Data rules for genomic and clinical analysis

Which part a machine can check

Almost every requirement splits the same way. A machine can see whether a record exists, when it was made, whether its fields are filled, whether a deadline was met, whether a value is on a list. Whether the requirement applies, and whether what was done is enough, is left to a person.

Label	Means
Machine-checkable	A machine can check it from records or code: a field is present, a date is in order, a value is on a list.
Partly machine-checkable	A machine can check the form; whether the requirement applies, or whether what was done is enough, needs a person.
Needs a person	Only a person can judge it; the text gives nothing a record could be compared against.
Binding law	A statute or regulation. Binding.
Guidance	Guidance or a statement of principles from an authority. Not binding in itself; authorities and inspectors apply it.
Draft	A draft or consultation version. Not yet adopted; its wording may change.

Requirement	A machine can check	A person must judge
Transformations in analysis must be traceable, and outputs tied to the programs that produced them EU clinical trials Partly machine-checkable	Whether each output links to its inputs, the program version and the run record, with timestamps.	Whether that trail is sufficient for the analysis it supports.
Every creation and change of electronic trial data needs an audit trail EU clinical trials Partly machine-checkable	That the trail exists, is time-stamped in an unambiguous time zone, has no gaps, and cannot be edited or switched off by ordinary users.	Whether the trail is readable by a person and actually reviewed.
The sponsor must never hold the only copy — and a distributed ledger is named as one way to show it EU clinical trials Partly machine-checkable	Whether an independent copy or ledger entry exists for each record, and when it was made.	Whether the measure actually precludes sole control, and whether its justification holds.
Processing at the point of data capture must be possible to validate — and no method is given EU clinical trials Partly machine-checkable	Whether a validation record exists for the capture step and names the version that ran.	What validation is enough: the text sets no method.
Migrated data must be verified — checksums are given as an example EU clinical trials Partly machine-checkable	Checksums and record counts before and after the migration.	Quality control of the records, and whether the plan addressed the risks that mattered.
Changes to the trial master file must be traceable — this one is binding law EU clinical trials Partly machine-checkable	Whether every change to the file is recorded with what changed, who changed it and when.	Whether the archive will still be readable in 25 years.
Using AI to produce evidence: the EMA and FDA principles ask for traceable, verifiable provenance EU clinical trials Partly machine-checkable	Whether a provenance record exists for each data source, processing step and model version.	Whether the analytical decisions recorded were sound.
Part 11 requires audit trails that never obscure what was there before United States Partly machine-checkable	Whether entries are time-stamped and earlier values remain visible after a change.	Whether the trail is "secure".
Electronic signatures must be bound to their records so they cannot be moved to another United States Partly machine-checkable	Whether each signature covers a hash of the record it signs.	Whether the binding holds against "ordinary means" in the system as actually run.
Genomic data on more than 100 US persons may not go to a country of concern — and a Swiss company is reached indirectly United States Partly machine-checkable	How many distinct US persons a dataset covers, and which country a recipient is in.	Whether a counterparty is a covered person, and whether an arrangement amounts to evasion.
Reusing coded genetic data for research needs consent; coded non-genetic data does not Switzerland — research and signatures Partly machine-checkable	Whether every use of a coded record matches a consent, objection or withdrawal on file for that identifier.	Whether the information given beforehand was sufficient.
Whether re-analysing sequence data on a computer is a "genetic test" is not settled Switzerland — research and signatures Needs a person	Nothing the text defines.	Whether a given computational analysis is a test under the Act.
A Swiss qualified signature is not yet recognised as qualified in the EU Switzerland — research and signatures Partly machine-checkable	Whether a signature is qualified under ZertES or eIDAS, checked against the trust lists.	What weight it carries before a court or authority in the other jurisdiction.
Erasure and append-only records pull in opposite directions EU data protection and cyber security Partly machine-checkable	Whether genetic data, or pseudonyms that can be reversed, are written to an append-only store at all.	Whether a value on the store is personal data for a given recipient, and whether the research exception applies.
A hash of personal data is still personal data — keep personal data off the chain EU data protection and cyber security Partly machine-checkable	Whether on-chain hashes are keyed or salted, and what each on-chain field is derived from.	Whether the underlying data are personal data, and whether a salt is strong enough.
Genetic data is personal data by default, and "anonymous" is a claim regulators are testing EU data protection and cyber security Partly machine-checkable	How many records carry a combination of attributes unique to one person.	Whether linkage or inference remains possible.
Large-scale genetic data needs an impact assessment before processing starts EU data protection and cyber security Partly machine-checkable	That an assessment exists and is dated before processing began.	Whether the processing is "large scale" — and which national list applies.
The record of processing activities, and why small organisations are not exempt here EU data protection and cyber security Machine-checkable	Whether every required field of the record is filled in.	Whether what the record says is true — outside what a check of the record can see.
Breaches: 72 hours to notify — and a genetic-data fine for weak security and late notice EU data protection and cyber security Partly machine-checkable	The time between becoming aware and notifying, whether a breach register exists, and whether encryption and multi-factor authentication are configured.	How high the risk is, and whether the security level matches it.
A controller outside the EU processing genetic data at scale needs an EU representative EU data protection and cyber security Partly machine-checkable	Whether a written designation exists.	Whether Article 3(2) applies at all.
Cyber Resilience Act: actively exploited vulnerabilities reported within 24 hours since 2026-09-11 EU data protection and cyber security Partly machine-checkable	The time between becoming aware of an exploited vulnerability and the early warning.	Whether a vulnerability is actively exploited, and whether the supplier is a manufacturer, a steward or neither.
Large-scale sensitive data: log every access, and keep the log a year, apart from the system Switzerland — data protection Partly machine-checkable	Whether each log entry records who, what, when and to whom; whether logs are kept a year, separately from the system; whether the processing regulation exists and when it was last updated.	Whether processing is "large scale" and whether preventive measures alone are insufficient — the law gives no number.
Impact assessments and breach notices under the FADP: no hour count, but health data presumed high-risk Switzerland — data protection Partly machine-checkable	Whether an assessment exists and its dates; the time from detection to notice.	Whether the processing is "extensive" and the risk "high".
Disclosure abroad: a list a machine can check, and safeguards it cannot Switzerland — data protection Partly machine-checkable	Whether each destination is on the 44-entry list, and for the US whether the recipient is certified.	Whether the safeguards for any other country are adequate, or whether an Art. 17 exception applies.
No free-standing right to erasure — but data must be destroyed or anonymised once no longer needed Switzerland — data protection Partly machine-checkable	Whether a retention period is declared and deletion or anonymisation is recorded on time; whether an express consent is on file.	Whether the data are still "needed", and whether a hash kept in an append-only record is personal data.

