

Bar Registration

Teams

JonathanSilberstein-Loeb

Bar Registration

EU AI Act Enters Into Force on August 1, 2024

Swiss Corporate Sustainability Reporting

EU Corporate Sustainability Due Diligence Directive

Caveat Emptor and Sandbagging: U.S. Law and Swiss Practice

Making News: Historical Perspectives on the Political Economy of the Press in Great Britain and the United States since 1700

The Transatlantic Origins of the Business Trust

Join the Team

Jonathan Silberstein-Loeb

Career

Languages

Bar Registration

Teams

Jonathan
Silberstein-Loeb