Category: Articles

A TikTok cover may look deceptively simple: one singer, one smartphone, one well-known song. Yet behind a few seconds of content lies a complex web of intellectual property rights. A cover version can involve rights in the underlying musical composition and lyrics, the performer’s own neighbouring rights, the audiovisual recording of the video, and, increasingly, the licencing arrangements put in place by social media platforms. This raises a recurring question for creators and rights holders alike: when a user performs someone else’s song on TikTok, does recording and posting that cover require permission, and if so, from whom? This article explores the issue from an EU, German and French perspective.

 

2. EU perspective: several rights in one cover

At EU level, the starting point is the distinction between the underlying song, the singer’s new performance and any existing recording used in the video. Under the InfoSoc Directive, recording and uploading a cover may engage the author’s reproduction and communication-to-the-public rights in the composition and lyrics. The singer may, in turn, hold neighbouring rights in their own recorded performance.

Where the creator sings over the original track, additional rights of the original performers and the phonogram producer may also be involved. An a cappella cover avoids using the original recording, but the underlying composition and lyrics remain protected. EU copyright law provides certain exceptions, including quotation, criticism, parody and pastiche. However, there is no general exception permitting covers simply because they are short, non-commercial or posted on social media. The cover singer may hold performers’ rights in their own performance, but those rights coexist with the copyright subsisting in the underlying musical work and do not necessarily extend to every element of the resulting recording.

 

3. TikTok and platform licences: does the platform solve everything?

As a major user-upload platform, TikTok generally falls within the category of online content-sharing service providers targeted by Article 17 of the DSM Directive. Article 17 addresses the platform side of the equation by requiring such providers to obtain authorisation from rights holders for protected content uploaded by users and by establishing the conditions under which they may incur liability where no authorisation has been obtained.

TikTok’s music ecosystem often creates the impression that copyright issues have already been resolved. To some extent, this is true: platforms such as TikTok typically rely on  licensing agreements with major rights holders, including record labels and collecting societies, allowing users to incorporate a wide range of musical works into their content within the functionality and terms of the platform. These licences reduce the burden on individual creators and facilitate the day-to-day use of music on the platform.

However, creators should not assume that all rights are automatically cleared. Platform licences generally cover only certain uses and may not extend to every territory, type of content, or commercial exploitation. Furthermore, the exact scope of these licenses is often not transparent to users. Crucially, a creator recording a cover produces a new performance and a new audiovisual recording: several layers of rights coexist, including rights in the musical composition, the lyrics, and the performance itself. The existence of a platform licence does not eliminate the need to assess whether additional permissions are required and, for this reason, users should not automatically treat Tik Tok license agreements as a blanket authorization.

 

4. The German perspective: cover or adaptation?

Under German copyright law, the starting point is the distinction between the underlying song and the singer’s own performance. The composition and lyrics are generally protected as musical and/or literary works within the meaning of § 2 UrhG. A singer who records a TikTok cover may also benefit from neighbouring rights as a performing artist, since § 73 UrhG expressly protects those who sing, play or otherwise perform a work.

However, these performers’ rights do not replace the rights in the original song. Uploading a cover to TikTok may involve making the underlying work available to the public within the meaning of § 19a UrhG. In practice, licensing may be handled through platform arrangements or collecting societies such as GEMA, but creators should not assume that every use is covered. Particular caution is required where the cover goes beyond a faithful interpretation: under § 23 UrhG, adaptations or other transformations of a work, including a melody, generally require the author’s consent before publication or exploitation. This may be relevant, for example, where lyrics are changed, translated or substantially rearranged, or where the creator uses the original master recording or a third-party instrumental track.

 

5. The French law perspective: performers’ and moral rights

Under French copyright law, a song is protected as a musical work, while performers benefit from neighbouring rights over their own interpretation. A TikTok cover may therefore engage both the author’s rights in the composition and lyrics and the performer’s rights in the recorded performance, governed by the French Intellectual Property Code.

France transposed Article 17 of the DSM Directive through loi n° 2021-1382, reinforcing the obligations of online content-sharing platforms to obtain authorisation for protected content uploaded by users. In practice, platforms such as TikTok rely on licensing arrangements with collecting societies such as SACEM, publishers and other rights holders. Nevertheless, French law provides no broad exception permitting users to freely upload cover versions online. The non-commercial nature of a post or the fact that it is shared on social media does not remove the need to consider copyright clearance.

French law also grants authors extensive moral rights, including the right to respect for the integrity of their works. Consequently, a cover version that substantially alters the lyrics, meaning or artistic expression of a song may raise issues extending beyond economic rights alone.

 

6. Practical takeaway: before hitting “publish”

Posting a cover on TikTok is rarely a copyright-free act, regardless of how spontaneous or non-commercial it may appear. The singer may hold rights in their own performance, but the underlying song – and, where used, the original recording – remains protected. Platform licences provide a useful starting point and facilitate many uses of music on social media, but they do not resolve every rights question. Particular care is therefore required where a cover substantially changes the original song, uses third-party recordings or forms part of commercial, branded or monetized content.

The practical lesson is simple: the singer may hold rights in their own performance, but not necessarily the song.

Ultimately, the legal assessment will depend on several factors, including the nature of the cover, the music used, the scope of any applicable platform licences and the intended exploitation of the content.

In recent years, “being green” has become a powerful marketing tool. Consumers increasingly reward brands that appear sustainable, and companies are keen to communicate their environmental commitments. But the regulatory environment has changed, it is no longer enough to say that a product, brand or business is sustainable, companies must be able to prove it.

The European Commission has found that many environmental claims on the market are vague, misleading or unsupported by evidence, undermining consumer trust and penalising businesses that genuinely invest in sustainability. Against this background, Directive (EU) 2024/825 and its Italian implementation, Legislative Decree No. 30/2026, have strengthened the rules against unfair commercial practices, particularly greenwashing, misleading sustainability labels and unsubstantiated environmental claims. The decree amended the Italian Consumer Code and entered into force on 24 March 2026, although the new provisions will apply from 27 September 2026.

A broader concept of environmental claim

The amended Italian Consumer Code introduces new definitions, including “environmental claim”, “generic environmental claim”, “sustainability label”, “certification scheme”, “durability” and software updates for goods with digital elements.

This is important because the concept of environmental claim is broad, it may cover any non-mandatory commercial message or representation, including text, images, symbols, labels, brand names, company names or product names, where that message states or implies that a product, product category, brand or trader has a positive or zero environmental impact, is less damaging to the environment, or has improved its impact over time.

As a result, compliance will not involve only express statements such as “green”, “eco-friendly” or “climate neutral”. The overall presentation of a product, including packaging, colours, imagery, advertising, websites, e-commerce pages, social media campaigns and point-of-sale materials, may also be relevant if it creates an environmental impression for consumers.

What will become high-risk

Certain practices will be prohibited in all circumstances once the new provisions become applicable. The amended Italian Consumer Code expands the list of practices that may be misleading or prohibited in all circumstances. Generic environmental claims, such as “green”, “eco-friendly” or “biodegradable”, may be risky and unlawful where they are not properly specified or where the trader cannot demonstrate recognised excellent environmental performance relevant to the claim.

Sustainability labels will also require close scrutiny. They may only be displayed if they are established by public authorities or based on a qualifying certification scheme, with public requirements and independent third-party verification. Self-created icons, badges or “green seals” used for marketing purposes will therefore need to be carefully reviewed.

Climate-related claims are another key area. Businesses will no longer be allowed to claim, on the basis of greenhouse gas offsetting, that a product has a neutral, reduced or positive environmental impact in terms of greenhouse gas emissions. Carbon credits and environmental projects may still be communicated, but not in a way that suggests that the product itself has no climate impact if this is not based on its actual lifecycle impact.

The rules also target selective communication, for example businesses should not present an environmental benefit as relating to the whole product or to the trader’s entire activity where it actually concerns only one specific aspect.

Finally, forward-looking claims, such as net-zero or climate-neutrality targets, must be supported by clear, objective, publicly available and verifiable commitments, included in a detailed and realistic implementation plan and periodically verified by an independent third-party expert.

From marketing review to compliance process

This is no longer just a communication issue, it is a risk management issue. Businesses should be prepared to substantiate every sustainability claim with evidence that is accurate, up to date and robust enough to withstand scrutiny from consumers, competitors and enforcement authorities.

Companies should therefore map their environmental and social claims across all channels, review the evidence behind them, check the reliability of labels and certifications.

The direction of travel is clear: sustainability communication is moving from marketing language to compliance evidence. In the new framework, “green” is no longer just a message. It is a claim that must be substantiated.

Pending litigation in Italy

Around two thousands of claims were raised in 2023 before the Italian Administrative Court of Rome against the so called ‘payback system’ according to which the supplier of medical devices were requested to contribute to the coverage of the regional governments’ public expenditure on medical devices in excess of a certain limit (as identified by Ministerial Decree 6 July 2022) for FYs 2015, 2016, 2017 and 2018.

The issue was submitted by the Administrative Court of Lazio to the Constitutional Court that, with its final judgement No. 140/2024, confirmed the constitutional legitimacy of the rules governing payback, in the limit of 48% of the payments requested by the Regions, essentially affirming that the law can limit private economic initiative in case of social needs, providing a solidarity contribution, provided that it responds to the principles of reasonableness and proportionality.

Subsequently, after continuous pressure of Associations of operators, the Government further reduced to 25% the payments requested by the Regions, which led the majority of the operators to pay the amounts requested, waiving the pending litigations.

A similar situation is currently evolving against a contribution of 0.75% of companies’ annual turnover introduced to finance a fund for the governance of medical devices provided for by Legislative Decree No. 137/2022.

Numerous operators have filed appeals also against the introduction of this contribution before the administrative Court, all of which were rejected.

However, recent news is that, in appealing these rulings, the Supreme Administrative Court has decided once again to involve the Constitutional Court to ascertain the constitutional legitimacy of the relevant rules and regulations.

Particularly, the Supreme Court issued the decision No. 1588/2026 highlighting a possible violation of the constitutional principles of reasonableness, equality, and proportionality, considering that such contribution (in addition to the payback) creates a sort of undue taxation exclusively on a limited group of operators who sell medical devices to the public health service, without a precise assessment of the balance between public needs and entrepreneurial freedom guaranteed by the constitution.

Pending the Constitutional Court’s ruling and the subsequent final judgement of the Supreme Administrative Court, the contribution of 0,75% of revenues continues to be due, causing again an inevitable, prejudicial uncertainty regarding the outcome of this legal proceeding and the possibility of obtaining full or partial reimbursement of the amounts paid.

AI is no longer a new concept in the world of justice. Many law firms already have internal AI tools, and large legal databases now offer their own AI tools. State courts in Germany are also pushing ahead with the digitisation of civil proceedings, as demonstrated by a resolution of the Conference of Ministers of Justice in June 2025 and the adoption of a “Joint Declaration on the Use of Artificial Intelligence in the Justice System”.

AI applications can contribute to the effective and rapid processing of legal cases in the context of legal practice. For example, AI tools can be used as analysis and document management systems. Modern AI systems can analyse large quantities of documents in a very short time and extract relevant information.

The use of AI in document analysis appears to be unproblematic in principle. However, all AI tools have their respective risks and limitations in the context of legal practice. Not all AI tools are suitable for each individual case, and hallucinations are a problem. The following case example is based on the use of one of the currently available AI tools.

AI to support evidence presentation – Case example

A current case concerns a claim relating to several thousand damaged items. The client has documented the damages individually in damage reports and documented it with photos. Accordingly, the damage reports are correspondingly extensive.

How best to review thousands of documents?

In this context, the question arises as to how such a large number of damaged items should be dealt with in view of legal proceedings and the presentation of evidence. In terms of the burden of proof according to German law, the claimant would in principle have to prove precisely every instance of damage to each individual item. In return, however, the court would also have to examine the relevant evidence in detail in order to be able to pass a judicial judgement. In view of the sheer volume of damaged items, this proves to be extremely time-consuming and inefficient in practice, making the use of AI an obvious choice.

The damage reports can be uploaded to the AI platform internally, i.e. without any data protection concerns. Questions can be asked of the AI with regard to the uploaded documents, i.e. the damage reports. In principle, AI is able to scan all files and present the information in a collated form.

Not all the information contained in the documents can always be filtered out. For example, each document lists the damaged items with ID numbers. However, if AI is asked, for example, for the total sum of all items listed in the damage reports with the ID number, the AI can only filter out this information for a small number of items, even though the information is actually contained in every document. Incidentally, in addition to the list of damaged items with their ID numbers, each document also contains the total number of items recorded in the damage report.

Certain AI tools reach their limits when it comes to image analysis. The damage reports contain all images that visually document the damage to the individual items. However, according to AI, the images are only available as graphics embedded in PDF files. As a text extractor, AI can only recognize text modules and not image content in such a “mixed” PDF file consisting of text and images. AI can only analyze the damage or categorize it based on a separate table which lists all damaged items again with an additional description of the type of damage.

Review by a lawyer is still essential

In view of the increasing relevance of AI for legal practice, the German Federal Bar Association (“BRAK”) published a corresponding AI guide with information on the use of artificial intelligence. In these guidelines, the BRAK emphasizes the need for lawyers themselves to carefully review the results generated by AI in order to avoid errors and the resulting liability consequences.

The German Federal Lawyers’ Act (“BRAO”) standardizes the obligation of a German Rechtsanwalt to exercise their profession conscientiously. Particularly relevant here is the principle of highly personal service provision, which states that a lawyer must perform its work independently and, in case of doubt, personally. Consequently, the use of AI systems may not replace the work of a lawyer, but may only support it. It is undisputed that independent review and final control of the AI results by the lawyer is necessary.

Standards of care and confidentiality

The specific duties of care increase in their requirements when dealing with AI with the degree of automation and the intended use. For example, a higher standard of care applies if AI tools are used not only to support internal workflows but also in relation to clients (e.g. in automated communication with clients, auto-responders, use of chatbots for client intake, etc.).

Implications for the courts

With the increasing use of AI in legal practice, the question arises for the courts as to the extent to which judges can trust an AI mechanism in their evaluations.

In recent years, various automated programs have already been tested and used in numerous German courts, primarily to provide support and relief in mass proceedings. Examples include the OberLandesGerichts-Assistent (“OLGA”), the Massenverfahrens-Assistenz durch Künstliche Intelligenz (“MAKI”) and Codefy.

In view of the difficulties that arise when assessing the admissibility of AI tools, it seems sensible from the perspective of legal certainty for the legislator to include specific provisions on permissible areas of application in the Code of Civil Procedure, taking into account fundamental procedural rights.

It seems convincing to apply the principles of expert evidence (“Sachverständigengutachten”). The judge must be able to understand how the AI mechanism works (in order to rely on its results without reviewing the documents themselves). The main problem is that both the functioning and the results of the relevant systems are not comprehensible to users. The computer works like a “black box” that is fed with data and ultimately produces a result without it being possible to see what happens in between. If its process cannot be comprehensively understood from the outside (“black box AI”), but its use is nevertheless necessary, the expert’s duties are limited to the design, control and comprehensible presentation of the process and its prerequisites and consequences, so that the court can fulfil its task of evaluating and classifying the expert opinion and, in this respect, assess the evidence. Conversely, the use of AI below this threshold is generally permissible, but may then require disclosure and transparency.

It should also be in line with general quality standards to check the results obtained with the help of AI systems for their accuracy or at least plausibility. Here, too, no universally applicable standards have yet been developed. But insofar as it is part of good scientific practice to explain how results are obtained and thus make them comprehensible, this should also apply to the use of AI – or even more so, given the risk of “hallucination” in large language models.

Conclusion

Despite the existing challenges, AI offers considerable potential for processing tasks more quickly and effectively in the context of legal practice. Nevertheless, further developments are still needed, and professionals are always obliged to review and critically question the results produced by AI. In view of recent developments, it is to be expected that the initial problems with AI mentioned above will be resolved in the future and that risks will be further minimized as developments in the field of AI progress.

On 16 March 2026, France’s National Agency for the Safety of Medicines and Health Products (“ANSM”) launched a pilot fast-track procedure for the authorisation of clinical trials on medicinal products for human use (”MPHU”) that are carried out in France.

 

As highlighted by the ANSM, against a backdrop of fierce international competition in clinical research on MPHU, the speed of authorisation and the start of clinical trials for MPHU is a major strategic challenge. Therefore, the fast-track initiative’s aim is to attract more of such projects to France with the goal of offering patients earlier access to innovative therapies.

 

Since 31 January 2022, the EU Clinical Trials regulation (regulation 536/2014 of 16 April 2014 on clinical trials on medicinal products for human use) has governed the conduct of clinical trials on MPHU. In terms of administrative handling, all authorisation applications must be submitted via the Clinical Trial Information System (“CTIS”) portal, which centralises all applications to competent authorities within the European Union.

 

However, in substance, authorisation of a clinical trial remains subject to a dual assessment. In France, the ANSM assesses the scientific, methodological and regulatory aspects of the trial protocol, whilst an ethics committee (or comité de protection des personnes) examines its ethical basis.

 

Only if both assessments are positive can administrative authorisation to conduct the trial be granted.

 

In terms of shortening processing times, the ANSM states that the pilot fast-track procedure will offer academic and industrial sponsors an accelerated pathway for approval of clinical trials conducted in France and falling under the EU Clinical Trials regulation – or those combining trials involving MPHU and in vitro diagnostic medical devices –  which meet at least one of the following criteria:

• • The trail concerns a serious, rare or debilitating disease for which no appropriate treatment is currently available;
  • It is the first trial in a therapeutic class with a completely new mechanism of action; and/or
  • It involves the inclusion of adolescents in a clinical trial centred on adults.

 

In terms of the CTIS application procedure, the fast-track initiative will involve the ANSM verifying the trial’s eligibility prior to submission via the CTIS portal, with the ANSM undertaking to provide a response within 48 hours.

 

Once the clinical trial application has been submitted via the CTIS portal, the ANSM has indicated that, where the sponsor’s application raises no issues following the ANSM’s and the ethics committee’s assessments, the authorisation timeframe under the fast-track initiative will be capped at 14 days.

 

This promises to cut in half the 31-days assessment timeframe set out under the EU Clinical Trials regulation.

 

Where the clinical trial application raises issues following the ANSM’s and the ethics committee’s assessments, the fast-track authorisation timeframe will be extended to a maximum of 49 days, in comparison to 106 days under the EU Clinical Trials regulation.