What moved, and what is coming

2025-12-01 done

Swiss DSV Art. 4(1): the logging duty covers access to the data, not only reading.

2025-12-18 done

US Public Law 119-60, section 851 (commonly called the BIOSECURE Act), enacted.

2026-02-13 done

French Conseil d'État: pseudonymised data are anonymous only where re-identification risk is insignificant.

2026-05-26 done

CNIL fines IQVIA €5 million over health data it called anonymous.

2026-06-30 done

Swiss e-ID launch postponed; no new date.

2026-07-07 done

EDPB blockchain guidelines final (v2.0); anonymisation guidelines open for consultation.

2026-09-11 applying now

Cyber Resilience Act reporting obligations apply.

2026-09-28 done

Council adopts its first-reading position on the EU pharmaceutical package, which amends the Clinical Trials Regulation.

2026-10-01 done

Advocate General in C-12/25: a legible strike-through is not erasure.

2026-10-30 not yet

EDPB consultation on the anonymisation guidelines closes.

2027-01-15 not yet

ICH E6(R3) Annex 2 applies in the EU. FDA still lists it as draft; no Swiss date found.

2027-04-02 not yet

GDPR procedural regulation (EU) 2025/2518 applies to new cross-border cases.

2027-12-11 not yet

Cyber Resilience Act reporting duty for open-source stewards starts.

EU clinical trials

ICH E6(R3) as applied in the EU, the EMA guideline on computerised systems, the Clinical Trials Regulation

Transformations in analysis must be traceable, and outputs tied to the programs that produced them

ICH E6(R3), in force in the EU since 2025-07-23, puts traceability of data processing on the sponsor. Section 3.16.2(c) covers transformations and derivations; 3.16.2(f) asks that outputs be traceable to the statistical software programs, dated and time-stamped, and protected against changes. FDA finalised the same principles and Annex 1 on 2025-09-09, and Switzerland applies them through its Clinical Trials Ordinance from 2025-08-15. Of everything on this page, this is the requirement that a record of output hashes plus execution conditions answers most directly.

“The sponsor should ensure the traceability of data transformations and derivations during data processing and analysis.”

Binds: Sponsor
A machine can check: Whether each output links to its inputs, the program version and the run record, with timestamps.
A person must judge: Whether that trail is sufficient for the analysis it supports.

Guidance Partly machine-checkable Source re-checked ICH E6(R3) 3.16.2(c) · 3.16.2(f) EMA page for ICH E6(R3) Good Clinical Practic... Federal Register 2025-17311 — FDA final guida... Swissmedic — introduction of ICH E6(R3) in Sw...

Every creation and change of electronic trial data needs an audit trail

The EMA guideline on computerised systems in clinical trials asks for an audit trail on the original creation and every later modification of electronic data — secure, computer-generated and time-stamped — that ordinary users cannot switch off (section 6.2.1). ICH E6(R3) adds that audit trails should not be disabled and that dates and times should be unambiguous, giving coordinated universal time as its example (4.2.2).

“An audit trail should be enabled for the original creation and subsequent modification of all electronic data.”

Binds: Owner of the computerised system — sponsor, investigator or service provider
A machine can check: That the trail exists, is time-stamped in an unambiguous time zone, has no gaps, and cannot be edited or switched off by ordinary users.
A person must judge: Whether the trail is readable by a person and actually reviewed.

Guidance Partly machine-checkable Source re-checked EMA/INS/GCP/112288/2023 6.2.1 · ICH E6(R3) 4.2.2 EMA guideline on computerised systems and ele... EMA page for ICH E6(R3) Good Clinical Practic...

The sponsor must never hold the only copy — and a distributed ledger is named as one way to show it

Section 6.6 of the same guideline: all data the sponsor holds should be verifiable against a copy not held by the sponsor. A system run by an independent service provider is the usual answer; instead, the sponsor may take other technical measures that preclude sole control, and the guideline gives as its example verifiability of transactions by an independent, distributed, tamper-proof ledger, which should be justified and documented. It is the only place in the European clinical-trial texts we have read that names such a ledger.

“The sponsor should not have exclusive control of the data entered in a computerised system at any point in time.”

Binds: Sponsor
A machine can check: Whether an independent copy or ledger entry exists for each record, and when it was made.
A person must judge: Whether the measure actually precludes sole control, and whether its justification holds.

Guidance Partly machine-checkable Source re-checked EMA/INS/GCP/112288/2023 6.6 EMA guideline on computerised systems and ele...

Processing at the point of data capture must be possible to validate — and no method is given

Section 4.4, on source data: when processing is an integral part of capturing data and the unprocessed data are not kept, it should be possible to validate that the processing worked correctly. The guideline gives no method. The sentence concerns processing during capture, before data are recorded — not analysis pipelines in general — and we do not read it wider than that.

“It should be possible to validate the correct operation of the processing.”

Binds: Sponsor and system owner
A machine can check: Whether a validation record exists for the capture step and names the version that ran.
A person must judge: What validation is enough: the text sets no method.

Guidance Partly machine-checkable Source re-checked EMA/INS/GCP/112288/2023 4.4 EMA guideline on computerised systems and ele...

Migrated data must be verified — checksums are given as an example

When data move from an old system to a new one, validating the migration deserves no less attention than validating the system, and the guideline names checksums, case counts and quality control of records as ways to verify the migrated data (section 6.10).

“any foreseen possibilities that may exist to verify the migrated data (e.g. checksum, case counts, quality control of records)”

Binds: System owner
A machine can check: Checksums and record counts before and after the migration.
A person must judge: Quality control of the records, and whether the plan addressed the risks that mattered.

Guidance Partly machine-checkable Source re-checked EMA/INS/GCP/112288/2023 6.10 EMA guideline on computerised systems and ele...

Changes to the trial master file must be traceable — this one is binding law

The Clinical Trials Regulation is directly applicable law. Article 58 requires the master file to be archived for at least 25 years after the end of the trial and any alteration to its content to be traceable. The EU pharmaceutical package, on which the Council adopted its first-reading position on 2026-09-28, amends this Regulation; the amendment was not in the Official Journal on 2026-10-03.

“Any alteration to the content of the clinical trial master file shall be traceable.”

Binds: Sponsor and investigator
A machine can check: Whether every change to the file is recorded with what changed, who changed it and when.
A person must judge: Whether the archive will still be readable in 25 years.

Binding law Partly machine-checkable Source re-checked Regulation (EU) No 536/2014 Art. 58 Regulation (EU) No 536/2014 on clinical trial... Council of the EU — Commission communication ...

Using AI to produce evidence: the EMA and FDA principles ask for traceable, verifiable provenance

EMA and FDA published ten guiding principles for AI in drug development in January 2026. The sixth asks that data provenance, processing steps and analytical decisions be documented in a traceable and verifiable way. It is a statement of principles, not a regulation. FDA's draft guidance on using AI to support regulatory decisions for drugs and biologics (FDA-2024-D-4689) was still a draft on 2026-10-04.

“Data source provenance, processing steps, and analytical decisions are documented in a detailed, traceable, and verifiable manner”

Binds: Developers and users of AI that produce evidence for regulators
A machine can check: Whether a provenance record exists for each data source, processing step and model version.
A person must judge: Whether the analytical decisions recorded were sound.

Guidance Partly machine-checkable Source re-checked EMA-FDA guiding principles, principle 6 · FDA-2024-D-4689 (draft) EMA and FDA — guiding principles of good AI p... FDA draft guidance FDA-2024-D-4689 — AI to su...

United States

FDA Part 11 and guidance, and the Department of Justice rule on bulk genomic data

Part 11 requires audit trails that never obscure what was there before

21 CFR Part 11 is binding for electronic records kept under FDA requirements. Section 11.10(e) requires secure, computer-generated, time-stamped audit trails, and record changes must not obscure previously recorded information. Since its 2003 scope-and-application guidance, which is still final and unrevised, FDA has said it will exercise enforcement discretion on the audit-trail requirements. In clinical investigations, FDA's 2024 question-and-answer guidance on electronic systems is the operative text.

“Record changes shall not obscure previously recorded information.”