 

Finally, as concerns advanced therapy medicinal products (“ATMP”), an additional assessment period of up to 50 days applies under the current procedure. While the ANSM initially indicated that no extended evaluation period would apply to ATMP, its Advice to Applicants, also released this month, mentions a maximum timeframe of 62 days.

 

The ANSM’s pilot will be closely monitored by pharmaceutical companies who have long highlighted the long delays in obtaining clinical trial authorisation.

 

To give but one example, Leem, the association for pharmaceutical companies operating in France, has recently cited the drastic difference in wait times for new treatments to reach patients in France compared to other EU countries with the result that “Procedures are taking longer, innovations are on hold, and so are patients”.[1]

 

The French initiative has launched in advance of the European Heads of Medicines Agencies FAST-EU (Facilitating and Accelerating Strategic Clinical Trials) pilot programme, which promises to offer an accelerated assessment of multinational clinical trial applications in advance of the arrival of the new Eu regulation of so-called EU Biotech Act.

 

The FAST-EU sponsor’s guide published on 21 January 2026 states that FAST-EU aims for an overall duration of 70 calendar days from CTIS submission to conclusion of the clinical trial application, including sponsor response times.

 

Sponsors have been able to express their interest in taking part in FAST-EU since 30 January 2026, although no launch date has been announced.

 

 

 

[1] Make France a European leader in healthcare innovation, 17 November 2025 (La France à l’Heure des choix – Accélérons l’accès au progrès thérapeutique ! | Leem).

1. Abstract

On 23 February 2026, Law n°2026-122 on the confidentiality of consultations written by in-house lawyers was enacted, amending the 31 December 1971 Law reforming certain judicial and legal professions. Two days later, it was published in the “Journal Officiel”[i]. It will come into force no later than twelve months after its promulgation, under the terms of a decree whose content is not yet known.

The delay between promulgation and the law’s entry into force does not prevent France from becoming – at last – the ninth EU Member State to adopt a mechanism for protecting in-house lawyers’ advice.

Has this legislative saga reached its final chapter?

While some observers consider this delay to be very long, it is in line with the legislative process that led to the law, which took no less than a decade and numerous heated debates to be finalised.

This delay is all the longer given that – in the absence of the implementing decree, which may be issued within a maximum period of one year from 23 February 2026 – to date, consultations with in-house lawyers are not confidential… since the law has not yet entered into force!

This law represents the outcome of a lengthy and rather chaotic legislative process, marked by numerous unsuccessful attempts and recurring criticism of its constitutionality.

In 2023, the French Constitutional Council was required to rule on the constitutionality of a former bill. The same scenario occurred in 2026: on 18 February 2026, the French Constitutional Council was asked to rule on the last bill and declared it to be in accordance with the French Constitution.

Even though the brand-new Law of 23 February 2026 stipulates a significant number of rigorous conditions and has a limited scope of application, it has, nevertheless, attracted severe criticism from certain legal professionals and some independent authorities.

At a time when the implementing decree is now being drafted (or about to be), this law continues to be subject to debates and criticisms. While the precise contours of the confidentiality of in-house lawyers’ opinions remain to be determined by the future decree, it is nevertheless possible, as of today, to comment on the principles laid down by the recent law.

A French-style regime

The confidentiality regimes for in-house lawyers’ legal advice within the EU are not uniform. Also, the French regime differs substantially from those in place in the UK and the US.

These disparities are likely associated with the goals pursued by the protection, which differs from a country to another. In France, this law aims not only to enable the development of compliance law, where lawyers are increasingly exposed to these issues within the companies’ world, but also to protect French economic sovereignty in light of the growth of international competition[ii].

 

 

 

2. Context: the genesis of the law and its main goals

The umpteenth legislative iteration…

The 23 February 2026 Law constitutes the latest in a series of measures designed to establish a framework within France that ensures the protection of in-house lawyers’ professional advice.

In pursuit of the stated goal of strengthening France’s economic attractiveness, the French Senate has previously ruled on this issue on two previous occasions, adopting similar measures:

• During the review of the Ministry of Justice’s 2023-2027 policy and planning law proposal, the French Constitutional Council raised concerns about the confidentiality provisions. They stated that these provisions were inappropriate and should be reconsidered, as they were labelled as ‘legislative riders’.
• The second time was with the law proposal aimed at guaranteeing the confidentiality of legal consultations by in-house lawyers. This law proposal was widely adopted by the French Senate in 2024 and is now once again under consideration following amendments introduced by the French National Assembly.

… pursuing two goals….

In 2026, the objectives of those advocating for the confidentiality of in-house lawyers’ legal advice were as follows:

• To facilitate the growth of compliance law by ensuring legal professionals are trained to recognise and address the increasing prevalence of these issues within the corporate sector.
• It is vital that France strengthen its economic position, protect its economic sovereignty and adapt to international competition, as it lags behind a number of other European Union Member States (Germany, Belgium, Spain, Greece, Hungary, Ireland, the Netherlands and Portugal).

… allowing users to join an exclusive group…

Following the entry into force of the French law, the principle of confidentiality is to be enshrined in nine Member States representing 40% of the Union’s overall population.

… but fuelling much criticism…

While the reform has been met with enthusiasm by some, it has also faced significant criticism from legal professionals and several independent authorities.

Legal professionals, particularly lawyers (both barristers and solicitors), have highlighted a perceived disparity in terms of equality between their own status and that of in-house lawyers. The proposed confidentiality regime was viewed as unbalanced, but this argument was rejected by the French Constitutional Council.

Furthermore, opponents of confidentiality for in-house lawyers consider it to be an inappropriate protection at a time when the protection of correspondence between lawyers and their clients has been reduced to a mere shadow of its former self following decisions by the Criminal Chamber of the Court of Cassation. The latter only grants legal privilege to correspondence covered by professional secrecy in defence and counsel and relating to the ‘exercise of the rights of defence’.[iii]

Concerns have also been raised by some independent authorities (Autorité de la concurrence, Autorité de contrôle prudentiel et de résolution and Autorité des marchés financiers) regarding the confidentiality of their procedures and investigations.

The concerns raised have been addressed, with specific provisions of the law being subjected to scrutiny and multiple amendments already proposed to address these concerns.

 

3. A confidentiality subject to restrictive, numerous and blurred conditions

The law of 23 February 2026 sets out five cumulative conditions for advice provided by in-house lawyers to be confidential:

• The author must be an ‘in-house lawyer’ as defined by law, or a member of the said lawyer’s team under his/her supervision:
  • The ‘in-house lawyer’ must hold a master’s degree in law or ‘an equivalent French qualification’[iv], or meet the additional conditions set out in the article following the new article 58-1 of the law n°71-1130 of the 31^st December 1971.
  • The attentive observer will have noticed that the meaning of ‘equivalent French qualification’ is rather unclear.

 

• It is essential that they provide proof of training in ethical rules. No further details are given at this time, but a decree will provide further clarification.

 

• The advice must be a ‘legal consultation’ as defined by law. This means that it must be the result of a personalised intellectual service involving the provision of an opinion or advice based on the application of a rule of law. Should we assume that AI is being targeted?

 

• It is imperative that the legal advice explicitly states the terms “confidentiel – consultation juridique – juriste d’entreprise” (sic)[v] and is granted a classification of the highest priority in the company’s files (two conditions in one).

 

• Only legal advice intended for management, administrative or supervisory bodies may be considered confidential. This means that advice not addressed to the latter are not covered.

On the one hand, there are numerous conditions, and on the other hand, the abstract nature of certain terms maintains ambiguity, especially when they are subject to interpretation by courts.

 

4. The (numerous) limits to confidentiality: exceptions and mitigating factors

The confidentiality afforded by law to the opinions of in-house lawyers is not absolute…

There are two situations in which the law excludes confidentiality as a matter of principle:

• It is excluded ‘in the context of criminal or tax proceedings’.

 

• confidentiality is unenforceable in the event of an investigation initiated by the European Union authorities: legal advice provided by in-house lawyers on antitrust are unlikely to be confidential.

Therefore, the only consultations that are covered by confidentiality and cannot be seized or disclosed are those that are seized ‘in the context of civil, commercial or administrative proceedings or litigation’.

However, this protection is not absolute.

… and confidentiality may be lifted by the judge

It is imperative to understand that fulfilling all the aforementioned criteria does not inherently ensure confidentiality. The competent courts may lift confidentiality in accordance with a procedure specified by law.

In cases where the seizure of a consultation is deemed necessary, it will be carried out by a judicial officer. The seizure may be challenged:

• Before the liberty and custody judge in the context of a search and seizure operation.
• Before the president of the court that ordered the investigative measure in the context of a civil or commercial dispute.

 

5. A brief overview of the confidentiality of legal opinions issued by in-house lawyers around the world

Regimes protecting in-house lawyers’ communications are now emerging around the world. However, this serves as a reminder that significant disparities exist, and that European Union law only protects communications between lawyers and their clients.

It is the position of both the European Commission and the European Court of Justice that the protection should be limited in scope to communications exclusively between lawyers and their clients.

In its Akzo Nobel[vi] judgment, supplemented by the Ordre des avocats du Barreau du Luxembourg judgment, the ECJ stated that only consultations with external lawyers in the context of defence or advisory activities are protected by professional secrecy[vii].

In its Competition Policy Brief entitled Legal professional privilege in competition law investigations: has the status of in-house lawyers changed?[viii]  The European Commission concurred with the Court’s position on the matter, considering it unnecessary to extend confidentiality to the opinions of in-house lawyers.

Protections therefore vary greatly from one country to another.

Currently, nine Member States have implemented measures to protect legal advice with in-house lawyers. However, the level of protection varies between Member States. For example[ix]:

• In Belgium, the confidentiality of advice given by in-house lawyers to their employers in the course of their legal advisory activities is well-established[x].

 

• In Germany, a distinction is made between civil and criminal cases: while in-house lawyers may refuse to testify or provide documents in accordance with the confidentiality of their communications, in criminal cases, they do not enjoy the same protection as external lawyers and must accept the seizure of documents exchanged with their employers.

 

 

• In Greece and Ireland, legal opinions provided by solicitors and in-house lawyers enjoy the same level of protection.

 

• In Portugal, in-house lawyers are subject to the same professional privilege regulations as external lawyers, except for communications pertaining to ongoing criminal investigations.

 

• In Spain, according to Spanish law and case law, protection is generally extended to in-house lawyers[xi]. Besides, in-house and external lawyers enjoy the same general principles of freedom and independence, which tends to undermine the distinction between the two[xii]. However, the Spanish Competition authority does not extend any protection to communications made by in-house lawyers during its inspections.

Although the content of confidentiality may vary, each Member State has the same limitation as French law imposes with regard to investigations by European Union authorities.

Such differences can present challenges, given that the position of the Union differs from that of the Member States. Consequently, the uniformity of legal rules is not guaranteed in this area.

Other EU countries, such as Italy and Austria, have yet to address this principle.

In England and Wales, communications between in-house solicitors and employees are protected, regardless of their content, whether they relate to litigation or legal advice.

In the United States, the communication of legal advice by in-house solicitors to company employees is protected.

In both cases, it can be said that legal privilege in these two countries is much broader than in the European Union.

 

6. ­An appropriate text? Towards amendments prior to its implementation…

This law has not been universally endorsed in France, and there are already calls for amendments, including one that would render confidentiality unenforceable against the three French independent authorities which strongly fought the bill and are now strongly opposed to the law (Autorité de la concurrence, Autorité de contrôle prudentiel et de résolution and Autorité des marchés financiers).

The law has been enacted and published in the Official Journal, but further details are pending… pending the implementing decree, which is expected within a maximum of twelve months.

 

 

 

 

 

[i] Légifrance – Publications officielles – Journal officiel – JORF n° 0048 du 25/02/2026

[ii] Report of the French Senat n°260, January 2026

[iii] Cour de Cassation, Criminal Chamber, 13 January 2026, nbr. 24-82.390

[iv] Art. 2  « Les personnes qui sont titulaires d’une maîtrise en droit, les étudiants qui ont validé la première année d’une formation de deuxième cycle conduisant au diplôme national de master en droit ou les détenteurs de l’un des titres ou diplômes reconnus comme équivalents par arrêté conjoint du ministre de la justice et du ministre chargé des universités qui justifient, à la date d’entrée en vigueur de la présente loi, d’au moins huit ans de pratique professionnelle au sein du service juridique d’une ou de plusieurs entreprises ou administrations publiques sont considérés, pour l’application de l’article 58-1 de la loi n° 71-1130 du 31 décembre 1971 portant réforme de certaines professions judiciaires et juridiques, comme titulaires d’un master en droit »

[v] ‘Confidential – Legal advice – In-house lawyer’

[vi] ECJ, 14 September 2010, C-550/07, Akzo Nobel Chemicals Ltd.

[vii] ECJ, 26 September 2024, C-432-23, Ordre des avocats du Barreau de Luxembourg

[viii] Policy Brief

[ix] As was pointed out during parliamentary debates in France

[x] Article 5 of the law of the 1^er of March 2000 establishing the ‘Institut des juristes d’entreprise’

[xi] Administrative Court nº8 of Madrid Ruling num. 24/2015

[xii] Article 39 of the General Regulation of the Legal Profession (Estatuto General de la Abogacía)

The European Union has taken an important step towards a circular economy with the adoption of Regulation (EU) 2025/40 on packaging and packaging waste (“PPWR”). This legislation, which repeals the long-standing Directive 94/62/CE, establishes a harmonized legal framework aimed at introducing new obligations that will reshape how packaging is designed, used, and managed across its entire lifecycle.

By moving from a Directive to a Regulation, the EU ensures that the new rules are directly applicable across all Member States, eliminating the legislative fragmentation that previously hindered the internal market and the achievement of environmental targets. The first measures provided for in the PPWR will be mandatory from August 2026.

The Core Pillars of PPWR

PPWR is built on several key pillars designed to prevent waste, promote circularity, and enhance the sustainability of packaging materials.

1. Waste Prevention and Reduction: At its core, PPWR introduces binding targets for the progressive reduction of packaging waste generated per capita in each Member State. In this regard, a significant measure is the restriction on placing certain formats of single-use packaging on the market, effective from January 1, 2030. This includes, among others, single-use plastic packaging for fresh fruits and vegetables, packaging for food and beverages consumed in restaurants, and miniature packaging for toiletries commonly found in hotels.
2. Promotion of Reuse and Refill: The legislation sets specific targets for reusable packaging in various sectors, trying to move away from a single-use culture. For instance, the takeaway food and beverage industry will be required to ensure that a growing percentage of their sales are provided in reusable packaging, with targets set at 10% by 2030 and increasing to 40% by 2040.
3. Boosting Recyclability and Recycled Content: To ensure that packaging waste is a valuable resource, PPWR mandates that all packaging placed on the EU market must be recyclable by 2030, according to specific design-for-recycling criteria. Furthermore, it establishes mandatory minimum targets for recycled content in new plastic packaging. For example, single-use plastic beverage bottles must contain at least 30% recycled content by 2030; such a figure rises to 65% by 2040. These measures are designed to drive demand for secondary raw materials, improve the quality of recycling processes, and reduce the EU’s reliance on virgin resources.
4. Extended Producer Responsibility (EPR) and Data Transparency: PPWR strengthens the principle of Extended Producer Responsibility (EPR), requiring producers to bear the financial and operational costs of collecting, recycling, and managing packaging waste. Each company must register with a national or transnational waste management system and provide detailed data on the volume of packaging placed on the market, its composition, and how it is ultimately disposed of. This data must be reported to competent authorities and, where requested, made available to consumers.

Focus: New Obligations on Labelling, Marking, and Information

A central component of the new regulatory framework is the overhaul of information requirements for packaging. The goal is to provide clarity for consumers, efficiency for waste operators, and transparency throughout the supply chain. The previous system, based on national interpretations and the now-repealed Commission Decision 97/129/CE, is being replaced by a more stringent approach.

• Harmonized Labelling for Waste Sorting: PPWR mandates the creation of a harmonized label to clearly indicate the material composition of packaging and provide instructions for its correct disposal. The European Commission is tasked with developing the specifications for this label, which will be uniform across the EU. This will help consumers to correctly sort packaging waste, thereby increasing the quantity and quality of materials sent for recycling and reducing contamination in waste streams.
• Digital Information and the Product Passport: To avoid the risk of overwhelming consumers with too many physical labels, PPWR encourages the use of digital tools. Information can be provided through a data carrier, such as a QR code, affixed to the packaging. This data carrier can link to a website or, more significantly, to a Digital Product Passport. This concept allows for a vast amount of information to be stored and accessed digitally. This includes details on material composition, reusability features, recycled content, and the presence of any substances of concern.
• Marking of Substances of Concern: To enhance safety and promote high-quality recycling, PPWR introduces an obligation to provide information on the presence of “substances of concern” in packaging materials. This information should be accessible via digital means, to ensure that waste managers can identify and handle these substances appropriately, thereby facilitating cleaner material cycles and protecting human health and the environment.

Outlook for Economic Operators

PPWR marks a key transition for all economic operators involved in the packaging value chain, from material manufacturers and producers to importers, distributors, and retailers. Compliance will require a proactive and strategic approach. Companies must review their packaging portfolios to assess their conformity with the new requirements for recyclability, reuse, and recycled content.

Furthermore, the new information and labelling obligations necessitate an update of data management systems to track and disclose the required information, particularly through digital channels.

Companies that will embrace these changes early will not only ensure compliance, but also gain a competitive advantage in a market that increasingly values sustainability.

Legal advisors will play a key role in helping clients understand the obligations, ensure compliance, and assess the risks associated with the transition to a more circular economy.

With the adoption of Regulation (EU) 2024/1689, known as the AI Act, the European Union has established for the first time a systematic and binding framework for artificial intelligence, becoming a pioneer in the regulation of a technology which is bound to profoundly affect the economy, fundamental rights and essential services. One of the sectors most affected by the new regulatory framework is Health, which has been included among “high risk” segments.

The AI Act has adopted a risk-based approach, scaling obligations based on the potential impact of artificial intelligence systems on different sectors. AI healthcare applications fall within the category of high-risk systems, as they directly affect the diagnosis, treatment, clinical decisions on and, ultimately, the life and physical integrity of patients.

 

 

This category includes, first of all, the AI-based safety components integrated into medical devices, such as, for instance, those used in robot-assisted surgery. But there’s more: high-risk AI systems are also systems meant for use by, or on behalf of, public authorities to assess the eligibility of private individuals to essential public services, including healthcare services, as well as to grant, reduce, revoke or recover such services. Finally, this category includes AI systems used to assess and classify emergency calls, to send first aid or determine priorities – including with regard to the police and fire brigade – as well as patient selection systems in emergency healthcare.