Binds: Anyone keeping electronic records under FDA requirements
A machine can check: Whether entries are time-stamped and earlier values remain visible after a change.
A person must judge: Whether the trail is "secure".

Binding law Partly machine-checkable Source re-checked 21 CFR 11.10(e) 21 CFR Part 11 — electronic records and signa... FDA guidance — Part 11 scope and application ... FDA Q&A — electronic systems, records and sig...

Electronic signatures must be bound to their records so they cannot be moved to another

Section 11.70 requires electronic and handwritten signatures executed to electronic records to be linked to those records so that they cannot be excised, copied or otherwise transferred to falsify a record by ordinary means. A signature computed over a hash of the record is one way to meet the shape of this requirement.

“cannot be excised, copied, or otherwise transferred to falsify an electronic record by ordinary means”

Binds: Anyone keeping electronic records under FDA requirements
A machine can check: Whether each signature covers a hash of the record it signs.
A person must judge: Whether the binding holds against "ordinary means" in the system as actually run.

Binding law Partly machine-checkable Source re-checked 21 CFR 11.70 21 CFR Part 11 — electronic records and signa...

Genomic data on more than 100 US persons may not go to a country of concern — and a Swiss company is reached indirectly

The Department of Justice rule (28 CFR Part 202) treats human genomic data on more than 100 US persons as bulk data, and prohibits US persons from providing it to countries of concern. Switzerland is not one. The duties fall on US persons, but the prohibition on evasion (section 202.304) is not limited to them, and US customers can be expected to ask their non-US counterparties for the onward-transfer clauses of section 202.302. Separately, section 851 of Public Law 119-60, enacted on 2025-12-18 and commonly called the BIOSECURE Act, restricts federal contracts, grants and loans involving listed biotechnology companies; the Department of Defense's section 1260H list published on 2026-06-10 includes BGI Group, MGI Tech, WuXi AppTec and Novogene.

Binds: US persons; their non-US counterparties by contract
A machine can check: How many distinct US persons a dataset covers, and which country a recipient is in.
A person must judge: Whether a counterparty is a covered person, and whether an arrangement amounts to evasion.

Binding law Partly machine-checkable Source re-checked 28 CFR 202.205(a) · 202.302 · 202.303 · 202.304 · 202.601 · Pub. L. 119-60 §851 28 CFR Part 202 — access to US sensitive pers... US Department of Justice — Data Security Prog... Public Law 119-60 (National Defense Authoriza... Federal Register 2026-11571 — Department of D...

Switzerland — research and signatures

Human Research Act, Genetic Testing Act, ZertES

Whether re-analysing sequence data on a computer is a "genetic test" is not settled

The Genetic Testing Act defines genetic tests as cytogenetic and molecular-genetic examinations and all other laboratory examinations (GUMG Art. 3(a)), and leaves tests done for research on human diseases and on the structure and function of the human body to the Human Research Act (Art. 2(4)). Neither provision says whether computational re-analysis of existing sequence data is a test. We have found no authority that answers it.

Binds: Anyone performing or ordering genetic tests
A machine can check: Nothing the text defines.
A person must judge: Whether a given computational analysis is a test under the Act.

Binding law Needs a person Source re-checked GUMG Art. 2(4) · GUMG Art. 3(a) Genetic Testing Act (GUMG), SR 810.12, versio...

A Swiss qualified signature is not yet recognised as qualified in the EU

ZertES, the Swiss electronic signature act, is unchanged since 2020; its technical rules were updated on 2025-11-01. Mutual recognition with the EU's eIDAS is at the stage of preparing a negotiating mandate, and the federal office writes that an agreement before the end of 2026 is unlikely. The Swiss e-ID, once expected on 2026-12-01, was postponed on 2026-06-30 with no new date; the state trust infrastructure is planned for the first half of 2027.

“ein Abschluss eines Abkommens vor Ende 2026 … wenig wahrscheinlich”

Binds: Anyone relying on a Swiss qualified signature in the EU
A machine can check: Whether a signature is qualified under ZertES or eIDAS, checked against the trust lists.
A person must judge: What weight it carries before a court or authority in the other jurisdiction.

Binding law Partly machine-checkable Source re-checked ZertES · eIDAS Federal Act on Electronic Signatures (ZertES)... Federal Office of Communications — electronic... Federal Department of Justice and Police — e-... Federal Office of Justice — e-ID launch postp...

EU data protection and cyber security

GDPR, EDPB guidelines, Cyber Resilience Act

A hash of personal data is still personal data — keep personal data off the chain

The EDPB's guidelines on blockchain became final (version 2.0) on 2026-07-07, with the key paragraphs unchanged from the consultation version. A hash of personal data is itself personal data, and unsalted or unkeyed hashes are in general not sufficient (§52). Personal data in clear, encrypted or hashed form should be stored off-chain (§104). Rather than personal data, it is better to store on-chain a pointer, a cryptographic commitment or a hash generated with a keyed hash function (§54); once the original data and its witness are deleted, a perfectly hiding commitment can no longer be linked back to them (§53). Guidelines are not law, but supervisory authorities apply them.

“the hash will also be considered personal data”

Binds: Controllers writing values derived from personal data to a blockchain
A machine can check: Whether on-chain hashes are keyed or salted, and what each on-chain field is derived from.
A person must judge: Whether the underlying data are personal data, and whether a salt is strong enough.

Guidance Partly machine-checkable Source re-checked EDPB Guidelines 02/2025 v2.0 §52 · §53 · §54 · §104 EDPB Guidelines 02/2025 on processing of pers...

Genetic data is personal data by default, and "anonymous" is a claim regulators are testing

The EDPB's draft guidelines on scientific research (1/2026, consultation version) say genetic profiles are personal data by default and that the risk reaches relatives, permanently (§165, §167). Its draft guidelines on anonymisation (02/2026, consultation until 2026-10-30) set three tests: no record isolation (no combination of attributes unique to one person), no linkage, and no inference. In May 2026 the French authority fined IQVIA €5 million after rejecting its argument that pseudonymised health data were anonymous; in February 2026 the Conseil d'État held that pseudonymised data count as anonymous only where the risk of re-identification is insignificant.

“Genetic data profiles are considered to be personal data by default”

Binds: Controllers claiming data are anonymous
A machine can check: How many records carry a combination of attributes unique to one person.
A person must judge: Whether linkage or inference remains possible.

Draft Partly machine-checkable Source re-checked EDPB Guidelines 1/2026 §165 (draft) · EDPB Guidelines 02/2026 (draft) EDPB Guidelines 1/2026 on processing for scie... EDPB Guidelines 02/2026 on anonymisation — co... CNIL — €5 million fine against IQVIA over hea... Conseil d'État, decision n° 498628, 2026-02-13

Cyber Resilience Act: actively exploited vulnerabilities reported within 24 hours since 2026-09-11

Manufacturers of products with digital elements placed on the EU market must send an early warning within 24 hours and a notification within 72 hours; Article 14 applies from 2026-09-11, and ENISA's single reporting platform opened that day. Supplying free and open-source software that is not monetised is not a commercial activity; open-source stewards carry Article 24 duties without fines (Art. 64(10)), and their reporting duty starts on 2027-12-11.

“Article 14 shall apply from 11 September 2026”

Binds: Manufacturers; open-source stewards from 2027-12-11
A machine can check: The time between becoming aware of an exploited vulnerability and the early warning.
A person must judge: Whether a vulnerability is actively exploited, and whether the supplier is a manufacturer, a steward or neither.

Binding law Partly machine-checkable Source re-checked CRA Art. 14 · Art. 24 · Art. 64(10) · Art. 71(2) Regulation (EU) 2024/2847 (Cyber Resilience A... European Commission — Cyber Resilience Act re... European Commission — Cyber Resilience Act an...

Switzerland — data protection

Federal Act on Data Protection (FADP / DSG) and its ordinance (DSV)

Large-scale sensitive data: log every access, and keep the log a year, apart from the system

Private controllers and processors that process sensitive data — genetic data included — on a large scale, where preventive measures alone cannot protect it, must log at least storage, modification, disclosure, deletion and destruction, and, since 2025-12-01, access to the data (DSV Art. 4(1); the word was previously "reading"). Logs are kept for at least one year, separately from the system (Art. 4(5)). Article 5 adds a processing regulation that must be kept regularly up to date. An append-only record is the natural shape of such a log. Two of our checking agents disagreed on whether this requirement is machine-checkable: the log's fields, retention and separation are; whether the duty applies at all is not.

“zumindest das Speichern, Verändern, Bekanntgeben, Löschen und Vernichten der Daten sowie das Zugreifen auf die Daten protokollieren”

Binds: Private controllers and processors of sensitive data at large scale
A machine can check: Whether each log entry records who, what, when and to whom; whether logs are kept a year, separately from the system; whether the processing regulation exists and when it was last updated.
A person must judge: Whether processing is "large scale" and whether preventive measures alone are insufficient — the law gives no number.

Binding law Partly machine-checkable Source re-checked DSV Art. 4(1) · 4(4) · 4(5) · Art. 5 Data Protection Ordinance (DSV), SR 235.11, v...

Impact assessments and breach notices under the FADP: no hour count, but health data presumed high-risk

An impact assessment is required for extensive processing of sensitive data (DSG Art. 22(2)(a)) and kept for at least two years after processing ends (DSV Art. 14). A breach likely to cause high risk is notified to the Federal Data Protection and Information Commissioner "as soon as possible" (Art. 24(1)) — there is no fixed number of hours, unlike the GDPR's 72 — and the Commissioner's guide says that for health and biometric data a high risk is to be assumed in many cases. Separately, the operators listed in the Information Security Act — among them health institutions on a cantonal hospital list and laboratories licensed under the Epidemics Act — must report cyber attacks meeting its criteria within 24 hours of discovery (ISG Art. 74b, 74d, 74e).