The Regulation provides for a number of strict obligations to be fulfilled by high-risk systems before being placed in the market or put into service. These include in particular:

• The adoption of risk management and mitigation systems, to prevent harmful effects on health;
• The use of high-quality representative and unbiased data sets, to reduce the risk of discriminatory or clinically unreliable results;
• The traceability of transactions, to enable ex-post checks and audits;
• Detailed technical documentation, to enable the competent authorities to assess the compliance of AI systems;
• Transparency obligations vis-à-vis users (e.g., healthcare facilities and operators);
• Adequate human oversight measures, to prevent blind reliance on automated decisions;
• High robustness, accuracy and cybersecurity standards.

In a scenario where digital medicine and the use of artificial intelligence are bound to grow rapidly, the AI Act constitutes a crucial stepping stone toward more efficient, responsible and transparent healthcare, compliant with EU values.

An initial set of general rules, contained in Chapters 1 and 2, entered into force on 2 February 2025. Particularly important is the obligation for suppliers and deployers of AI systems to take measures ensuring an adequate level of AI literacy of the personnel involved in the operation and use of the systems, taking into account technical skills, experience and work context, as well as the persons they are expected to affect. Moreover, the Regulation introduced a list of prohibited AI practices which are considered incompatible with fundamental rights. These include, for instance, systems using subliminal or manipulative techniques, systems exploiting the vulnerabilities of specific groups of persons, social scoring mechanisms, risk assessments of the likelihood that a person may commit a criminal offence solely based on profiling and some forms of massive facial recognition and emotion recognition in the work and school environment, with some limited medical or security exceptions.

Subsequently, the core rules of the AI Act entered into force on 2 August 2025, introducing, among others, the classification of AI models relevant for the purposes of high-risk systems and specific obligations for suppliers, who shall be required to report to the European Commission as well as to prepare and keep up to date detailed technical documentation on the AI model, including training, testing and assessment processes, to be made available to the European AI Office and the national competent authorities on request. In addition, the following bodies have been created: an AI Office, to develop the Union’s know-how and skills, and the European Artificial Intelligence Board, with an advisory and support role for the Commission and Member States, facilitating a consistent application of the AI Act, including through the coordination of national authorities, the sharing of good practices and the contribution to the harmonization of administrative practices.

Furthermore, by 2 August 2026, Member States will have to establish an AI regulatory sandbox at the national level.

Instead, the obligation for high-risk AI systems to undergo a third-party conformity assessment as a condition for their being placed on the market and put into service, will apply from 2 August 2027.

In any event, the European Commission can decide to update the list laid down in Annex III and the list of prohibited AI practices once a year throughout the delegation of power period, which at present ends on 1 August 2029 but which could be tacitly extended for additional five-year periods.

Is your company sufficiently protected if a customer from Germany is no longer able to pay for the goods delivered or services provided? For companies, this question often arises only in the context of an imminent threat of payment default by their customers. Often underestimated is the significant risk that payments already received can be reclaimed by the insolvency administrator in the event of the subsequent insolvency of the German business partner– even across borders.

Overall, the economic situation indicates that the number of corporate insolvencies in Germany will remain on a high level in 2026. This development does not only affect the German market. Since German companies are frequently involved in international supply and service relationships, insolvencies are most likely to directly affect their foreign business partners.

As insolvency figures are rising, the law of insolvency contestation is becoming increasingly important, also at an international level. Insolvency administrators are systematically reviewing payments and other transactions made in the months and years prior to the filing for insolvency and are increasingly asserting insolvency contestation claims against creditors, including those based abroad. The consequences are significant repayment claims and legal disputes before German courts.

Supplier credits (exchange of goods and services for payment terms of more than 30 days), which are frequently used in practice, are also particularly risky. What serves to maintain a long-standing business relationship from a sales perspective can prove to be a significant disadvantage under insolvency law.

Legal background: The purpose of insolvency contestation law is to reverse disadvantages to all creditors that arose as a result of certain transactions by a debtor prior to the opening of insolvency proceedings. The relevant provisions can be found in Sections 129 et seq. of the German Insolvency Code. As a general rule, payments made within 30 days in exchange for an equivalent consideration can only be contested in very limited cases. Otherwise, however, the following applies: The shorter the period between payment receipt by the creditor and the debtor’s filing for insolvency proceedings, and the stronger the indications that the customer was already insolvent (in the legal sense) at the time of payment, the higher the repayment risk. Companies in financial distressed situations often decide in the short-term to satisfy certain creditors, especially certain suppliers to maintain supply chains. However, for the payment recipients it can be challenging to ascertain whether their German business partner is in a legally relevant financial crisis, especially for those based abroad. Therefore, it is all the more important to establish clear internal processes, train sales and receivables management teams and conduct early legal assessment of payment and suspicious indications. This applies also to international supply and service relationships.

Eventually, German insolvency contestation law is always applicable when insolvency proceedings are opened against the assets of a company based in Germany. Within Europe, Regulation (EU) 2015/848 of the European Parliament and of the Council of 20 May 2015, on insolvency proceedings, generally regulates the applicability of insolvency law provisions at the company’s registered office, while also determining which transactions are void, contestable or relatively ineffective because they disadvantage the body of creditors. Furthermore, the courts of the Member State within the territory of which insolvency proceedings have been opened, shall have jurisdiction for any action which derives directly from the insolvency proceedings. This explicitly includes insolvency contestation actions. Consequently, foreign companies may face repayment claims that can be asserted in German courts.

Therefore, all companies with German business relationships are well advised to regularly and critically review their payment terms including the actual payments of their German customers with regard to insolvency contestation risks. Early preventive advice is just as crucial as a coordinated procedural defense strategy in the event of a contestation case. It is precisely in these cases that the benefit of an international law firm network such as unyer becomes apparent.

Secretary General Mark Rutte’s statement at the press conference following the conclusion of the NATO summit in June 2025 was clear: It is time to ‘roll up our sleeves to put this new plan into action.’ Prior to this, NATO member states had agreed in their final declaration to invest five per cent of gross domestic product (GDP) in defence and security annually from 2035 at the latest.

Since then, the European security and defence industry has been undergoing a period of upheaval and reorientation unlike anything seen in recent decades. For many companies, the resulting increase in procurement requirements and funding may make it economically attractive to use production resources as part of a transformation process to supply companies in the security and defence industry. One example that has received particular attention in the press is that of companies and suppliers in the automotive industry.

Companies that decide to take this step are often unfamiliar with the specifics of the security and defence industry and find themselves in a completely changed economic and legal environment. The transformation of production processes is often lengthy and involves considerable costs. Due to the complex challenges involved, it is essential to provide technical, business and legal support for such a transformation process within the company from the outset.

Building new production capacity

Neither the manufacturers’ production facilities nor the suppliers along the supply chain are seriously prepared for the situation. Enormous upheavals are imminent, as evidenced, for example, by the growth of companies such as Helsing, which has developed from a start-up to a major market player and has recently invested hundreds of millions of pounds in production facilities in the United Kingdom alone.

This example shows that building new production facilities can bind a significant amount of capital. Anyone who wants to increase their production capacity must deal with the financing of the expansion and new construction of their production facilities. Consequently, manufacturing companies also have a considerable interest in securing their investments economically, for example by concluding long-term supply contracts.

Legislative activities

The framework conditions within the security and defence industry are more heavily regulated by law than in many other sectors. Changes in legal requirements can therefore have a significant impact on the business model of manufacturing companies and their suppliers. For example, the deployment of employees in certain areas may require these employees to undergo a security check in accordance with the German Security Check Act (German: Sicherheitsüberprüfungsgesetz, SÜG). This can make it difficult to deploy employees flexibly. In the case of new hires, a lengthy security check procedure can mean that companies only find out whether they are allowed to deploy their new employees in a position that requires security clearance after the employee’s probationary period has expired. In addition, there are a number of licence requirements for the production, transport and export of defence goods. A double licence requirement applies to exports, as licences are required under both the War Weapons Control Act (German: Kriegswaffenkontrollgesetz) and the Foreign Trade Act (German: Außenwirtschaftsgesetz).

It is therefore essential to be aware of legislative activity in this area and to make the necessary adjustments to contracts and procedures. In fact, there are signs that the regulatory framework for the security and defence industry could undergo fundamental changes in the near future. Well-known associations such as the Federal Association of the German Security and Defence Industry are calling for adjustments to the legal situation in order to simplify and accelerate the expansion and reconstruction of production facilities. In June 2025, the Federal Government presented a draft bill with the same objective.

Recently, in June 2025, the Federal Association of the German Security and Defence Industry (German: Bundesverband der Deutschen Sicherheits- und Verteidigungsindustrie) proposed a comprehensive package of legislative measures. These measures primarily concern public procurement law. The association proposes expanding the circle of potential bidders in procurement procedures. At present, participating in procurement procedures is particularly difficult for start-ups. The association proposes that the legislator should counteract this by lowering or abolishing the turnover and liquidity requirements of procurement law for security and defence-related projects. Outside of procurement, approval procedures for the export of defence goods in particular should be simplified. Specifically, the association proposes introducing a single complementary permit for exports instead of the double licence requirement. In addition, the legislator should create the possibility of obtaining approval for the export of defence goods at the same time as approval for manufacture. Furthermore, security checks should be accelerated and the information obligations of the authorities involved should be laid down in law for the benefit of companies.

The association also calls for the increased use of so-called standby contracts (German: Vorhalteverträge). These are a special type of contract in which the supplier’s performance does not consist solely of the delivery of the ordered goods. Instead, the purchaser pays the supplier in advance to keep the goods to be delivered on call. This allows the public sector to maintain the security of supply for the armed forces in a flexible manner without this being at the expense of the contracted company.

It remains to be seen whether and to what extent these demands will be implemented. With regard to the procurement procedure, the Federal Government presented a draft bill for a new Bundeswehr Planning and Procurement Acceleration Act (German: Bundeswehrplanungs- und beschaffungsbeschleunigungsgesetz (BwPBBG)) on 1 October 2025, which is intended to simplify and accelerate the award of defence-related contracts (available here: DIP – Act on Accelerated Planning and Procurement for the Bundeswehr). For example, the scope of application for accelerated direct awards is to be expanded on the basis of essential security interests. In addition, the draft provides for the possibility of advance payments by the public sector in order to facilitate investment and expand the pool of potential bidders. Start-ups and companies with lower liquidity are expected to benefit from this.

Current developments in financing

The European Investment Bank (EIB) has also already responded by significantly increasing the financing framework for investments in ‘Europe’s strategic and technological independence’ for 2026 to €100 billion. Of this, €4.5 billion is earmarked for investments in security and defence (EIB Group renews record-high financing target of €100 billion to boost Europe’s strategic and technological independence). It has also expanded the catalogue of eligible projects in the security and defence industry. Ultimately, this is also an important signal for small and medium-sized enterprises, whose lenders often refinance with the EIB. Overall, the EIB has made it much easier for companies in the security and defence industry to access finance. The eligible projects cover a wide range of areas. They now also include military-related infrastructure projects, research and development projects, for example in drone technology, projects in cyber security and even in space travel. In addition to the procurement of military helicopters by Italy, the EIB has therefore also co-financed, for example, the development of satellites in Poland and Spain, cyber security programms in France and investments in military infrastructure in the Baltic States.

Due to these and other EU-wide facilitations in the financing of security and defence projects, it is strongly recommended that participating companies review their financing options.

Change of use of production facilities in the automotive industry

Furthermore, the increase in European security and defence spending comes at a time of unprecedented structural change in the automotive industry. Due to the increasing market share of electric vehicles and intense international competition, several European car manufacturers are considering significantly reducing their production capacities by closing production sites. The transformation of the security and defence industry may therefore represent an opportunity for affected companies in individual cases to use existing production resources for the manufacture of other goods and products in the future. Some car manufacturers are already involved in the security and defence industry, often through subsidiaries and joint ventures. However, due to the current market situation, some suppliers and service providers to the automotive industry are also attempting to diversify their offerings more and acquire new orders in the security and defence industry.

However, such a transformation of the use of production facilities towards the production of security and defence goods is associated with considerable practical and legal challenges. From an organisational point of view, it is generally advisable to spin off the production and distribution of goods for the security and defence industry into a separate business unit, which raises corporate law issues such as the choice of the appropriate legal form for the business unit. Legal and technical measures may also be necessary with regard to production. For technical reasons, existing production facilities are often only suitable for the production of security and defence goods after extensive conversion. One particular legal challenge lies in the implementation of regulatory requirements for the security and defence industry, for example in the execution of the necessary approval procedures or the requirements of the Security Screening Act already outlined for certain employees. In addition, it can be assumed that companies will have to completely restructure their supply chains. One such special feature, for example, are quality management plans, which some public clients require and which contractors therefore often contractually oblige their suppliers to conduct as well. These issues require comprehensive contract management to terminate old supply contracts and conclude new ones.

Download Full Article

In international trade, bank securities are essential. Due to the stagnant economic growth in many European countries, many businesses are in distress. As a consequence, trade agreements are not fulfilled and disputes over provided bank securities arise. Knowing what to look out for in such a dispute is crucial. In the following, we compare the legal framework of Germany, France, Italy, and Austria focusing on actionable strategies depending on the type of security and the parties’ role.

The German Perspective of the Guarantee Beneficiary, Guarantee Debtor, and Issuing Bank

Alongside documentary collections and bank sureties, bank guarantees in their various forms are a wellestablished instrument to secure payment and performance obligations, particularly in crossborder trade. In Germany, the bank guarantee “on first demand” is the instrument of choice, as it promises quick liquidity. Unlike accessory security instruments, the bank granting a bank guarantee “on first demand” does not review the underlying claim before disbursement; it will only refuse payment in cases of manifest abuse.

Companies in the role of guarantee beneficiaries are, however, well advised not to call upon a first demand Disputes over Bank Securities – Recommendable Action in a European Comparison guarantee without first reviewing both the contractual prerequisites of the guarantee agreement and those of the underlying principal contract. This approach helps avoid costly and timeconsuming follow-up proceedings brought by the guarantee debtor for recovery. In this context, even seemingly minor provisions on the applicable law and international jurisdiction should be carefully reviewed. Parties are often caught off guard by these aspects, for instance, when the beneficiary seeks payment but finds itself confronted with an “unfavorable” legal system at a strategically disadvantageous forum that interprets the concept of abuse of rights in an overly broad manner.

If the beneficiary concludes that the guarantee case has occurred, it should act swiftly and without prior notice to the guarantee debtor by demanding payment of the guarantee amount from the bank. Otherwise, the guarantee debtor could prepare a motion for preliminary injunction.

For the guarantee debtor, seeking preliminary injunction before German courts against either the bank or the contractual partner can be advisable to prevent payment of the guaranteed sum. This may be appropriate where the debtor’s own solvency is at risk or where the counterparty is feared to face a liquidity shortfall during a lengthy recovery process. Whether a preliminary injunction is likely to succeed depends on the contractual provisions of the guarantee agreement between the bank and the beneficiary and on the applicable law governing that relationship. The guarantee agreement may contain detailed provisions permitting refusal of payment, such as the requirement of an (arbitral) award against the beneficiary. If, however, the guarantee agreement contains no such provisions, payment under a first demand guarantee can usually be prevented only in cases of abuse of rights, which must be proven with “readily available” evidence. Such abuse might be established, for instance, where the beneficiary and the bank had agreed on the return of the guarantee at a specified date, yet the beneficiary invokes the guarantee after that date. Acting in time is always of the essence, as the guarantee bank will usually arrange for the guaranteed sum to be paid within a few days only.

If the bank has already disbursed the guaranteed sum, the guarantee debtor could challenge the debit to its account where the payment was unauthorized under the terms of the guarantee agreement or in cases of abuse. Moreover, the bank could be liable for damages if it failed to promptly notify the debtor of the claim, thereby depriving the debtor of the opportunity to prevent payment.

From the perspective of the guaranteeing bank, a call on the guarantee presents a dilemma: on the one hand, the bank must fulfill its obligation under the guarantee towards the beneficiary. On the other hand, it must also safeguard its contractual relationship with the debtor and avoid making payments without proper justification, as it would otherwise not be able to lawfully debit its customer’s account with the recourse amount. In addition to reviewing the key contractual documents and the parties’ correspondence, it will be advisable for the bank to a llow a reasonable period to pass before disbursement – particularly to determine whether a preliminary court order prohibiting enforcement of the guarantee is issued. From an economic standpoint, too, restraint often carries less risk, since the beneficiary’s potential loss typically consists of the costs of substitute financing (such as loan interest), whereas an unjustified payment could result in a loss of the entire guarantee amount, if recovery later proves
impossible.

A Look at France

The bank securities common in Germany also exist under French law. The common instrument for securement of international trade in France is the “garantie autonome”, which closely resembles the German guarantee “on first demand”. Like its German counterpart, the “garantie autonome” is independent of the underlying principal contract and aims to provide swift liquidity. The “garantie autonome” arises through a unilateral declaration by the guarantor. Care must be taken to distinguish it clearly from a bank surety (“cautionnement”), otherwise the security is at risk of re-qualification.

Calls under a “garantie autonome” must comply with any formal requirements set out in the guarantee declaration as well as with guarantee conditions agreed in the principal contract. Beyond that, also under French law, payment may only be refused in cases of manifest abuse. According to the French court practice, this is the case, for instance, where the beneficiary itself has failed to
perform under the principal contract.

Just as in Germany, French law allows the guarantee debtor to file an emergency application for a preliminary injunction before the référé judge to prevent an abusive call. This mechanism is powerful, as it can significantly delay enforcement of the guarantee, particularly in cases involving substantial amounts or technical disputes, even though court decisions are typically rendered swiftly.

From the beneficiary’s perspective, the French system is designed to make guarantees rapidly enforceable, with a clear emphasis on the autonomy of the instrument. In practice, however, the process often requires carefully balancing the interests of the debtor and the bank, and swift payment is not always assured.

From the bank’s perspective, while the legal obligation to pay is clear, yet in practice banks act with caution to avoid liability for a wrongful call. They typically notify the debtor upon receiving a demand and may hold off payment briefly to allow the debtor to act, which adds another layer of timing and strategy to the overall process.

Additionally, in case of dispute, it should be noted that French courts have, in some cases, applied French law to disputes over guarantees by reference to French law governing the principal contract, even if the guarantee agreement is expressly governed by another law.