“so rasch als möglich”

Binds: Controllers; processors inform the controller
A machine can check: Whether an assessment exists and its dates; the time from detection to notice.
A person must judge: Whether the processing is "extensive" and the risk "high".

Binding law Partly machine-checkable Source re-checked DSG Art. 22(2)(a) · Art. 24(1) · DSV Art. 14 · ISG Art. 74b · 74d · 74e Federal Act on Data Protection (DSG), SR 235.... Data Protection Ordinance (DSV), SR 235.11, v... FDPIC guide on data security breaches, v1.2 (... Information Security Act (ISG), SR 128, versi... Regulation (EU) 2016/679 (GDPR), Official Jou...

Disclosure abroad: a list a machine can check, and safeguards it cannot

Personal data may go abroad without further safeguards only to countries the Federal Council lists as adequate (DSG Art. 16(1), DSV Annex 1): 44 entries, last changed on 2024-09-15, with the United States limited to companies certified under the Swiss-US Data Privacy Framework. Elsewhere, the safeguards of Art. 16(2) are needed, unless one of the exceptions in Art. 17 applies, such as consent or a contract with the person concerned. Data from the EU to Switzerland need no transfer instrument: the EU's adequacy decision for Switzerland was confirmed on 2024-01-15.

Binds: Controllers and processors disclosing personal data abroad
A machine can check: Whether each destination is on the 44-entry list, and for the US whether the recipient is certified.
A person must judge: Whether the safeguards for any other country are adequate, or whether an Art. 17 exception applies.

Binding law Partly machine-checkable Source re-checked DSG Art. 16(1) · 16(2) · Art. 17 · DSV Annex 1 Federal Act on Data Protection (DSG), SR 235.... Federal Office of Justice — countries with ad... FDPIC — EU adequacy decision regarding Switze...

Where this touches our own design

Where these requirements touch our own design. This is our reading of our own position, published so it can be checked and contradicted; no authority has agreed with it.

Facts we state about ourselves

Our provenance records are append-only and identify outputs by hash. They hold hashes of analysis outputs and of execution conditions.
We plan to sign records with ZertES. Until mutual recognition with eIDAS exists, such a signature is not a qualified signature in the EU.
Our assessment code is published under the MIT licence.
A check we build against these requirements would report the machine part and hand the human part to a person. It would never output "compliant": there is no field for that word.

What we have not resolved

We publish these rather than pick an answer, because we have found no authority that has answered them.

Is a hash of an analysis output derived from human genomic data personal data? The EDPB says a hash of personal data is; whether an output such as a count matrix is personal data is the open step. (EDPB 02/2025 §52 · GDPR Art. 4(1))
If it is, can an append-only record that holds it meet an erasure request, given the Advocate General's reading in C-12/25? (GDPR Art. 17 · DSG Art. 6(4))
Under the Cyber Resilience Act, are we a manufacturer, an open-source steward, or neither? (CRA Art. 24 · Art. 64(10))
Is computational re-analysis of existing sequence data a genetic test under the Swiss Genetic Testing Act? (GUMG Art. 3(a))

Sources

Everything above resolves to one of these. The last column says whether a machine watches the source for changes, and if not, why not.

Source	Kind	Checked	Watch
EMA page for ICH E6(R3) Good Clinical Practice, with Annex 1, Annex 2 and the consolidated text https://www.ema.europa.eu/en/ich-e6-good-clinical-practice-scientific-guideline	official-guidance	2026-10-03	watched
Federal Register 2025-17311 — FDA final guidance E6(R3) and Annex 1, 2025-09-09 https://www.federalregister.gov/documents/2025/09/09/2025-17311	primary	2026-10-03	fixed once published
Swissmedic — introduction of ICH E6(R3) in Switzerland https://www.swissmedic.ch/swissmedic/en/home/news/mitteilungen/einfuehrung-leitlinie-ich-gcp-e6-r3.html	official-guidance	2026-10-03	watched
EMA guideline on computerised systems and electronic data in clinical trials, EMA/INS/GCP/112288/2023 https://www.ema.europa.eu/en/documents/regulatory-procedural-guideline/guideline-computerised-systems-and-electronic-data-clinical-trials_en.pdf	official-guidance	2026-10-03	watched
Regulation (EU) No 536/2014 on clinical trials, Official Journal https://eur-lex.europa.eu/eli/reg/2014/536/oj	primary	2026-10-04	watched
Council of the EU — Commission communication COM(2026) 527 recording the Council position on the pharmaceutical package, adopted 2026-09-28 https://data.consilium.europa.eu/doc/document/ST-13768-2026-INIT/en/pdf	primary	2026-10-04	fixed once published
EMA and FDA — guiding principles of good AI practice in drug development, 2026-01 https://www.ema.europa.eu/en/documents/other/guiding-principles-good-ai-practice-drug-development_en.pdf	official-guidance	2026-10-03	watched
FDA draft guidance FDA-2024-D-4689 — AI to support regulatory decision-making for drugs and biologics https://www.fda.gov/regulatory-information/search-fda-guidance-documents/considerations-use-artificial-intelligence-support-regulatory-decision-making-drug-and-biological	official-guidance	2026-10-03	watched
21 CFR Part 11 — electronic records and signatures (eCFR) https://www.ecfr.gov/current/title-21/chapter-I/subchapter-A/part-11	primary	2026-10-03	watched
FDA guidance — Part 11 scope and application (2003) https://www.fda.gov/regulatory-information/search-fda-guidance-documents/part-11-electronic-records-electronic-signatures-scope-and-application	official-guidance	2026-10-03	watched
FDA Q&A — electronic systems, records and signatures in clinical investigations (FDA-2017-D-1105) https://www.fda.gov/regulatory-information/search-fda-guidance-documents/electronic-systems-electronic-records-and-electronic-signatures-clinical-investigations-questions	official-guidance	2026-10-03	watched
US Department of Justice — Data Security Program (28 CFR Part 202) https://www.justice.gov/nsd/data-security	official-guidance	2026-10-03	watched
28 CFR Part 202 — access to US sensitive personal data by countries of concern (eCFR) https://www.ecfr.gov/current/title-28/chapter-I/part-202	primary	2026-10-04	watched
Public Law 119-60 (National Defense Authorization Act), section 851 — BIOSECURE https://www.congress.gov/119/plaws/publ60/PLAW-119publ60.pdf	primary	2026-10-03	fixed once published
Federal Register 2026-11571 — Department of Defense list, 2026-06-10 https://www.federalregister.gov/documents/2026/06/10/2026-11571	primary	2026-10-03	fixed once published
Human Research Act (HFG), SR 810.30, version of 2023-09-01 https://www.fedlex.admin.ch/eli/cc/2013/617/de	primary	2026-10-04	watched
Human Research Ordinance (HFV), SR 810.301, version of 2024-11-01 https://www.fedlex.admin.ch/eli/cc/2013/642/de	primary	2026-10-04	watched
swissethics — announcement of the genomic research information and consent template, 2025-11-11 https://swissethics.ch/news/2025/11/11/information-und-einwilligung-fuer-genomische-forschung	official-guidance	2026-10-03	fixed once published
swissethics — General Consent documents page https://swissethics.ch/en/documents/generalkonsent	official-guidance	2026-10-03	watched
Federal Office of Public Health — revision of the Human Research Act https://www.bag.admin.ch/de/humanforschung-revision-hfg-stfg	official-guidance	2026-10-03	watched
Federal Office of Public Health — overview of human research regulation in Switzerland https://www.bag.admin.ch/de/die-regelung-der-humanforschung-in-der-schweiz	official-guidance	2026-10-04	watched
Genetic Testing Act (GUMG), SR 810.12, version of 2025-08-01 https://www.fedlex.admin.ch/eli/cc/2022/537/de	primary	2026-10-04	watched
Federal Office of Communications — electronic signature (ZertES) and recognition with the EU https://www.bakom.admin.ch/de/elektronische-signatur	official-guidance	2026-10-03	watched
Federal Act on Electronic Signatures (ZertES), SR 943.03, version of 2020-01-01 https://www.fedlex.admin.ch/eli/cc/2016/752/de	primary	2026-10-04	watched
Federal Department of Justice and Police — e-ID launch expected 2026-12-01, 2026-02-25 https://www.bj.admin.ch/de/newnsb/L6Nbf7gStnDm	official-guidance	2026-10-04	fixed once published
Federal Office of Justice — e-ID launch postponed, 2026-06-30 https://www.bj.admin.ch/de/newnsb/4ZNYpSk3J1-U	official-guidance	2026-10-03	fixed once published
Regulation (EU) 2016/679 (GDPR), Official Journal https://eur-lex.europa.eu/eli/reg/2016/679/oj	primary	2026-10-04	watched
Regulation (EU) 2025/2518 — GDPR procedural rules https://data.europa.eu/eli/reg/2025/2518/oj	primary	2026-10-03	watched
Court of Justice press release — Advocate General's opinion in C-12/25, 2026-10-01 https://curia.europa.eu/site/upload/docs/application/pdf/2026-10/cp260139en.pdf	official-guidance	2026-10-03	fixed once published
EDPB Guidelines 02/2025 on processing of personal data through blockchain technologies, version 2.0 https://www.edpb.europa.eu/system/files/2026-07/edpb_guidelines_202502_blockchain_v2_en.pdf	official-guidance	2026-10-03	watched
EDPB Guidelines 1/2026 on processing for scientific research — consultation version https://www.edpb.europa.eu/public-consultations/guidelines-12026-on-processing-of-personal-data-for-scientific-research_en	official-guidance	2026-10-03	watched
EDPB Guidelines 02/2026 on anonymisation — consultation version https://www.edpb.europa.eu/public-consultations/guidelines-022026-on-anonymisation_en	official-guidance	2026-10-03	watched
CNIL — €5 million fine against IQVIA over health data, 2026-05 https://www.cnil.fr/en/health-data-fine-5-million-euros-against-iqvia	official-guidance	2026-10-03	fixed once published
Conseil d'État, decision n° 498628, 2026-02-13 https://www.conseil-etat.fr/fr/arianeweb/CE/decision/2026-02-13/498628	primary	2026-10-03	fixed once published
Netherlands — list of processing requiring a DPIA (Stcrt. 2019-64418) https://zoek.officielebekendmakingen.nl/stcrt-2019-64418.html	official-guidance	2026-10-03	fixed once published
Germany — DSK list of processing requiring a DPIA, version 1.1 (2018) https://www.datenschutzkonferenz-online.de/media/ah/20181017_ah_DSK_DSFA_Muss-Liste_Version_1.1_Deutsch.pdf	official-guidance	2026-10-03	fixed once published
Spain — AEPD list of processing requiring a DPIA (2019) https://www.aepd.es/sites/default/files/2019-09/listas-dpia-en-35-4.pdf	official-guidance	2026-10-03	fixed once published
AEPD decision PS/00140/2025 — 23andMe https://www.aepd.es/documento/ps-00140-2025.pdf	official-guidance	2026-10-03	fixed once published
European Commission — Cyber Resilience Act reporting obligations https://digital-strategy.ec.europa.eu/en/policies/cra-reporting	official-guidance	2026-10-03	watched
European Commission — Cyber Resilience Act and open source https://digital-strategy.ec.europa.eu/en/policies/cra-open-source	official-guidance	2026-10-03	watched
Regulation (EU) 2024/2847 (Cyber Resilience Act), Official Journal https://eur-lex.europa.eu/eli/reg/2024/2847/oj	primary	2026-10-04	watched
Data Protection Ordinance (DSV), SR 235.11, version of 2025-12-01 https://www.fedlex.admin.ch/eli/cc/2022/568/de	primary	2026-10-04	watched
Federal Act on Data Protection (DSG), SR 235.1, version of 2025-07-07 https://www.fedlex.admin.ch/eli/cc/2022/491/de	primary	2026-10-04	watched
Information Security Act (ISG), SR 128, version of 2025-10-01 https://www.fedlex.admin.ch/eli/cc/2022/232/de	primary	2026-10-04	watched
FDPIC guide on data security breaches, v1.2 (2025-04-23) https://www.edoeb.admin.ch/de/leitfaden-data-breach	official-guidance	2026-10-03	watched
Federal Office of Justice — countries with adequate data protection (DSV Annex 1) https://www.bj.admin.ch/de/schweizerische-anerkennung-von-staaten-die-einen-angemessenen-datenschutz-gewaehrleisten	official-guidance	2026-10-03	watched
FDPIC — EU adequacy decision regarding Switzerland confirmed, 2024-01-15 https://www.edoeb.admin.ch/en/15012024-eu-adequacy-decision-regarding-switzerland	official-guidance	2026-10-03	fixed once published
FDPIC annual reports (33rd report, 2026-06-30) https://www.edoeb.admin.ch/de/taetigkeitsbericht-des-edob	official-guidance	2026-10-03	fixed once published