A Look at Italy

Under Italian law, the “garanzia autonoma” or “garanzia a prima richiesta” is widely used, particularly in public procurement and trade agreements. Like its German and French counterparts, it is non-accessory and thus defences arising from the principal contract cannot prevent payout. Like in France, precise drafting is essential to avoid re-qualification as a surety, increasing exposure to defences under the principal contract.

Before payout, Italian banks will only examine two narrowly defined exceptions (exceptio doli): bad faith and abuse. As a result, the guarantee debtor is left with little scope for intervention at an early stage. Unlike in Germany and France, preventive relief through preliminary injunctions is rare and subject to strict requirements and very high evidentiary burden of proof.

Additionally, Italian courts tend to emphasize the purpose of the “garanzia autonoma” as an immediate liquidity instrument, and thus preventive judicial control of guarantee payments is seldom granted. Consequently, legal protection for the debtor is largely reactive, relying on subsequent claims for restitution or damages after payment has been made. Correspondingly, the autonomous guarantee provides a highly effective and immediate legal safeguard against the risk of non-performance for the guarantee beneficiary. The bank’s obligation to pay “on first demand” ensures trust and liquidity without the delays of litigation or proof of breach. Yet this autonomy has limits: the beneficiary must act in good faith and refrain from abusive enforcement, as fraudulent or opportunistic calls may trigger the exceptio doli and give rise to liability for damages.

The guaranteeing bank is bound to pay upon first demand, provided the formal requirements are met. While this ensures efficiency in commercial relations, it also exposes the bank to payment risks, especially if the debtor has not fulfilled its obligations. The bank’s protection is then limited to cases of exceptio doli.

A Look at Austria

In Austria, bank sureties play a minor role, primarily due to a 1% government “stamp fee” on the secured amount payable by the guarantee debtor. Not least for this reason, the guarantee “on first demand” is the preferred security in Austrian trade agreements and construction projects. Like the above counterparts, the Austrian version is nonaccessory. In addition, Austria recognizes the so-called “simple guarantee” (“einfache Garantie”), which, while generally abstract, requires the beneficiary to prove the occurrence of the secured event before payment. As it is not payable upon first demand, the “simple guarantee” also plays a minor role.

A typical dispute over a guarantee “on first demand” in Austria arises when a construction contractor commissions its bank to issue a guarantee in favor of the client to secure performance. The bank undertakes to pay the client – the beneficiary – upon first written request, without further examination. If the client later demands payment, alleging a defect or delay, the bank must pay swiftly, regardless of whether an actual defect or delay exists. The contractor, as the guarantee debtor, cannot object directly to the bank’s payment but must instead pursue legal action against the client. This illustrates the “pay now, sue later” principle central to Austrian law on first demand guarantees.

In disputes over securities, the available remedies and strategic considerations mirror those under German law. The debtor may seek a preliminary injunction to block payment. For the bank, it remains a matter of debate under Austrian law whether it must notify the guarantee debtor prior to payout to allow for a preliminary injunction. In practice, however, banks typically request a comment from the guarantee debtor before executing payment as part of their contractual duties of diligence and good faith.

Recommended Action in Case of Dispute

The comparison shows that the abstract guarantee “on first demand” and its counterparts are the security instruments of choice across the compared jurisdictions. The parties’ available remedies and strategic considerations in the event of a dispute are likewise largely similar.

For the guarantee beneficiary, the key advice is consistent: do not call on the guarantee without carefully reviewing not only the guarantee agreement but also the substantive requirements under the principal contract to avoid costly recovery proceedings. In this context, provisions on applicable law and international jurisdiction should also be carefully reviewed to avoid unwelcome surprises. Once the guarantee event has occurred, the beneficiary should act swiftly, and demand payment of the guarantee sum from the bank before the guarantee debtor can prepare for a preliminary injunction.

For guarantee debtors, preliminary injunction before state courts can be an effective means of preventing payment – with the caveat that Italy offers only limited preventive relief. In assessing their position, debtors should closely review the scope of the guarantee, the obligations covered, any time limits, and the conditions for returning the security. Where a call is made at a time when the beneficiary is already obliged to return the guarantee, the debtor may successfully invoke abuse of rights. In practice, they should be aware there usually is only a short time window to prevent payout – making swift action essential.

From the perspective of the issuing bank, beyond a thorough review of the key documents, it may be advisable to wait before disbursing the guaranteed amount to allow for the possibility that an interim court order may intervene in the meantime.

The Member States of the European Union have a vast and diverse heritage of local food and drink products.

The European Union, with its 27 Member States, is the world’s leading exporter of agri-food products.

 

French champagne, Italian Parma ham, Spanish Manchego cheese and Greek Kalamata olives are just a few of the products that have earned European agri-food production an international reputation.

The European Union currently has around 4,000 registered geographical indications.

European Union law provides a fairly high level of protection in the event of infringement of geographical indications (PGI) and designations of origin (PDO) relating to agricultural products and beverages.

In terms of French law, Article L431-1 of the Consumer Code defines the concept of “PDO” as follows: “A designation of origin is the name of a country, region or locality used to designate a product originating there, the quality or characteristics of which are due to the geographical environment, including natural and human factors.”

 

The legal strategy for launching and operating a trademark in the food and beverage sector within the European Union must, in addition to the issue of the availability of the brand name among common signs such as trademarks, trade names and prior domain names (…), also take into account PDOs and PGIs protected at national level by each Member State and by the European Union.

• What precautions should be taken when launching and operating a new food or beverage trademark in order to avoid infringing existing PDOs and PGIs?

The relationship between trademarks and PDOs/PGIs is complex in many respects, but fortunately it is well-regulated by law.

In terms of European Union law, Regulation (EU) 2024/1143 of the European Parliament and of the Council of 11 April 2024 on geographical indications for wine, spirit drinks and agricultural products, as well as on traditional specialities guaranteed and optional quality terms for agricultural products, organises the coexistence between these types of signs:

Article 26 thus provides for the various possible infringements of these protected geographical indications, namely:

a) Any direct or indirect commercial use of a geographical indication in relation to products not covered by the registration, where such products are comparable to those registered under that name or where the use of that geographical indication for any product or service allows the reputation of the protected name to be exploited, weakened, diluted or damaged, including where such products are used as ingredients;

b) Any misuse, imitation or evocation, even if the true origin of the products or services is indicated or if the protected name is translated, transcribed, transliterated or accompanied by an expression such as “genre”, “type”, “method”, “way”, “imitation”, ‘flavour’, ‘manner’ or similar expression, including when these products are used as ingredients;

c) Any other false or misleading indication as to the provenance, origin, nature or essential qualities of the product appearing on the packaging or wrapping, in advertising, in documents or in information provided on online interfaces relating to the product concerned, as well as the use of packaging likely to create a false impression as to the origin of the product;

d) Any other practice likely to mislead the consumer as to the true origin of the product.

 

In practice, these provisions should be complied with from the stage of choosing the name and before any trademark application is filed.

In fact, in the event of an application for registration before a national or European Union trademark office, any trademark application for registration that contravenes the provisions of the aforementioned Article 26 will be rejected.

There is a wealth of case law on this subject.

For example, the European Union Intellectual Property Office (EUIPO), in relation to a PDO for wine, through its Board of Appeal, issued a decision on 30 May 2024 confirming the cancellation of the trademark “PriSecco” for non-alcoholic cocktails, due to the similarity between the signs (PROSECCO / PRISECCO) and the similar nature of the products designated.

The General Court of the European Union recently provided valuable clarification on the concepts of “direct or indirect commercial use” and the concept of “evocation” of PDOs and PGIs by the trademark.

In 2025, the Court, in a case involving the trademark “QUEVEDO PORT” with the PDO “PORT“, usefully clarified that the concept of “direct or indirect commercial use” of the EU trademark presupposes, in principle, the reproduction of the PDO in an identical or nearly identical form, for comparable or non-comparable products

Thus, the fact that the trademark associates the PDO with another word does not automatically give rise to a situation of use when the trademark forms a logical unit of its own that prevents the establishment of a link with the PDO.

The concept of ‘evocation’ covers situations in which the sign used to designate a product incorporates part of a protected geographical indication or PDO, so that the consumer, when presented with the name of the product in question, is led to think of the goods covered by that indication or designation as a reference image (Regulation (EU) 2024/1143, Art. 26(1)(b) – Regulation (EU) 2023/2411, Art. 40(1)(b)).

Thus, there may be an evocation of a PDO where, in the case of products of similar appearance, or even services (CJEU, 9 Sept. 2021, case C-783/19, ‘Champanillo’, para. 52), there is a phonetic, visual or even conceptual similarity between the PDO and the contested sign, including its graphic elements.

In the “Bolgaré” case, the visual and phonetic similarity to “Bolgheri”, combined with a similarity between the products, creates an objective situation of evocation of the earlier PDO (EU Court of Justice, 23 March 2023, case T-300/22, “Bolgaré v Bolgheri”, paras. 35 to 40).

The use as a trademark of a single element of a designation of origin is sufficient to constitute an infringement, in that it evokes the complete designation of origin and misleads the consumer as to the origin of the products covered by it.

In France, this infringement is punished under Article L431-2 of the Consumer Code, which specifies in its 4° that it is prohibited, in particular, to affix or display, by addition, deletion or any alteration whatsoever, on products, whether natural or manufactured, offered for sale or intended to be offered for sale, a designation of origin or a geographical indication defined in Article L. 721-2 of the Intellectual Property Code, knowing it to be inaccurate; or, in paragraph 5, to lead or attempt to lead others to believe that a product benefits from a designation of origin or a geographical indication defined in the same Article L. 721-2.

This infringement is also punishable under Article L721-8 of the Intellectual Property Code, which provides that any direct or indirect commercial use of a registered name in relation to products not covered by the registration, where those products are comparable to those registered under that name or where such use allows the reputation of the protected name to be exploited;

4° Any other practice likely to mislead the consumer as to the true origin of the product.

The provisions on unfair commercial practices and misleading commercial practices may also apply.

A commercial practice is misleading if it is committed in any of the following circumstances:

1° When it creates confusion with another product or service, trademark, trade name or other distinctive sign of a competitor;

2° When it is based on false or misleading allegations, indications or presentations relating to one or more of the following elements:

b) The essential characteristics of the goods or services, namely: their substantial qualities, composition, accessories, origin, particularly with regard to the rules justifying the use of the terms “made in France” or “origin France” or any equivalent term, sign or symbol, within the meaning of the Union Customs Code on the non-preferential origin of products, their quantity, method and date of manufacture, the conditions of its use and its suitability for use, its properties and the expected results of its use, in particular its environmental impact, as well as the results and main characteristics of the tests and checks carried out on the goods or services

It is therefore essential to assess whether the registration as a trademark and the use of the new or currently used trademark will constitute direct or indirect commercial use, misappropriation, imitation or evocation of an existing PDO or PGI.

It is important to remember that the protection granted to PDOs and PGIs also applies to trademarks imported into the European Union, in particular:

a) goods entering the customs territory of the Union without being released for free circulation;

b) goods sold through distance selling methods, such as e-commerce; and

c) goods intended for export to third countries.

 

• The specific case of the use of a protected trademark which has been filed/registered prior to an existing PDO or PGI:

This situation is much less common in practice but does exist and deserves to be addressed.

At the European level, Article 31(3) of Regulation (EU) 2024/1143 of the European Parliament and of the Council of 11 April 2024 on geographical indications for wine, spirit drinks and agricultural products, as well as traditional specialities guaranteed and optional quality terms for agricultural products, regulates this coexistence between the use of a trademark and an earlier geographical indication:

3. A trademark whose use is contrary to Article 26 but which has been applied for, registered or established by use in good faith in the territory of the Union, where this possibility is provided for by the relevant legislation, before the date of submission of the application for registration of the geographical indication to the Commission, may continue to be used and renewed notwithstanding the registration of a geographical indication, provided that there are no grounds for invalidity or revocation of the trademark under Directive (EU) 2015/2436 or Regulation (EU) 2017/1001. In this case, the use of the geographical indication, once registered, and that of the trademark concerned is authorised.

In this scenario, the trademark owner will be forced to adopt a very strict and regulated strategy for protecting (trademark registration) and exploiting their trademark.

The registered trademark will be subject to refusal or cancellation if its use constitutes direct or indirect commercial use of a registered name in relation to products not covered by the registration, when these products are comparable to those registered under that name or when such use allows the reputation of the protected name to be exploited, including when these products are used as ingredients.

 

In conclusion, it is therefore essential for any company wishing to launch and/or exploit its food or beverage brand within the European Union to anticipate, even before its commercial launch or before importing into the European Union market, by systematically including a preliminary in-depth study of existing PDOs and PGIs in its protection strategy, in order to detect any potential legal risks.

1. Abstract

Over the years, French and European case law confirmed that the presence of “black clauses” (restrictions deemed anti-competitive, such as price fixing or prohibition of passive sales) in a selective distribution agreement does not automatically render the agreement or the distribution network unlawful:

• The courts require a concrete analysis of the effects of these clauses on competition
• A clause may be severable or interpreted restrictively, allowing the rest of the network to remain valid
• The rulings of the French Cour de cassation (g. 2016, 2018, 2022) and the Paris Court of Appeal (e.g. 2019, 2023) illustrate this pragmatic approach: even if certain contractual clauses are classified as hardcore restrictions, this does not rule out the possibility that the selective distribution network complies with competition rules, subject to an in-depth analysis of the practices implemented and their impact on the market: there mere presence does not necessarily mean a violation of Article 101(1) TFEU or Article L.420-1 French Commercial Code
• The lawfulness of a selective distribution network must be assessed on a case-by-case basis.

 

2. Context: Selective distribution and Competition law

Selective distribution systems are allowed under EU and French Competition law as long as they are justified by the nature of the product and based on qualitative criteria that are applied uniformly and without discrimination (Article 101 (1) and (3) TFUE; Article L.420-1 French Commercial Code)[i].

Such systems are common for luxury, high-tech, or safety-critical products, where the manufacturer has a legitimate interest in preserving the brand image or ensuring proper use and maintenance.

 

3. “Black clauses”

“Black clauses” are restrictions that are presumed to be “hardcore” or anticompetitive, such as:

• Resale Price Maintenance or “RPM” (imposing fixed or minimum resale prices to the reseller)
• Absolute territorial protection (preventing cross-border or passive sales)
• Prohibition on online sales (without objective justification)

These are listed in Article 4 (c) of Commission Regulation (EU) 2022/720 of 10 May 2022 (“VBER”).

For the French Autorité de la concurrence, the main restrictive clauses are as follows:

• Price fixing clauses[ii]
• Prohibition of cross-deliveries[iii]
• Prohibition of parallel imports and passive sales[iv]
• Prohibition of internet sales[v]
• Restriction of promotions and sales[vi]
• Prohibition of distributing competing brands[vii]

 

4. French jurisprudence: “black clauses” in a selective distribution agreement do not induce automatic illegality of the network

French Courts and the French Autorité de la concurrence have consistently held that:

• The mere presence of a black clause does not render the entire network illegal per se
• The effect and purpose of the clause must be examined in context – whether it truly restricts competition by object or by effect.

A clause may be severable or interpreted restrictively, allowing the rest of the distribution system to remain valid.

In various rulings, the French Cour de cassation addressed the question of whether the presence of clauses restricting online sales in a selective distribution agreement invalidates the latter.

For the Commercial Chamber, the fact that a selective distribution agreement does not benefit from a block exemption does not mean that it is contrary to the Treaty on the Functioning of the European Union (Article 101 (1) TFEU).

In one symptomatic affair, the dispute concerned the broadcasting by France Télévisions of a programme promoting a website which offered products from a selective distribution network without having received its approval. Coty France, the company at the head of this network of luxury cosmetics and perfumery products of various brands, sued France Télévisions and the website’s publisher, the US company Marvale, for damages[viii].

As is often the case in this type of litigation, France Télévisions and Marvale argued that the selective distribution network was unlawful. The Paris Court of Appeal ruled in their favour, finding that three clauses of the selective distribution agreement contravened Article 101(1) TFEU. In fact, the Paris Court of Appeal concluded that ‘the existence of these “black clauses” in the selective distribution agreement ruled out any legality of the network’.

In a second affair, an unauthorised reseller, Brandalley, was accused of marketing products sold within the same Coty network on the internet. In its defence, Brandalley also contested the legality of the selective distribution network, based on the same grounds. The Paris Court of Appeal also ruled in favour of the reseller and concluded that the network was unlawful[ix].

On the same day, the French Cour de cassation overturned both rulings on the simple grounds that ‘the fact that the agreement does not benefit from a block exemption does not necessarily imply that the selective distribution network contravenes the provisions of Article 101(1) TFEU’.

Simply put, the presence of unlawful clauses in a selective distribution agreement does not necessarily imply that the network contravenes Article 101(1) TFEU[x].

The Paris Court of Appeal and the French Cour de cassation reiterated their position on several occasions:

• In 2019, the lawfulness of a selective distribution network must be assessed on a case-by-case basis, depending on the actual effects of the clauses on competition. The mere presence of ‘black clauses’ is not sufficient to conclude that the network is unlawful[xi]
• In 2022, the Court de cassation reiterates that the selection of distributors on the basis of qualitative criteria is lawful, provided that it is applied in a uniform and proportionate manner. The presence of restrictive clauses is not sufficient to invalidate the network; a real anti-competitive effect must be demonstrated[xii]

 

5. Practical consequence

Under French law:

• A selective distribution system containing a “black clause” is not automatically void
• Authorities and courts conduct a case-by-case analysis
• If the problematic clause can be isolated, the network as a whole may remain lawful, with the clause simply being deemed unenforceable

 

#distribution #distributionlaw #network #selectivedistribution #blackclause #competition

_____________

[i] Cass. Com., 16 February 2022, no. 20-11.754 (selective distribution – refusal to approve distributor: the Court held that the head of a selective distribution network may refuse to approve a reseller who fulfils the objective selection criteria – provided the criteria are applied uniformly and non‐discriminatorily).

[ii] French Autorité de la concurrence Decision 24-D-11 of 19 December 2024 on practices implemented in the manufacture and distribution of household appliances – French Autorité de la concurrence, Bureau van Dijk Group / Ellisphere, Press release, 13 April 2023

[iii] Comments of the French Autorité de la concurrence on Note by Advisory Committee regarding case AT. 39816 (Gazprom), 2 May 2018, §36 (“Les engagements comportementaux”, Paris 2019)

[iv] French Autorité de la concurrence, Decision No. 21-D-30 of 28 December 2021 on practices implemented in the brown goods distribution sector

[v] French Autorité de la concurrence, Decision no. 23-D-13 of 19 December 2023 (Rolex) – French Autorité de la concurrence, Decision no. 24-D-02 of 6 February 2024 (franchise network, online sales restriction)

[vi] French Autorité de la concurrence, Decision No. 21-D-30 of 28 December 2021 on practices implemented in the brown goods distribution sector

[vii] French Conseil de la concurrence (former name of French Autorité de la concurrence), Decision No. 03-D-42 of 18 August 2003 concerning practices implemented by Suzuki and others in the motorcycle distribution market

[viii] Cass. com., 16 May 2018, n° 16-18.174, P+B

[ix] Cass. com., 16 May 2018, nº 16-20.040, D

[x] Cass. com., 16 May 2018, n° 16-18.174, P+B – Cass. com., 16 May 2018, No. 16-20.040, D

[xi] Paris Court of Appeal, 30 August 2019, No. 18/20739 and 18 October 2023, No. 23/01291

[xii] Cass. com., 16 February 2022, No. 20-11.754

IT security: a multidimensional challenge

IT security is no longer limited to technical considerations. It now requires a comprehensive approach that integrates technical, organizational, managerial, and legal skills. This cross-functional nature requires close cooperation between different departments within the company to define clear objectives, measure risks, and implement corrective and/or preventive actions.

Despite growing awareness of digital risks, not all organizations are sufficiently committed to a proactive approach. However, cyberattacks can have financial and reputational consequences that are far more onerous than the investments required for prevention. In this context, security is becoming a strategic investment, which is reinforced by changes in the legal framework: we are moving from a right to security to an obligation to secure ourselves.

 

A constantly evolving legal framework

Organizations must navigate a complex legal environment, comprising international conventions, European texts (such as the GDPR or the NIS2 directive), national laws, regulations, and standards issued by authorities such as the CNIL or the ANSSI. It is essential to build a legal compliance framework and keep it up to date through multidisciplinary monitoring, often provided by lawyers.

 

Legal tools for cybersecurity

1. Preventive measures

1.1 Contractual security clauses

IT contracts must include specific security clauses defining responsibilities, obligations (of means or results), technical standards (ISO 27001, SecNumCloud, OWASP, etc.), incident management procedures, audit rights, and continuity plans (BCP/DRP). These clauses are key to ensuring the resilience of the information system and avoiding disputes.

 

1.2 Cybersecurity contracts

When the contract directly concerns security services (pentests, audits, SOC, etc.), the level of legal requirements must be high. The contract should detail the technical scope, objectives, methods, time commitments, and limits of liability. It is a strategic tool that must be co-developed by the company’s CIO/CISO and its General Counsel.

 

1.3 Internal charters and policies

IT charters and IS security policies (ISSPs) are internal documents that govern behavior, define rules of use, security obligations, penalties, and traceability procedures. They must be approved by management, distributed, updated regularly, and included in contracts with service providers.

Internal procedures (access management, incident management, encryption, etc.) ensure operational security. User training (via e-learning, awareness campaigns, etc.) is also crucial, as humans are often the weak link. Ninety percent of security incidents involve company employees.

 

The concept of state of the art

Contracts often refer to the state of the art, which mean the best practices and knowledge available at a given time. This reference framework consists of standards, scientific publications, and professional guides, and may be further clarified by experts or judges in the event of a dispute. By default, the obligation to comply with the state of the art applies in IT contracts. This reference framework must be specified in detail on a case-by-case basis.

 

2. Remedial measures: crisis management

The establishment of a cybersecurity crisis unit is essential to respond effectively to incidents. It must be multidisciplinary, including the CISO, CIO, technical teams, management, lawyers, communicators, HR, and the cyber insurer.

Key elements to consider:

• Crisis room (physical or virtual)
• Backup communication channels
• Runbooks (procedures according to incident type)
• Access to detection tools and backups
• Crisis management plan (CMP) with scenarios, alert procedures, decision chain, remediation

It is essential to conduct crisis exercises to test coordination and improve procedures. After each incident, a post-mortem analysis makes it possible to capitalize on the experience and adjust the systems.

Lastly, preserving evidence is crucial. It is recommended not to shut down equipment after an attack, but to disconnect it from the Internet to preserve volatile data. IT experts and judicial officers who are ready to intervene quickly must be identified in advance, with pre-established letters of engagement.

 

Conclusion

IT security has become a real investment (and no longer just an operating expense) because it is a strategic, legal, and organizational issue. It is based on an integrated approach, combining prevention, contractualization, internal governance, crisis management, and regulatory compliance. The legal tools, when used properly, serve to structure this approach, protect the company, and strengthen the confidence of its business partners.

 

What is the EU Data Act?

The EU Data Act establishes harmonised rules regarding the fair access to and use of data across digital markets.

Its overarching goal is to Promote competition, innovation and the free flow of data within the EU – with particular attention to data generated by connected (IoT) products and related services. It also introduces obligations for cloud service providers to enable users to switch to other providers easily, quickly and free of charge.

EU Member States must designate competent authorities responsible for supervising and enforcing the Data Act, including determining fines and penalties for non-compliance. Currently, only some Member States have yet to finalise their implementing measures.

 

Is your company affected?

The EU Data Act is applicable to any entity offering such products or services on the EU market, regardless of where it is established:
• Manufacturers and sellers of connected (IoT) products placed on the EU market,
• Providers of related services linked to such products,
• Providers of data processing services, including SaaS, IaaS and PaaS,
• Data holders, including non-EU entities, making data available to EU récipients,
• Public sector bodies and EU authorities that request data in the public interest.

 

What are the main obligations?

For manufacturers and/or sellers of connected products and related services:
• Pre-contractual transparency: Provide users with clear and upfront information on the type of data the product or related service generates.
• Data access: Ensure users can obtain all data generated by their products securely, free of charge and in a user-friendly format.
• Third-party sharing: Upon the user’s request, data must be made available to third parties under fair, reasonable, non-discriminatory and transparent (FRAND) terms.

For providers of data processing and cloud services:
• Facilitate switching: Remove technical and contractual barriers to enable customers to transfer data to alternative providers easily and securely.
• Contractual requirements: Contracts must specify clear provisions on data portability, exit strategies, contract termination, data retrieval and deletion and any switching fees.
• No switching fees: Providers may no longer charge customers for switching to another service provider.

On 11 September 2025, the Court of Justice of the European Union (CJEU) rendered its judgment in case C-115/24 (UJ v Österreichische Zahnärztekammer). The ruling is of major importance for cross-border healthcare in the EU, especially where telemedicine (remote care via information and communication technology (ICT)) is combined with in-person treatment. For practitioners advising on tele-health models, professional-regulation and cross-border service provision, the decision marks a turning point.

1. The Case in Brief

In the underlying Austrian proceedings, an Austrian dentist (UJ) worked with German-based entities which offered dental aligner treatment to Austrian patients: initial in-person consultations and scans in Austria were followed by the remote provision of dental aligner treatment via German online/ICT tools. The Austrian Dental Chamber challenged the arrangement on the basis of Austrian regulatory rules for dentists. The Austrian Supreme Court referred questions to the CJEU concerning, inter alia, the meaning of “healthcare in the case of telemedicine” under Directive 2011/24/EU and whether a country-of-origin principle applies in respect of telemedicine services.

The CJEU held that:

• The concept of telemedicine applies only when a health service is provided entirely through ICT, without the patient’s physical presence before the healthcare provider.
• Services that are hybrid (partly in-person, partly digital) do not fall within the Directive’s framework on cross-border healthcare.
• The Directive, while primarily designed to ensure cost reimbursement for patients treated in another Member State, also governs broader aspects of cross-border health service provision, including quality, safety and information requirements.

2. Legal Implications

For practitioners, the implications are multi-layered:

• Regulatory scope – Only fully remote treatments qualify under the Directive and can invoke the country-of-origin principle, meaning partial telemedicine models remain subject to national healthcare laws.
• Freedom to provide services – Digital-health providers cannot automatically invoke the free movement of services where treatment is partly delivered domestically.
• Professional qualifications and licensing – Hybrid or cross-border models may still trigger compliance duties under national professional rules.
• Liability and patient protection – When healthcare is split between jurisdictions, responsibility for informed consent, data security, and standard of care must be contractually allocated.

3. Practical Consequences for Contract Design

The decision underscores the need for robust contractual and compliance frameworks in cross-border digital healthcare:

• Service contracts must specify the nature of the service (fully remote vs. hybrid) and identify which jurisdiction’s rules apply.
• Professional liability clauses should allocate risk clearly where multiple providers or jurisdictions are involved.
• Data-protection obligations must reflect GDPR standards for international data transfer and patient confidentiality.
• Disclosure and patient-information duties remain critical — even in purely digital contexts.

In Austria and other Member States, telemedicine is subject to specific medical-practice and licensing rules; thus, providers must verify national authorisations before offering remote consultations to foreign patients.

Conclusion

For digital-health entrepreneurs, telemedicine providers and legal advisors, the message is clear: EU law rewards clarity of structure, transparency, and compliance discipline. Those who adapt their contractual and operational models accordingly will have legal certainty which laws will apply to their services within both EU and national regulatory frameworks.

In recent years, there has been a growing phenomenon that consumers receive less of a product for the same price – a practice known as “shrinkflation”.
Shrinkflation is defined as a business practice whereby contents of a product are reduced while the package and price remain unchanged. This practice effectively  results in a hidden increase in the unit price of the product.

Recently, the first Austrian court ruling on the admissibility of shrinkflation under unfair competition law has been issued. The Vienna Higher Regional Court (OLG Wien 24.06.2025, 4 R 197/24f) upheld the previous decision of the Vienna Commercial Court (Handelsgericht Wien) against a frozen food distributor for misleading commercial practices under § 2 of the Austrian Unfair Competition Act (UWG). An appeal to the Supreme Court (OGH) was permitted, but not filed by the defendant, so that the decision is final.

Until the beginning of 2023, the producer sold its product “Atlantic Salmon” with a net content of 250 grams per package. In February 2023, the net weight was reduced to 220 grams while the price and package size remained the same. The only modification of the packaging was the indication of the new (instead of the previous) weight.

The Austrian Association for Consumer Information (VKI) considered this to be a hidden price increase which was not sufficiently transparent to consumers, and filed a suit (Verbandsklage) in order to force the producer to refrain from such practices in future. The Court upheld VKI’s claim that this was a deceiving of the consumers regarding the price (§ 2 para 1 no 4 UWG) and regarding the essential features of the product (§ 2 para 1 no 2 UWG) and also a misleading commercial practice according to § 2 para 4 UWG. The claim was also not yet time-barred (verjährt), as the unfair practice was continued.

According to the Court, the reduction in the net weight of the product was not noticeable to the average consumer because not only the packaging size remained the same, but also the information on the packaging and the price remained unchanged. The average consumer expects that a product offered in the same packaging, with the same information and the same price, contains the same amount of the product. Even the correctly indicated unit price cannot prevent the deceptive effect on consumers, as it is intended for comparing prices between different products, but not for comparing the current price of a product with its previous price.

A similar phenomenon, named deceptive packaging (Mogelpackung, i.e. prepackaged goods whose external appearance is misleading as to the number, size, volume, or weight of the goods actually contained therein) has already been addressed in decisions of the Austrian Supreme Court (OGH 29.01.2019, 4 Ob 150/18i) and – recently – the German Supreme Court (BGH 29.05.2024, I ZR 43/23). The common denominator of both concepts is that the mere indication of the net weight is in both cases not enough to prevent deceiving the consumer.

In response to the recent court decision, the Austrian government also intends to adopt legislation to address shrinkflation practices. The need for clear legal provisions concerning deceptive packaging which, in line with German law, clearly defines the ratio of filling quantity to air content has also been emphasized. An amendment to the Price Marking Act is expected to help ensure the visibility and legibility of the unit price. In the future producers may therefore be required to indicate changes in filling quantities on the front of product packaging. Similar legislation is already in force in other jurisdictions, e.g. France, where larger food retailers are required to inform consumers about such changes.

In addition, allegedly high food prices (also compared to neighbouring countries) and controversial discount campaigns have come into public focus. In September 2025, 270 inspections were carried out in Vienna by the Market Authority, resulting in almost 200 complaints.

To sum it up, food producers and distributors in particular have to bear in mind that courts and public authorities are increasingly sensitive as far as price transparency is concerned, and should therefore carefully check their current price labeling strategies and, if necessary, amend them accordingly.

In 2023, the European Commission warned that “The COVID-19 pandemic and the Russian military aggression against Ukraine [have] exposed Europe’s supply chains dependencies and the risk that economic dependency could be weaponised. This has also heightened awareness of the risk of medicine shortfalls, experienced across all Member States and involving both original and generic medicines.”

 

On 17 September 2025, the European Court of Auditors released its special report on critical shortages of medicines which observed that:

“Faced with shortages, member states started to impose unilateral national stockpiling requirements for industry, not coordinated with other member states. While stockpiles in a given member state can help minimise shortages and provide authorities with time to act, such stock may have spill-over effects and exacerbate shortages in other member states.”

In that regard, the European Commission’s proposal for a regulation addressing the supply of critical medicinal products, called the Critical Medicines Act (or “CMA”), presented on 11 March 2025 sets out in article 20 that:

“Measures on security of supply applied in one Member State shall not result in any negative impact in other Member States. Member States shall, in particular, avoid such an impact when proposing and defining the scope and timing of any form of requirements for companies to hold contingency stocks.

Member States shall ensure that any requirements they impose on companies in the supply chain to hold contingency stocks are proportionate and respect the principles of transparency and solidarity.”

 

Overall, however, the Court of Auditors report points out that the Commission’s proposed legislative response aimed at tackling the underlying causes of medicine shortages remain at an early stage (the Commission’s proposal for the authorisation and supervision of medicinal products for human use, released on 26 April 2023, does not directly address the issue of contingency stocks).

Among the European countries that currently impose contingency stock requirements on industry actors, France recently hardened its national regime by increasing applicable fines and introducing new reporting obligations for pharmacists and for so-called pharmaceutical establishments.

 

The French Code of Public Health has, since 2019, provided for administrative fines in case of failure by companies marketing a medicinal product:

• to keep a safety stock of medicines of major therapeutic interest (“MITMs”) covering at least two months’ demand for the domestic market (the ANSM may decide to increase the duration to four months’ supply where a medicine has regularly been at risk of stock shortages, or has been out of stock, in the previous two calendar years); and
• to alert the French National Agency for Medicines and Health Products (“ANSM”) as soon as they become aware of any risk of MITM stock shortages.

 

In March 2025, the Code of Public Health was amended in particular to increase the administrative fine applicable to such non-compliance to 50% (increased from 30%) of the previous financial year’s turnover for the product or group of products concerned, up to a limit of five million euros (increased from one million euros), and to increase the daily penalty that the ANSM may apply in case of late compliance up to a cap of 50% (increased from 30%) of the daily turnover for the product. In addition, the code now provides that the ANSM will publish its decisions to apply such fines on its website for at least one year.

Moreover, a new amendment provides for a national database on the availability of MITMs which is aimed at better anticipating and dealing with shortages or risks of shortages in the supply of medicines and promoting exchanges between actors in the supply chain.

Under the Code of Public Health, medicinal products may only be manufactured, imported and sold by authorised pharmaceutical establishments. Following the recent legislative amendments, those pharmaceutical establishments must keep up to date the national MITM database under threat of the administrative fines set out above.

The legal obligation to keep up to date the national MITM database also applies to pharmacists, with fines of up to 150 000 euros for a natural person and up to 10% of turnover for the last financial year, up to a limit of one million euros, for a legal person – in additional to a penalty of up to 2500 euros per day that the ANSM may apply in case of late compliance.

The French industry association representing generic medicines manufacturers, the GEMME, has strongly criticized the amendments warning that “Faced with the scale of the financial penalties or the risk of being penalised, manufacturers will be forced to withdraw from the market, leading to shortages and the discontinuation of treatments that are nevertheless of major therapeutic interest.”

In that regard, in the absence of a central European database, the European Court of Auditors’ report recommends that the European Medicines Agency should operate a single medicines database and reporting platform that includes all medicines authorised in the EU, their marketing status and information on their availability.

While waiting for a European system to take shape, France appears determined to go it alone in its regulatory approach.

It remains to be seen, however, to what extent France’s policies in particular regarding stockpiling requirements and associated fines may conflict with emerging EU laws, in particular that CMA’s prohibition on measures that result in any negative impact in other Member States.

[1] Communication from the Commission addressing medicine shortages in the EU, 24 October 2023.

 

Around two thousands of claims were raised before the Italian Administrative Court of Rome against the Ministerial and Regional Decrees which, implementing the Legislative Decree 2015, No. 78, Article 9-ter, required the supplier of medical devices many years after – at the end of 2022 – to pay an amount corresponding to the percentage incidence of their sales to the Regional Healthcare Service (Servizio Sanitario Regionale), in order to contribute to the coverage of the regional governments’ public expenditure on medical devices in excess of a certain limit (as identified by Ministerial Decree 6 July 2022) for FYs 2015, 2016, 2017 and 2018.

The total amount due is about two billion euros, a prohibitive sum for pharmaceutical companies.

The Administrative Court issued temporary decisions in each pending claim which suspended all the deeds challenged, and requested to the Constitutional Court to verify the compliance of these regulations with constitutional principles of reasonableness, proportionality and transparency.

The decision No. 140/2024 of the Constitutional Court stated that the payback contribution would be ‘reasonable’, as it is aimed at guaranteeing the protection of the public healthcare system and the rationalization of its costs, and ‘proportionate’ also taking into account that, in the meantime, the Government decided to reduce the contribution for all suppliers of medical devices to an amount equal to 48% of the payments requested by the Regions.

This outcome led the Administrative Court, in May 2025, to issue its first final judgment, expected to be replicated with reference to all the other pending claims, which rejects a petition against the payback system.

Throughout this long period of uncertainty, pressures of trade associations on the Government never stopped, with the aim of having the payback system finally repealed or the relevant contribution further reduced.

Hence, the Decree dated 30 June 2025, No. 95, published on the same date (which shall be converted into Law, with possible amendments in the subsequent 60 days) provides that the obligations of paying payback contributions for the years 2015-2018 are considered fulfilled with the payment of the 25% of the amounts initially requested by the Regions.