Not legal advice. This is a reading of published texts by the people who build GenomicsChain. It locates requirements; it does not say that anyone meets them. It creates no advice relationship and should not be relied on in place of a qualified opinion.

How this page is maintained. Monthly. Every claim below carries the date it was checked. The underlying research corpus is docs/reports/regcheck_20261003/ in the open-source assessment repository — nine seat reports in Japanese and four verification reports in English, with every source URL and check date. Working-file paths and housekeeping remarks were removed from seven of them before publication.

Found an error? Tell us — corrections are recorded in the dataset with the date they were made.

Revisions.

v0.1.0 · 2026-10-04 — First version. Built from the 2026-10-03 agent-team check of EU clinical-trial rules, US rules, Swiss research law, EU data protection, the GDPR and the Swiss data protection act. Before publication, independent checking agents found and this version corrects: a Council citation that did not show the adoption date; an unsupported clause about expected FDA finalisation; "BIOSECURE" used as if it were the statutory name; an over-broad "no opt-out for genetics" (anonymisation for research is opt-out, HFG Art. 32(3)); the ISG reporting duty attributed to the wrong article and stated too broadly; transfers abroad stated without the Art. 17 exceptions; the FDPIC's research-reuse view stated more strongly than the report; EDPB §53 described as a preference; the first anonymisation test misnamed; the Dutch and Spanish DPIA lists misdescribed; "two fines" where one decision is cited; and a CRA quotation attributed to pages that do not carry it. The seven Swiss statutes are watched through the fedlex SPARQL endpoint's list of consolidated versions, so claims resting on them can be re-checked by machine; until this change they were carried as unwatchable. The three EU acts it rests on (GDPR, Clinical Trials Regulation, Cyber Resilience Act) are watched through the Publications Office Cellar list of versions, corrigenda and amending acts.