According to the Decree, the payment – to be made within thirty days from the date of entry into force of the Law converting this Decree- will be communicated to the Administrative Court, with reference to the pending claims, implying their extinction; otherwise, the same claims will remain pending in the merit, with the very high risk of rejection and the consequent obligation to pay the full amount of the contribution due.

The intervention of the Government is certainly welcome, but unfortunately it does neither fully repeal the payback system as expected, nor clarify what is going to happen for the years after 2015-2018, leaving, once again, the operators in the uncertainty for the future of their activity.

In the dynamic landscape of the German hospital sector, several challenges and developments are currently taking centre stage that affect both the quality of care and the economic stability of the facilities.

Quality competition between hospitals is a key challenge. There is deliberate competition between hospitals, focussing on the quality of medical care. This competition is important to ensure the profitability of hospitals and to give patients the opportunity to choose between different providers. A loss of this competition could lead to a decline in the quality of treatment.

Another key aspect is adequate staffing, particularly in the area of nursing staff. Procedures are being developed to determine the number of nursing staff required on wards with beds in order to adequately cover nursing requirements.

Demographic change poses a further challenge. An ageing population is leading to an increasing need for medical and nursing care. At the same time, the shortage of skilled labour is worsening, making care even more difficult. These developments require the healthcare system to adapt in order to ensure needs-based care.

Financial aspects also play an important role. The growing need for care and medical progress are leading to an increased need for funding. There is a need to reform the financing structures in order to ensure the efficiency and effectiveness of the utilisation of funds. Cost pressure in the healthcare sector is increasing, which has an impact on medical care and liability risks. The tension between the economic efficiency requirement and the demands on medical care is becoming increasingly apparent.

In addition, organisational duties and quality assurance are becoming increasingly important. The organisation of medical care must be designed in such a way that safe and effective patient care is guaranteed. This also includes ensuring the functionality of medical equipment and compliance with hygiene standards.

To summarize, the German hospital system faces the challenge of finding a balance between high quality of care and economic efficiency. This task requires comprehensive reforms and adjustments.

The Hospital Care Improvement Act (KHVVG), which came into force on 12 December 2024, represents a significant reform to improve the quality and efficiency of hospital care in Germany.

The KHVVG marks a significant step towards improving the quality of care in German hospitals and reforming remuneration structures. Before the KHVVG came into force, remuneration in the hospital sector was heavily dependent on flat rates per case, which led to false incentives and insufficient consideration of actual care requirements.

The KHVVG introduced several significant changes. One of the key innovations is the entitlement to transitional care for insured persons following hospital treatment. This transitional care can be utilized for up to ten days in a cross-sector care facility or at another hospital location if certain services cannot be provided or can only be provided at considerable expense. Transitional care comprises comprehensive care, including medicines, remedies and aids, activation of the insured person, basic and treatment care, discharge management as well as accommodation and meals.

A further aim of the KHVVG is the introduction of a retention fee, which is to replace around 60% of the previous flat rate per case revenue. This reform is intended to increase the financial stability of hospitals and reduce their dependence on the number of treatment cases. In the area of paediatrics in particular, additional surcharges are planned in addition to the retention fee in order to secure care in this sensitive area.

The reasons for enacting the KHVVG were the need to improve the quality of care in hospitals and to adapt remuneration systems to actual care requirements. The introduction of transitional care and the reform of remuneration structures are intended to ensure patient-orientated, high-quality care that meets both the needs of patients and the economic requirements of hospitals.

Despite the positive changes, there are also critical voices: In the specialist area of paediatrics, a significant proportion of revenue remains dependent on the number of treatment cases, which could lead to false incentives. In addition, the implementation of the economic efficiency principle in the healthcare system is seen as a challenge, as it could lead to a limitation of the medical treatment mandate.

Overall, it remains to be seen how the objectives of the KHVVG can be realised in reality and whether the targeted improvements will have the expected positive effects on the quality of care.

1. Introduction: a complex regulatory framework

Managing cybersecurity in accordance with a complex, fragmented and constantly evolving regulatory framework is one of the most complex and significant challenges today. In fact, the digitalization of production processes, the interconnection of infrastructures and the continuous proliferation of new cyber threats have led to the emergence of different regulatory sources – both at national and European level – which, while pursuing the same purpose, involve a certain fragmentation of the obligations set forth and, in general, of the applicable regulatory framework. This can sometimes make it difficult for the operators to outline a unitary organizational and operational model that allows them to fulfil the applicable regulatory obligations in a coordinated and efficient manner.

 

2. Areas of overlapping and divergence between legislative sources

2.1. NIS 2 Decree: starting point for a compliance model

Italian Legislative Decree No. 138/2024, which transposes Directive (EU) 2022/2555 or NIS 2 Directive into Italian law, introduced measures aimed at ensuring a high level of cybersecurity at national level for public and private entities operating in sectors considered essential or important.

The NIS 2 Decree represents the essential regulatory basis for operators in the development of a common cybersecurity strategy. In fact, the centrality of this decree lies in its horizontal nature, which makes it applicable to a plurality of sectors considered strategic or essential, outlining a minimum and uniform set of obligations for important and essential operators, such as the adoption of risk management measures, the notification of incidents, the implementation of security controls and the preparation of business continuity plans. Therefore, due to the general scope of the NIS 2 Decree, the latter must be the starting point for the development of a compliance model, which must be integrated and coordinated with the obligations arising from any additional regulations applicable to the individual operator, in order to ensure consistent and systematic cybersecurity management.

 

2.2. CER Directive: resilience of critical entities

Directive (EU) 2022/2557, transposed into national law by Italian Legislative Decree 124/2024, although at first sight it might appear to be distinct from the NIS discipline as it concerns another aspect of cybersecurity, i.e. the physical protection of critical infrastructures, is actually closely linked to the NIS 2 discipline. Both regulations in question, in fact, share some common points, such as the multi-risk approach, the governance of safety measures, and methods of managing incidents. Furthermore, confirming the partial overlap and convergence between the two regulations, Article 3 of the NIS 2 Decree highlights how this decree applies to all subjects identified as critics according to CER Decree. For these subjects, therefore, during the implementation of the obligations referred to in the regulatory sources in question,a joint reading of the implementing decrees, both two NIS 2 and CER directives, and a common and integrated approach to the management of the IT and physical security of their ICT infrastructures will be necessary.

 

2.3. The National Cyber Security Perimeter

The National Cyber Security Perimeter is the regulatory framework aimed at ensuring the protection of networks, information systems and IT services of strategic national security interest. Some subjects, both public and private, may therefore be required at the same time to fulfil the obligations under both this framework and NIS2. In this regard, the legislator, in order to avoid redundancies or overlaps between the disciplines and to facilitate the regulatory adaptation process, has provided for a general exemption from NIS2 obligations for the subjects included in the Cyber Security Perimeter. However, the networks, information systems and services of these operators not specifically included in the Perimeter list do not benefit from the abovementioned exemption and are subject to the discipline of Legislative Decree 138/2024. Therefore, the operators included in the Perimeter may still be required to comply with the obligations provided for by the NIS2 regulations, at least for some of their ICT systems. If on the one hand this guarantees the reduction of gaps in the security systems of important or critical subjects, on the other hand it also entails for these operators the need to coordinate the fulfilment of the two disciplines under analysis, in order to achieve an efficient compliance process.

 

2.4. DORA: lex specialis

The coordination between the NIS2 discipline and that of Regulation (EU) 2022/2554 or DORA, which regulates digital operational resilience in the financial and insurance sector, appears more straightforward. In fact, since these are sectoral provisions, the DORA Regulation is considered to be the lex specialis of the NIS2 discipline, and only the obligation to register on the platform made available by the ACN pursuant to Legislative Decree NIS2 applies to DORA subjects.

Notwithstanding the foregoing, it is the same DORA Regulation in Recital 16 that highlights the need to maintain a strong relationship between the financial sector and the EU’s horizontal cybersecurity framework to ensure consistency with the cybersecurity strategies adopted by Member States and to allow financial supervisors to become aware of cyber incidents affecting other sectors relevant under NIS2.

 

3. Building a common cybersecurity strategy

The regulatory framework outlined above represents the result of an articulated legislative process aimed at the progressive consolidation of cyber security in areas considered strategic for the protection of the public interest.

It is therefore appropriate for operators who fall within the scope of application of cybersecurity legislation to adopt a compliance model that is based on an integrated and holistic approach, capable of combining the specific obligations imposed by the various disciplines on the subject. In fact, the aim must be to build an organizational system suitable for ensuring, on the one hand, the correct identification of the applicable regulatory obligations in relation to the nature and activities of the operator in the specific case and, on the other hand, the adoption of security measures proportionate to the specific risks. Such a model, if correctly implemented, can represent not only a regulatory compliance tool, but also a strategic element in protecting the reliability and reputation of the operator, contributing to the protection of the public interest underlying cyber security. Indeed, the adoption of a structured and integrated model as described above and of safeguards capable of guaranteeing a high level of cybersecurity can represent, especially in the current context characterized by a high exposure to cyber risks, a significant competitive advantage for the operator compared to its competitors. In this perspective, the implementation of adequate and effective cybersecurity management models by some companies operating in a given sector may firstly represent a strategic investment for the company capable of generating an economic return, and secondly trigger a broader evolutionary process of improvement, involving other operators and/or competitors, who will in fact be called upon to comply with increasingly higher security standards, driven by market dynamics that reward resilience and reliability in cyber risk management.

In practical terms, first of all, cybersecurity legislation gives corporate management bodies a central role in the governance of cybersecurity, going beyond the traditional competence of IT. These management bodies are called upon to approve and supervise cyber risk management measures, as well as to participate in specific training courses. In addition, it will be necessary to structure a cybersecurity governance system based on clearly defined roles and responsibilities – including, for example, the appointment of a Chief Information Security Officer (CISO) – and on the establishment of a dedicated decision-making center, such as an internal cybersecurity committee.

An essential element of this model is the timely and constantly updated mapping of critical IT assets and relevant ICT infrastructures, to be correlated with the regulations applicable from time to time, in order to outline a clear framework of compliance obligations and measures to be taken. On this basis, companies will be required to develop an IT risk management system that provides for periodic risk assessment activities, accompanied by the implementation of technical and organizational security measures calibrated to the levels of risk identified, suitable for ensuring the protection of information systems and business continuity. In addition, this IT risk management system should consider the level of risk associated with the entire supply chain.

In order to increase the efficiency of the management of the above-mentioned safeguards, it is best to prepare a single set of documents, constantly updated and easily accessible for all personnel, containing, for example, security policies, incident response plans, access management procedures and protocols for reporting to the competent bodies. Finally, continuous training at all levels of the company, and not limited to technical staff, is particularly important, with the aim of spreading a culture of cybersecurity across the entire organization.

For the above-mentioned reasons, the implementation of a common and integrated compliance model, which takes into account the entire regulatory framework applicable to a company from time to time, is not only a strategic investment for the company, but also necessary to ensure timely and efficient compliance with existing regulatory obligations, and to face the challenges arising from the constantly evolving cyber threats.

Around two thousand claims raised in 2023 are still pending before the Italian Administrative Court of Rome against the Ministerial and Regional Decrees which, implementing the Legislative Decree 2015, No. 78, Article 9-ter, required the supplier of medical devices many years after – at the end of 2022 – to pay an amount corresponding to the percentage incidence of their sales to the Regional Healthcare Service (Servizio Sanitario Regionale), in order to contribute to the coverage of the regional governments’ public expenditure on medical devices in excess of a certain limit (as identified by Ministerial Decree 6 July 2022) for FYs 2015, 2016, 2017 and 2018.

The Administrative Court of Lazio, in the second half of 2023, issued a temporary decision in almost each pending claim which suspended all the deeds challenged, deciding to submit to the Constitutional Court the issue relating to the legitimacy of the payback system, provided by the said Legislative Decree No. 78/2015.

The Constitutional Court, with its final judgement No. 140/2024, confirmed the constitutional legitimacy of the rules governing payback, limited to 48% of the payments requested by the Regions, essentially affirming that the law can limit private economic initiative in case of social needs, providing a solidarity contribution, provided that it responds to the principles of reasonableness and proportionality.

Following the rulings of the Constitutional Court, which effectively represent a compromise between the various positions taken by the public and private entities involved in the dispute, the final decision in the merit is now back to the Administrative Court.

On February 25^th 2025, the final hearing in the merit of some of the pending claims was held with no anticipation of what the outcome of the claims will be. Certainly, should the Court reject the claims, it is expected that the Regions will issue new deeds, redefining the amounts due (equal to 48% of the amounts originally requested 2018) and the Company, on the other side, will appeal the decision of the Court, causing a further long period of uncertainty relating to the payback system.

The EU hydrogen and gas decarbonisation package, consisting of Directive (EU) 2024/1788 and Regulation (EU) 2024/1789, was adopted in May 2024. It updates the rules on the EU natural gas market set out in the Gas Directive 2009/73/EC and the Gas Regulation 715/2009/EC. The revised gas market rules were published in the EU Official Journal on 15 July and entered into force 20 days later. Concerning the Directive, Member States will have two years to adapt their national legislation to the provisions of the Directive.

Scope and Purpose of the Hydrogen and Decarbonised Gas Market Package

The revised gas market rules establish a common framework for the decarbonisation of the markets for natural gas and hydrogen, in order to contribute to the achievement of the Union’s climate and energy targets. Its scope is to facilitate the Union’s objective to cut greenhouse gas emissions at the same time as ensuring security of supply and the proper functioning of the internal markets for natural gas and hydrogen.

In contrast to electricity, the role of natural gas will progressively decline in the future, which also affects the demand for infrastructure investments. Therefore, it will be necessary to strategically close and adjust part of the distribution system in order to phase out the supply of natural gas to household customers, thus ensuring the transition into a sustainable and effective system. The aim is to progress towards interconnected markets for hydrogen in the Union and thereby facilitate investment in cross-border hydrogen infrastructure. The gradual phase-out of natural gas also contributes to the resilience of the European energy supply.

The new Framework

The Hydrogen and Decarbonised Gas Market Package seeks to facilitate the penetration of renewable and low-carbon gases into the energy system, enabling a shift from natural gas and to allow for these new gases to play their needed role towards the goal of EU climate neutrality in 2050.

In order to achieve this, the updated regulatory framework of the Directive incorporates a series of measures designed to enhance the rights of customers and consumers. The measures include transparent pricing (e.g. access to a comparison tool free of charge), extended information obligations, the right to switch suppliers and new provisions for an independent, cost-effective and efficient out-of-court mechanisms for the settlement of disputes, as well as protection against energy poverty. Moreover, it strengthens the rights of active customers on the market for natural gas. Active customers should be entitled to operate directly and sell self-produced renewable natural gas using the natural gas system without suffering from any discrimination. In addition to consumer protection, the joint use of energy is also reinforced.

Another key point of the decarbonisation package is the switch from fossil gas to renewable alternatives such as hydrogen. In line with the EU Hydrogen Strategy, renewable hydrogen is expected to be deployed on a large-scale basis from 2030 onwards for the purpose of decarbonising certain sectors, ranging from aviation and shipping to hard-to-decarbonise industrial sectors.

The new Regulation provides for third-party access to hydrogen networks and storage facilities according to objective criteria and without discrimination. Therefore, from 1 January 2033, third party access will be subject to a regulated tariff regime. Member States have the possibility to allow for a negotiated third party access to hydrogen networks until 31 December 2032.

Moreover, the new Regulation establishes a network association for the operators of hydrogen transmission networks, called The European Network for Network Operators of Hydrogen’ (ENNOH). The tasks of ENNOH include writing relevant network codes, as well as developing union-wide, non-binding ten-year network development plans for the hydrogen sector.

In addition, unbundling provisions for hydrogen networks were implemented. The unbundling rules for hydrogen distribution network operators are generally aligned with the existing requirements for gas distribution system operators (unbundling in terms of legal form, organization and decision-making power). For hydrogen transmission network operators, ownership unbundling is generally required. Alternative options are the possibility of unbundling as an independent hydrogen transmission network operator or as an independent transmission network operator (so-called integrated hydrogen transmission network operator). In principle, combined grid operation of electricity, gas and hydrogen grids is permitted. However, the hydrogen transmission network operator must be organized in a separate legal entity (horizontal unbundling).

The Directive also requires Member States to provide for tariff discounts and incentives in order to facilitate their market and system integration, especially for the emerging hydrogen market, and so to ensure a just transition. Moreover, network development plans will be built on sector integration, the ‘energy efficiency first’ principle and prioritizing the use of hydrogen in hard-to-decarbonise sectors.

Measures relating to security of supply will also be strengthened by the new provisions. The updated Regulation provides for the introduction of a mechanism for the joint procurement of gas to avoid competition between Member States, as well as a pilot project to strengthen the EU hydrogen market.

Impacts and Effects

The updated revised gas market rules aim to decarbonise the energy sector and includes provisions on consumer rights, transmission and distribution system operators, third-party access and integrated network planning, and independent regulatory authorities. Those new provisions present a multitude of prospective opportunities for the energy market, which have the potential to benefit all market participants.

In the light of the increased consumer empowerment and protection established in the natural gas and hydrogen sectors, energy companies are obliged to provide their customers with comprehensive information on the terms and conditions of their contracts, the pricing structure, the availability of contract switching options, and the proportion of renewable energies in their gas mix. Furthermore, bills and billing information are required be accurate, easy to understand, clear, concise, user-friendly and presented in a manner that facilitates comparison by final customers

With regard to the new comprehensive consumer protection provisions, it is of the utmost importance for energy suppliers to obtain an overview of the new obligations at an early stage. To avoid lengthy procedures with customers, it is advisable to implement or adapt the internal control system to ensure compliance with the regulations.

Furthermore, certain gas pipelines will be rededicated to hydrogen or shut down completely. Therefore, gas distribution system operators must develop network decommissioning plans where a reduction in natural gas demand requiring the decommissioning of natural gas distribution networks or parts of such networks is expected. In consequence of the growing interconnection between the electricity, gas and hydrogen sectors, market participants must work more closely together. This also requires the joint development of energy supply plans.

While the new framework for decarbonising the markets for natural gas and hydrogen will help European companies to remain competitive by giving them access to more predictable energy costs, it should be noted that there are also new strict rules that market participants must comply with. For example, with regard to the unbundling regulations, it is advisable that market participants who wish to operate in the hydrogen sector in the future familiarise themselves with the relevant regulations in in a timely manner. [1]

Overall, both households and companies have the chance to benefit from the lower costs of renewable energies, whose integration and availability will also be promoted by the new provisions on grid congestion, trading deadlines, load control and storage as well as auctions at EU level. [2] The entry into force of the new rules will also give energy companies the planning security they need to set the course for the energy transition towards green gas and hydrogen.

 

[1] Bisteghi/Dießner, Hochlauf der Wasserstoffwirtschaft in Österreich: das EU-Wasserstoff- und Dekarbonisierungspaket und der Gasmarkt von morgen, ecolex 2024, 653.
[2] Topal-Gökceli, Reformen des Strom- und Gasmarkts sowie neuer Rechtsrahmen zur Förderung der Entwicklung von Wasserstoff, ZfRV 2024, 107.

unyer Working Group Energy / Infrastructure

Sarina Illo Ortner

Roberto Padova

Holger Stappert

Relevance also for medical devices from 13 December 2024

The EU General Product Safety Regulation 2023/98 – GPSR, published on 23 May 2024, will enter into force on 13 December 2024 and will be directly applicable from that date. The GPSR lays down general rules for the safety of consumer products placed on the market in the European Union or made available for sale online or in shops on the EU-market.
For those products for which safety-relevant legal acts already exist, the GPSR can nevertheless be applied in addition. Foodstuffs and medicinal products for example are expressly excluded from the scope of the GPSR, but not medical devices.

The specific safety requirements for medical devices are primarily regulated by the Medical Device Regulation (Regulation (EU) 2017/745 – MDR). The GPSR imposes additional requirements, if certain safety risks are not fully covered by the MDR. Those areas of the GPSR that are not covered by the MDR, such as responsibilities of providers of online marketplaces, new information obligations in the case of distant sales, reporting obligations or consumer rights, also apply to medical devices that are intended for or used by consumers.

Some of these relevant provisions of the GPSR are, for example, the following:

• Providers of online marketplaces are subject to new information, monitoring and reporting obligations.
• All economic operators selling their products online must provide contact details, product information and product images. Warnings and safety information must be placed on the product or on the packaging or in an accompanying document in a language easily understood by the Member State in which the product is made available on the market.
• In future, all manufacturers will be obliged to report safety-related incidents via the European Safety Gate rapid alert system. This also provides for a web portal to inform the public, including the option of submitting complaints (Safety Gate portal).
• Consumers must be informed immediately of product safety recalls or safety warnings in writing and in an easily understandable manner, this can also be done via the consumer’s contact details stored for this purpose only or via other channels to reach all consumers. In the event of a product safety recall, the responsible economic operator must offer the consumer an effective, cost-free and timely remedy. The remedy shall not cause significant inconvenience or expense to the consumer.

The provisions of the GPSR bring significant changes, particularly in the digital trade in medical devices, which must be complied with from 13 December 2024. To avoid possible sanctions (to be set by the EU Member States) and collective consumer actions, all economic operators must familiarize themselves with the specific obligations that apply to them. It is also important to put in place internal procedures to be prepared for handling product recalls as well as safety complaints from consumers and to ensure that their rights are properly handled.

 

unyer Working Group Health Care & Life Science

Barbara Kuchar

Petra Artner

On 24 September 2024, the French national agency for the safety of medicines and health products (the “’ANSM’) announced the imposition of financial sanctions totalling nearly eight million euros against 11 pharmaceutical companies for non-compliance with their legal obligations to keep a contingency stock of so-called medicines of major therapeutic interest.

These sanctions have been imposed in a context where the risk of shortages is worsening: in 2023, the ANSM recorded almost 5,000 reports of out-of-stock medicines and risks of stock shortages ie one third more than in 2022 and six times more than in 2018. Moreover, they represent a significant increase compared to the six fines equalling a total of 560 000 euros handed out in 2023.

Consequently, these most recent fines appear to be particularly severe and raise questions about both the ANSM’s enforcement policies and the practical consequences of such heavy penalties.

Medicines of major therapeutic interest are defined in the French Code of public health as medicinal products “for which an interruption in treatment is likely to jeopardise the patient’s vital prognosis in the short or medium term, or represents a significant loss of opportunity for patients in view of the seriousness or potential evolution of the disease”.

In order to protect patients against such risks, the Code of public health places upon marketing authorisation holders (‘MAHs’) and wholesalers in particular a default obligation to keep a dynamic contingency stock of medicines of major therapeutic interest covering at least two months’ demand for the French market.

Moreover, where such a medicine has regularly been at risk of stock shortages or out of stock in the previous two calendar years, the ANSM may decide to increase the contingency stock duration requirement to a maximum of four months’ supply. Currently, 748 medicinal products are designated by the ANSM as requiring a 4-month contingency stock, compared with 422 in 2021 when these measures were added to the Code of public health.

In the event of non-compliance by a legal entity with these obligations, the ANSM may impose a fine of up 30% of the previous financial year’s turnover for the product or group of products concerned, up to a limit of one million euros.

On a European level, recently re-elected president of the European Commission Ursula von der Leyen has confirmed that the EU Commission “will propose a Critical Medicines Act to reduce dependencies relating to critical medicines and ingredients” in order to remedy the problem of “severe shortages of medical devices and medicines, with antibiotics, insulin, painkillers and other products becoming particularly difficult to obtain.”[1]

This follows the establishment in January 2024 of the Critical Medicines Alliance, a consultative mechanism whose mission is to “identify the best measures to address and avoid shortages of critical medicines” and which is scheduled to make recommendations and present a strategic plan by the end of 2024.

Although concrete details of a future EU act are yet to appear and the CMA’s work is ongoing, contingency stock measures are already under consideration at the EU level.

First, article 134 of the proposal for a regulation for the authorisation and supervision of medicinal products for human use, published in March 2023, states that the Commission may take in account, in particular, recommendations of the European Medicines Agency’s Executive Steering Group on Shortages and Safety of Medicinal Products (MSSG) and may consequently “impose contingency stock requirements of active pharmaceutical ingredient or finished dosage forms, or other relevant measures required to improve security of supply”.

In that regard, the MSSG has recently flagged that:

• “Several Member States have implemented provisions at national level to require supply chain actors to maintain a contingency stock in order to have a buffer when short-term shortages occur”; and
• “The MSSG may also issue a recommendation that certain supply chain actors maintain safety stocks to create a buffer stock of certain critical medicines to protect against fluctuations in demand or supply.”[2]

Moreover, a 2021 Commission report highlighted the “important benefits to patients and health systems, in the form of costs avoided and continuity of care, from avoided shortages or from shortages that are resolved more quickly or mitigated better”. [3]

It should be noted, however, that the report ultimately recommended introducing “legal obligations for MAHs and wholesalers to maintain a safety stock of (unfinished) products for medicines of major therapeutic interest at EU-level”.

In any case, national precedents including the French ANSM’s vigorous enforcement of its contingency stock obligations present a case study for the Commission to consider in weighing up potential measures that could be included in a future Critical Medicines Act.

Following the ANSM’s announcement, the French industry association representing generic medicines manufacturers, the GEMME, swiftly denounced the fines, saying in a press release that “These extremely serious sanctions were imposed even though the products were, in most cases, available on the market. This approach is not viable for a high-volume, low-price sector. Faced with the scale of the penalties or the risk of being penalised, manufacturers will be forced to withdraw from the market…”

These are all factors that the European legislator will need to take into account in its pursuit of securing the supply of critical medicines while simultaneously maintaining affordable prices for patients.

 

unyer Working Group Health Care & Life Science

Ruslan Churches
Attorney at Law, Senior Associate

Jean-Baptiste Chanial
Attorney at Law, Senior Partner

 

[1] ‘Political Guidelines for the Next European Commission 2024−2029’, Ursula von der Leyen, 18 July 2024.
[2] ‘Recommendations to strengthen supply chains of critical medicinal products’, Executive Steering Group on Shortages and Safety of Medicinal Products, 19 April 2024.
[3] ‘Future-proofing pharmaceutical legislation — Study on medicine shortages’, European Commission, December 2021.

From 9 February 2025, Italy too will be interconnected with the major European hub for verifying the authenticity of medicines before they are dispensed to patients.

Our country, together with Belgium and Greece, has taken advantage of a six-year derogation for the adaptation of the drug traceability system to the standards provided for by the European Directive 2011/62/EU – “Falsified Medicine Directive” supplemented by the Delegated Regulation (EU) 2016/161 of the European Commission, by virtue of the presence in our system of the so-called “vignino system” particularly efficient and structured for the traceability and control of drugs, based on the single national database and the stamp issued by the Istituto Poligrafico e Zecca dello Stato.

From 9 February 2025, Italy too will be interconnected with the major European hub for verifying the authenticity of medicines before they are dispensed to patients.
Our country, together with Belgium and Greece, has taken advantage of a six-year derogation for the adaptation of the drug traceability system to the standards provided for by the European Directive 2011/62/EU – “Falsified Medicine Directive” supplemented by the Delegated Regulation (EU) 2016/161 of the European Commission, by virtue of the presence in our system of the so-called “vignino system” particularly efficient and structured for the traceability and control of drugs, based on the single national database and the stamp issued by the Istituto Poligrafico e Zecca dello Stato.

The “new” European legislation, operational as of 9 February 2019 in all other Member States plus Iceland, Liechtenstein and Norway, envisages the affixing of a unique two-dimensional barcode, known as “Datamatrix 2D”, on drug packages and the implementation on them of an anti-tampering device to guarantee their integrity and non-compromise. The system will thus be based on a European interconnection of drug data to facilitate the free movement of medicines in the EU area, in a system aimed at protecting the health of patients.
The Council of Ministers of 30 August 2024 examined the legislative decree for the harmonisation of national legislation with European standards, introducing new obligations for the dispensing of prescription drugs, applicable to the entire drug supply chain: from manufacturers, wholesalers and distributors to pharmacists.

In particular, manufacturers who hold the marketing authorisation for drugs will generate the identifier and enter it into the single national archive linked to the European database. The identifier will be verified at each subsequent step within the supply chain; in fact, wholesalers and distributors will have to verify the unique code by comparing it with those in the system and consider it authentic only if they find a match in the national and European archives. The last check that the medicine undergoes, before reaching the patient’s hands, is carried out by the pharmacist, who must validate and remove the code at the time of dispensing after comparing it with the identifiers in the system. If the unique code is not present in the records, one could be faced with a counterfeit medicine.

Outside the ordinary process, the various operators will only be able to remove the code in the strict cases provided for by the regulations, including, medicines distributed outside the European Union or, medicines that cannot be put back into the sales stock or destined for destruction or samples requested by the competent authorities.

The decree also deals with the identification of sanctions for non-compliance with the regulation, which, to date, seems to have a considerable impact on the activities of distributors and pharmacists and for which, at the current state of the art, several critical issues are already emerging:

• the integration and dialogue of the databases, the national one managed by the consortium company “Nmvo – National Medicine Verification Organisation” set up in January 2024 by all players in the drug supply chain and the European one, “European Medicines Verification Organisation”. A further connection is planned with the “Nsis – New Health Information System”, a database with which the systems of retail pharmacies will interface, which in turn will have to equip themselves with systems capable of interacting with the European Hub and with hospitals for drug decommissioning procedures.
• the provision of new optical readers, suitable for the new unique code, for pharmacists (old technological equipment will not be able to be decommissioned until the drugs in circulation with the “old sticker” are completely disposed of).
• the repeal by the Government of the current “vignette system” legislation to make way for the new “Datamatrix”.

More details will come with the technical specifications that the Ministry of Health will issue within 30 days of the government decree coming into force. For the time being, the first deadline set by the decree is 9 November 2024, when holders of marketing authorisations for drugs issued before the decree came into force will already have to have submitted an application to AIFA to adapt their authorisation to the new drug traceability system.

 

unyer Working Group Health Care & Life Science

Roberta Pirola
Partner

Alberto Santi
Partner

The digitalisation of the healthcare system is an important step towards more effective and efficient healthcare. Advances in medical technology such as Wearables, robot-assisted surgery and Artificial Intelligence (AI) are also being used more and more frequently in the healthcare sector. The EU and the German Federal Ministry of Health (Bundesministerium für Gesundheit; “BMG”) have set themselves the goal of making health data accessible for research purposes and improving healthcare through digital solutions.

The German Digital Act (Digital-Gesetz, “DigiG”) was introduced in March 2024 to simplify every-day treatment for doctors and patients with digital solutions. The most important contents include the Electronic Patient Records (ePA), which will be set up for all people with statutory health insurance at the beginning of 2025. The e-prescription has already become a binding standard in the provision of medicines in Germany and is currently being further developed.

Furthermore, the German Health Data Use Act (Gesundheitsdatennutzungsgesetz; “GDNG”) came into force in March 2024 as well. The main, but not final, contents are the establishment of a central data access and coordination centre for the use of health data in order to reduce bureaucratic hurdles and facilitate access to research data. The lead data protection authority for transnational research projects will be extended to all health data. In future, an opt-out procedure will apply to the release of data from the ePA. This will make it easier to utilise treatment data for research purposes. Only data that has been reliably and automatically pseudonymised will be transmitted.

‘Modern medicine needs digital help’, said Federal Health Minister Karl Lauterbach at the presentation of the new digitalisation strategy in March 2023. However, these modern developments are subject to strict regulatory requirements such as the European Medical Device Regulation (MDR) and the national Medical Device Law Implementation Act (Medizinprodukterecht-Durchführungsgesetz; MPDG) and pose a challenge for the development of the Metaverse around the digitalisation of medical technology. For example, the MDR and MPDG contain extensive requirements for the clinical evaluation of Wearables. As a rule, medical technology companies must conduct clinical studies and fulfil basic requirements for the safety and performance of the products.

For this reason, international companies are increasingly investing in the UK, Singapore, China and Vietnam, where the government is promoting the digitalisation of the healthcare system more strongly and setting the course for the future.

In Germany, even after facilitating the digitalisation of the healthcare system through national and European laws, there is still a need for action to create a legal framework that is open to digital innovations and does not impair the marketability of wearables, for example.

It remains to be seen whether legislators will respond to these developments with regulatory relief in order to improve Germany’s attractiveness as a centre of innovation for medical technology. Stay tuned!

 

unyer Working Group Health Care & Life Science
Dr. Christoph von Burgsdorff, LL.M.
Partner

Luisa Kramer
Associate

Numerous appeals are still pending before the Regional Administrative Court for Lazio against the deed issued in December 2022 by the Regions, based on Article  9-ter of the Legislative Decree No. 78/2015 (as amended by the Legislative Decree No. 115/2022), ordering the suppliers of medical devices to public administrations to pay a contribution for the partial offset (so-called payback) to cover the regional governments’ public expenditure on medical devices in excess of a certain limit for FY’s years 2015, 2016, 2017 and 2018, as certified by the Ministerial Decree dated 6 July 2022.

The Court, in nearly all pending cases, has temporarily suspended the effects of the payment requests and, in order to adopt the final decision on the merits, formally requested to the Constitutional Court, on 24 October 2023, to verify the constitutional legitimacy of the rules regulating the payback system.

The Constitutional Court, with its final judgement No. 140 published on 22 July 2024, confirmed the constitutional legitimacy of the rules governing payback, essentially affirming that the law can limit private economic initiative in case of social needs, providing a solidarity contribution, provided that it responds to the principles of reasonableness and proportionality.

This solidarity contribution, according to the Constitutional Court, would be ‘reasonable’, as it is aimed at guaranteeing the protection of the public healthcare system and the rationalization of its costs, and ‘proportionate’, taking into account the reduction of the contribution for all suppliers of medical devices to an amount equal to 48% of the payments requested by the Regions.

In this latter respect, in fact, the Constitutional Court itself, with the judgement No. 139 published on the same date of 22 July 2024, declared the constitutional illegitimacy of the known Government provision (referred to in Article 8 of the Legislative Decree No. 34/2023) which provided for the said 48% reduction as reserved only for operators who decided to waive to the claims raised before the Regional Administrative Court, since such reduction should have been acknowledged to all the operators with no distinction.

Following the rulings of the Constitutional Court, which effectively represent a compromise between the various positions taken by the public and private entities involved in the dispute, it is now believed that there is no margin for obtaining a complete annulment or further reductions of the requests for contributions of payback.

Therefore, it is expected that the Regions will issue, within a period of time difficult to foresee, new deeds, redefining the amounts due (equal to 48% of the amounts originally requested for the FY’s 2015, 2016, 2017 and 2018) and the payment methods of the same. This may lead to a consequent conclusion of the pending appeals before the Court due to a supervening lack of interest.

On 5 July, the Corporate Sustainability Due Diligence Directive (CSDDD), also known as the Supply Chain Act or, more technically, Directive (EU) 2024/1760 of 13 June 2024, was published in the Official Journal of the European Union. This directive represents a crucial step in promoting corporate sustainability and holding businesses accountable for their social and environmental impacts throughout their supply chains. In fact, following the Corporate Sustainability Reporting Directive (CSRD), entered into force on 5 January 2023, which imposed new and more demanding ways of conducting sustainability reports for larger companies, the CSDDD introduce an obligation for companies of a certain size to identify and mitigate – through careful and thorough due diligence – adverse impacts on human rights (such as child labour) and the environment (such as pollution) in their own operations, those of their subsidiaries and those of suppliers and sub-suppliers included in their business relationships, i.e. their supply chain.

The innovative scope of CSDDD Directive was recognised even before its entry into force, such that the European legislator was obliged, given the numerous objections from the Member States, to provide for its gradual application, proportionate and therefore inextricably linked to the size of the companies subject to its implementation: as of 26 July 2027, companies with more than 5,000 employees and a turnover of more than EUR 1,500 million; from 26 July 2028, companies with more than 3,000 employees and a turnover of more than EUR 900 million; and finally, from 26 July 2029, all other companies falling within its scope (i.e. those with more than 1,000 employees and a turnover of more than EUR 450 million).

Until recently, the lack of adequate and effective control over the supply chain allowed companies to remain passive, as there was no concrete reason, either from an economic or a productivity point of view, for them to monitor the performance of their suppliers and subcontractors in terms of compliance with human rights and environmental standards. This state was due to the absence of a real supply chain management and control system, which was limited to the signing of ethical codes and superficial, often cursory audits, instead of a real risk management system covering the entire chain and aimed at effectively monitoring suppliers in order to support them, both economically and in terms of know-how, on their way towards a more sustainable business model.

With the entry into force of the European Directive, large companies (and, consequently, the SMEs involved in their supply chain) will first have to carefully map the risks affecting the supply chain, necessarily involving all stakeholders, and provide appropriate training on CSDDD issues to all employees. In addition, at the documentary level, companies will be required to produce annual reports focusing on the impact of their activities on the environment, human rights and related risks.

These obligations will enable companies to adopt a sustainable and transparent business strategy that, although considerably burdensome in the short term, will bring significant benefits in the long term.

Each Member State will set up a specific supervisory authority with the power to carry out inspections, impose significant fines – up to 5% of the company’s total net turnover, plus compensation for any damage caused – and, in the event of non-compliance, issue public statements indicating responsibility and breach, with obvious negative repercussions on the reputational profile of the company involved.

Transparency, a culture of legality and competitive input will form the basis of the Supply Chain Act, with a commitment from companies to adopt appropriate compliance, accompanied by adequate contractual protection and negotiating safeguards – especially in the most commonly used types of contract in this fields, such as for contracting and subcontracting agreements – together with the creation of a competitive market favourable to SMEs, whose sustainable policies will be preferred to the selection of low-cost, foreign or socially and environmentally dumping suppliers.

On June 27, 2024, the European Union announced its withdrawal from the Energy Charter Treaty (ECT). This move potentially marks the end of a long and difficult negotiation process on the reform of the treaty, which was originally intended to promote and protect investment in the energy sector. Given the undisputed need to promote investment in renewable energy and thus combat climate change, this withdrawal raises a number of questions.

The Origins of the ECT

The ECT was signed in 1994 and came into force in 1998. Originally comprising almost 50 contracting parties from Europe (including all EU member states in addition to the EU), the successor states to the Soviet Union and Asia, it aims to create a stable framework for cross-border cooperation in the energy sector. This includes protecting investments in the energy sector and settling disputes between investors and states. The original political motivation was to secure access to the oil and gas sources there after the First Gulf War and the collapse of the Soviet Union.

So far unsuccessful reform negotiations

In recent years, criticism of the ECT has grown, particularly with regard to its alleged incompatibility with the EU’s climate targets and the Paris Agreement. Critics argued that the treaty protects fossil fuels and would thus hinder the transition to renewable energies. In 2022, after five years of negotiations, an agreement in principle was reached on a modernized treaty that would have significantly restricted protection for existing and new investments. However, as not all EU member states agreed to the details, a vote was postponed until 2023. In the meantime, however, numerous contracting parties, including Germany, Denmark, France, Italy, and Spain have declared their withdrawal from the ECT. Austria has also been considering an exit from the ECT for some time, but initially has postponed its final decision in view of the modernization efforts.

In March of this year, the European Commission therefore proposed a three-stage process in which the EU first withdraws from the treaty, then the EU member states agree to no longer block the conclusion of the modernized treaty, and subsequently all other EU member states withdraw from the non-modernized ECT.

Effects of the phase-out on existing investments

A crucial point in connection with the EU’s withdrawal is the sunset clause in Article 47 of the ECT. This clause states that existing investments continue to be protected by the treaty for up to 20 years after the withdrawal of a contracting party. This applies both to foreign investors and to investors of this contracting party abroad.

However, the relevance has so far been low, as proceedings have almost always been initiated against EU member states. The withdrawal is also likely to be of little relevance for investors from the EU, as all EU member states were also parties to the ECT. Despite the withdrawal of these states, the issue will also have little relevance in the future, as the sunset clause also applies to the member states. Whether this can be abolished retrospectively is at least doubtful.

Impact on new investments and renewable energies

Probably the most serious effect of the withdrawal concerns new investments. While existing investments, whether fossil or renewable, will remain protected, no new investments, whether fossil or renewable, will be protected against EU measures.

The need for private investment in the energy transition is undisputed. According to the International Energy Agency (IEA), annual investment in clean energy must increase to around USD 4 trillion by 2030 in order to achieve the goals of the Paris Agreement.

Interestingly, the majority of arbitration proceedings under the ECT were directed against European states such as Spain, Italy and Germany and concerned the renewable energy sector. These proceedings were often initiated by investors who felt disadvantaged by changes in the support conditions for renewable energy. Spain, for example, was confronted with a large number of lawsuits after it retroactively reduced the feed-in tariffs for solar energy. This shows that renewable energies also require considerable investment protection in order to ensure confidence and stability for investors.

Conclusion: a double-edged sword

The EU’s withdrawal from the Energy Charter Treaty is a complex issue with far-reaching consequences. While existing investments continue to be protected and European companies in third countries continue to benefit from the ECT, the lack of protection for new investments, particularly in the area of renewable energies, could hamper the EU’s climate protection efforts.

It remains to be seen whether the European Commission’s strategy of overcoming resistance to the adoption of the modernized ECT will work. In the short term, however, it represents a setback for the protection of urgently needed investments in renewable energies.

 

Authors of the unyer Energy & Infrastructure working group

Dr Richard Happ
Manuel Tomas
Roberto Padova
Nicolas O. Zenz 

The German Civil Code (BGB) has been getting increasingly complex for years, in part due to several EU Directives and in part due to domestic legislative changes. This development constantly creates new challenges for companies and might lead to an increased application of the “United Nations Convention on Contracts for the International Sale of Goods” (CISG).
The CISG is an international law for trading of goods, which contains its own legal system of rights and obligations for buyers and sellers. It is recognized in 97 Contracting States, includ-ing most European nations and many others like the USA, China or Japan. In theory, the CISG would apply to most cross-border commercial contracts for the sale of goods, as long as the contract is subject to the law of one of the Contracting States. In fact, many contracts exclude the application of the CISG, because companies and their legal advisors favour their familiar domestic civil codes.

Regarding the German jurisdiction, it might be worth to reconsider. The CISG is easy to un-derstand, less complex than the German Civil Code and allows greater freedom of contract.
In the past years more and more provisions have been added to the German Civil Code, e.g. provisions on the sale of consumer goods or provisions on recourse. “Recourse” means a sellers claim against his supplier. It differs partially from general warranty claims that the seller might be entitled to and only applies to contracts on certain goods, such as consumer goods or newly manufactured things.

As of January 1st 2022 the Directive (EU) 2019/770 (“Digital Content Directive”) and the Di-rective (EU) 2019/771 (“European Sales of Goods Directive”) have been implemented into domestic law. Since then, the German Civil Code also contains special provisions on the sale of digital products and the sale of goods with digital elements, each with their own pro-visions on warranty and recourse. The changes of 2022 have also abolished the fixed limita-tion period for recourse. And the changes have extended the period of shifted burden of proof, regarding defects of consumer goods, up to one year. Many of these new provisions are mandatory rules, that can not be modified by contract.

In contrast, the CISG does not differentiate between different types of products and only con-tains one set of provisions. It only stipulates general warranty rights, like claims for damages, reduction of price or declaring the contract avoided. These rights are time-barred after a peri-od of two years. Furthermore, most provisions of the CISG are default rules and subject to modification by the contracting parties. Overall the CISG is subject to less legislative change compared to the German Civil Code.

In conclusion, the CISG might be a suitable alternative for cross-border sales contracts. It enables contracting parties to agree on terms and conditions that would be invalid under domestic German law. Finally, because the CISG is recognized in many countries, it allows for the use of the same contract template for business dealings in different countries.

 

unyer Working Group Commercial & Trade Law
Dr Christoph von Burgsdorff
Dr Robert Burkert

On October 17, 2023, the French pharmaceutical industry signed its first sector-wide agreement on ecological transition and sustainable mobility. The agreement, signed between Leem and the CFDT, CFTC, FO and Unsa federations, requires companies to carry out a carbon assessment of their activities by October 17, 2024, and to adopt two best practices from among those proposed, such as adjusting executive compensation, collective catering, responsible transport and purchasing.

The agreement highlights the importance of integrating ecological issues at every stage of the drug life cycle without compromising jobs or working conditions. In line with the French Climate and Resilience Act of August 22, 2021, which incorporated the ecological transition into negotiations on job and career path management (GEPP), the agreement goes further by requiring that all company negotiations now include the ecological dimension.

The social and economic committees (CSE) of companies with over 50 employees must be informed about the environmental impact of projects. As with the human impact study of projects, the environmental impact study is becoming essential. Acculturating and training the social partners on CSR/ESG issues will help ensure common understanding and effective collaboration.

Companies will have to include environmental criteria in their profit-sharing agreements and are encouraged to offer employee savings funds with the “socially responsible investment” (SRI) label.

Lastly, the agreement encourages the inclusion of environmental criteria in compensation policies, particularly for top executives, as the involvement of management (the tone at the top) is a key factor in effective environmental policy. Companies must also sensitize their employees to environmental issues, with initiatives such as eco-driving and everyday actions.
This agreement is a significant step towards a more responsible and sustainable pharmaceutical industry, integrating environmental concerns at the heart of its strategy.

Against this backdrop, the role of lawyers as expert advisors is essential in explaining the legal implications of the new regulations and enabling business leaders to build effective sustainable strategies, avoiding greenwashing and socialwashing, to reduce the litigation risk. As trusted advisors to business leaders, lawyers play a strategic role in managing these paradigm shifts within companies.

 

Caroline Ferté
unyer Working Group Health Care & Life Science

The Supreme Court (OGH) dealt with this question in its recently published decision of March 19, 2024 on 4 Ob 42/24s and commented on a few fundamental questions.
The use of Ozempic in people who are not severely obese or do not suffer from diabetes, but want to lose weight easily, has been the subject of much controversy for several months. Only recently there was a dispute between two well-known Hollywood actresses.

In the case in question, a specialist doctor in plastic, aesthetic and reconstructive surgery had given several patients in his two surgeries who were suffering from obesity the drug Ozempic for self-administration at home for the entire duration of the treatment. The defendant doctor had taken a fee for this. One of the preparations, which he had not purchased from an Austrian pharmacy, also turned out to be a counterfeit. After using the counterfeit preparation, the patient using it suffered a seizure and hypoglycemia.
The Austrian Chamber of Pharmacists based its action on Section 1 of the Unfair Competition Act (UWG) and asserted a breach of Sections 57 and 58 of the Austrian Medical Practitioners Act (ÄrzteG – permissible dispensing of medicinal products) and Section 58 of the Austrian Medicinal Products Act (AMG – pharmacy reservation). The courts issued the requested interim injunction against the doctor.

In its decision, the Supreme Court emphasized that the pharmacy reservation anchored in Section 59 para. 1 AMG means that the supply of medicines to the population by public pharmacies has primacy, from which there are only narrow, legally defined exceptions.

It is true that, depending on the nature of their practice and local conditions, all doctors must keep the necessary medicines for first aid in stock. This requirement is interpreted restrictively by the courts, according to which an urgent case of dispensing a medicine to a patient can only ever exist if it is no longer possible to obtain the medicine from a public pharmacy in good time. This exception therefore only applies to medicines that must be administered to patients without delay in order to provide first aid. Under no circumstances does this regulation apply to medicines that are used for further therapy.

Furthermore, a doctor is not prohibited from keeping medicines in stock that are required for the treatment contract. Such use by the doctor also includes the provision of small quantities of a medicine for self-taking if (i) the direct connection with the treatment in the surgery and (ii) medical supervision are ensured.

These requirements were not met here; the defendant doctor unlawfully interfered with the pharmacy reservation by providing patients with not small quantities (namely a whole month’s supply) of the medicinal product, including injection devices, for the purpose of self-injection over several weeks without any medical supervision.
The main proceedings following the interim injunction have not yet been concluded, but the conclusive reasoning of the Supreme Court in the summary proceedings does not suggest a different outcome.

unyer Health Care & Life Science Working Group
Barbara Kuchar
Beatrice Blümel

1. Background

On May 7, 2024, Regulation (EU) 2024/1106, better known as “REMIT II“, came into force. This marks the first amendment to REMIT, the Regulation on Wholesale Energy Market Integrity and Transparency, which has been in force since early 2012. The adoption of REMIT II is part of the European package of measures to reform the electricity market design. This European package aims to utilise the experiences gained during the energy crisis to achieve long-term stabilisation of the electricity markets.

The most important changes introduced by REMIT II are as follows:

2. Extension of the scope of application

REMIT II changes the definition of wholesale energy products. Both contracts for the supply of LNG and storage contracts are now included. Additionally, REMIT II includes contracts for the supply of electricity and derivatives related to electricity which may result in a delivery in the Union as a result of single day-ahead and intraday coupling in the electricity sector. For trading orders placed in a third country participating in the Union’s single day-ahead and intraday coupling, the optimal matching of bids may result in a contract for the supply of electricity for delivery within the Union. The legislator clarifies that these contracts shall also be subject to the REMIT regulatory regime.

The existence of a wholesale energy product is the essential prerequisite for the applicability of the market abuse prohibitions and reporting obligations. By changing this definition, the legislator expands the scope of their applicability.

Additional elements are introduced in the provisions on market manipulation and insider trading. The regulation expands the list of actions that potentially fulfil the provisions on market abuse, introducing additional alternatives. REMIT II also introduces catch-all provisions to address previous difficulties in subsuming certain trading practices under the legal provisions. These amendments align REMIT with financial market regulation, which served as a model for the wholesale energy markets’ protection regime in 2011.

 3. Harmonisation of fines

The practice of setting fines varies significantly among Member States, particularly regarding the amounts imposed. In recent years, fines have ranged from low four-digit amounts to tens of millions. With REMIT II, the legislator goes further in intervening in national sanction laws than before. REMIT I stipulated that sanctions must be effective, dissuasive, and proportionate, considering the nature, duration and seriousness of the infringement, the damage to consumers, and the potential gains resulting from trading. REMIT II substantiates this requirement: the regulation raises the upper limit of fines by setting maximum amounts for fines that a Member State must at least provide for the fining of a violation. For example, for market manipulation, the national regulatory authority must be able to impose a fine of at least 15% of the annual total turnover in the preceding financial year against a legal entity. In future, fines of at least up to 5 million euros can be imposed on a natural person. This requirement contains a clear mandate to the Member States to increase the maximum amounts provided for under their national laws.

4. Strengthening cooperation between authorities

According to the REMIT concept, a broad information base is essential for enforcing the prohibition of abuse. To this end, REMIT II strengthens cooperation between national authorities. In particular, it promotes the sharing of information, which is intended to close information gaps at individual authorities. However, REMIT II does not only focus on energy regulators, but also takes supervisory authorities from other markets into consideration. For example, the exchange of information between financial and energy regulators will be intensified.

5. New powers for ACER

In addition to its market surveillance function, ACER can also investigate suspected cases with cross-border relevance on the basis of REMIT II. The reason behind this change was the realisation that market abuse is increasingly taking place across borders. In the past, difficulties have arisen in prosecution when determining responsibilities. ACER’s involvement creates new capacities for investigating suspected cases. Under REMIT II, for example, ACER is authorised to carry out on-site inspections, request information, and impose penalty payments to enforce the investigative measures. However, the right to sanction violations remains exclusively with national regulatory authorities.

6. Expansion of reporting obligations

REMIT II expands existing reporting obligations and introduces new ones. For example, the reporting obligation for persons professionally arranging transactions is expanded. In future, they will no longer only have to report suspicious transactions, but also suspicious trading orders. With the expansion of the definition of wholesale energy products, existing reporting obligations are correspondingly expanded. REMIT II also implements additional reporting obligations, for example, for operators of algorithmic trading. These changes must be taken into account when (re-)organising internal reporting processes.

7. Algorithmic trading

REMIT I, which came into force in 2012, did not yet contain any regulations on algorithmic trading. This type of trading has increased significantly in recent years, partially surpassing manual trading. Due to its relevance, ACER clarified in its application guideline that trading by means of algorithms can also fall under abuse prohibitions.

REMIT II contains additional requirements for the resilience of algorithms. Market participants must design their algorithms to avoid causing disruptions in the market. REMIT II also stipulates monitoring and documentation obligations. Market participants engaging in algorithmic trading are also required to notify the national regulatory authority and ACER. The national regulatory authority can request specific evidence from market participants. Therefore, the newly introduced retention periods must be particularly observed.

8. Need for action

Market participants must immediately review and, if necessary, adjust their trading and reporting processes and internal compliance regulations to the new legal framework. The amended regulations regularly require significant adjustments to established practice, which demand time and resources. In light of the stricter sanctions, these adjustments must be carried out all the more carefully.

 

unyer Working Group Energy / Infrastructure
Lilith Boos
Dr Holger Stappert
Manuel Tomas

The safety of medical devices is of utmost importance for the health of patients around the world. Numerous regulations, particularly by the European Commission, are therefore commonplace in this industry. Just recently, the EU launched the AI Act to regulate artificial intelligence, with further requirements explicitly for the manufacture of medical devices. However, while the authorisation of medical devices is based on complex international standards, subsequent liability due to any product defects has not yet been part of international legislation. Medtech companies that sell their products on the German market should therefore obtain an overview of national liability law.

Neither the European Medical Devices Regulation nor the German Medical Device Law Implementation Act (MPDG) contain regulations on product liability. In fact, the industry-independent German Act on Liability for Defective Products and the German Civil Code are actually the basis for liability claims.

The Act on Liability for Defective Products is the key liability base. It provides for a no-fault claim for damages by the injured party if they have suffered physical damage due to a design, instruction or manufacturing defect. Damages due to defective monitoring of the product after market entry are not covered.

Proving a mistake is the key of product liability litigation. In principle, the injured party must pro-vide evidence that the product was defective. In practice, however, this is not an overly strict standard, as even a basic presentation of the relevant circumstances places a secondary burden of proof on the manufacturer. It is then up to the manufacturer to demonstrate that its product is in order.

However, this product liability does not only apply to traditional end-manufacturers, but also to companies that claim to be the manufacturer of a product by affixing their trade mark or that im-port a product into the European Economic Area. Even distributors can be held liable. In the event of a justified claim, they are obliged to name the manufacturer. If the manufacturer cannot be identified, the distributor is itself liable.

In addition to liability due to a product defect, fault-based liability of all market players in accordance with the general provisions of tort law must also be considered. In particular, this can also be used to assert a breach of a product monitoring obligation even after market launch.

Companies in the medtech sector should therefore protect themselves with a detailed documentation. This certainly begins with the manufacturing process due to the extensive EU regulations, but should by no means end with market authorisation. Admittedly, German law does not provide for such high compensation payments as in the USA, for example. Nevertheless, the conditions for a claim are quickly met and, in particular, are not linked to fault by the manufacturer.

 

Dr. Christoph von Burgsdorff, LL.M. (University of Essex)
Working Group Healthcare & Life Science

Luisa Kramer
Working Group Healthcare & Life Science