Why "Automatic Copyright" Is No Longer Enough in 2026

In March 2025, a Basel-based UX agency delivered a full brand identity to a Series A startup before the contract was countersigned. Two weeks later, the startup's new in-house designer claimed the work as their own. The agency had timestamped emails and Dropbox folders with file dates they assumed would hold up. They did not. File system dates are easily manipulated. Email headers can be spoofed. The startup's lawyers had one question: prove you created this first. The agency had no answer that satisfied the standard of proof.

That dispute cost the agency CHF 38,000 in legal fees before a settlement was reached, a settlement that reflected not what happened but what could be documented. They had created the work. They could not prove it in a way that shifted the burden of proof to the other side.

Automatic Copyright Is Real. Enforcement Is Not.

Automatic copyright under the Berne Convention (181 member states) gives you the legal right the moment you create something. What it does not give you is evidence. In 2026, the absence of certified evidence is increasingly the difference between a right you can enforce and one you cannot.

The legal protection automatic copyright provides is only as strong as your ability to prove three things: when you created the work, what it looked like at that moment, and that it was yours. All three are harder to establish now than at any previous point in legal history. The tools to challenge them have never been more sophisticated.

The Three Threats Every Creator Faces Today

Threat 1: The AI Training Problem

AI models, including image generators, music composers, code assistants, and writing tools, are trained on large datasets. Some of that data is licensed. Some is scraped. Some is contributed by users who accept broad terms of service granting AI training rights without reading them.

If your unreleased work is shared digitally before it is properly protected (sent to a collaborator, uploaded to a cloud platform, included in a presentation), it may be processed by systems that use it for AI training. When an AI subsequently generates something that resembles your work, proving that you are the original creator requires establishing exactly when your work existed in its current form.

Without a certified timestamp, you have no credible prior art. Your claim of copyright exists in the law, but not in evidence.

Threat 2: The Collaborative Dispute

Modern creative and technical work is collaborative. Beats, hooks, architectural concepts, software designs, and business methodologies circulate via WhatsApp, Dropbox, and WeTransfer long before contracts are signed or formal agreements are in place.

Without an objective record of who contributed what and when, "my work" becomes "our version of events" the moment something becomes commercially valuable. This is the most common form of IP dispute. Two people worked on something together. It succeeded. Now each claims a larger share. The absence of contemporaneous documentation means the dispute is settled by negotiation, with the better-documented party having more bargaining power, regardless of what actually happened.

Threat 3: The Due Diligence Wall

Investors, label groups, acquirers, and strategic partners have become significantly more rigorous about IP provenance. The reason is straightforward: IP disputes that emerge post-acquisition or post-investment are expensive, distracting, and in some cases, deal-breaking.

The due diligence question is no longer just "do you own this?" It is: "Can you prove the ownership chain, back to creation, with documentation that would hold up if challenged?" A creator or startup that cannot answer that question cleanly is a higher-risk asset. That translates directly into lower valuations, extended deal timelines, and increased warranty and indemnity requirements.

Why "Timestamp" Is Not Enough

The instinct to use a timestamp as proof is correct. The challenge is that most readily available timestamps are not credible as legal evidence.

File system timestamps are easily manipulated. Email send dates can be spoofed. Screenshot dates can be falsified. Version control commit timestamps, while harder to forge in isolation, are internal records that sophisticated parties can challenge.

What the law requires, in Switzerland under ZertES (SR 943.03), in the EU under eIDAS, and before courts generally, is a timestamp issued by an accredited, independent certification authority, using cryptographic methods that make retroactive alteration detectable. That is what a qualified electronic timestamp provides.

The ZertES and eIDAS Framework

ZertES, Switzerland's federal law on electronic signatures (SR 943.03), defines the conditions under which an electronic timestamp carries legal presumption before Swiss courts. Article 2 requires the timestamp to be issued by a BAKOM-accredited certification service provider (ZDA).

eIDAS, EU Regulation 910/2014, Article 41, does the same for the EU-27: a qualified electronic timestamp carries a legal presumption that the data is accurate and the time is correct. The challenger must rebut this presumption, not the creator prove it.

Swisscom Trust Services is simultaneously a ZertES-accredited ZDA and an eIDAS-qualified trust service provider (QTSP) on the EU Trust List. Every seal created through Swiss Trust Layer is anchored to Swisscom's infrastructure, satisfying both frameworks with a single document.

What the Basel Agency Would Have Had

If the Basel UX agency had sealed their brand identity deliverable before sending it to the client, the outcome would have been different from the first call with the startup's lawyers. The seal would have produced a PAdES-compliant certificate showing the exact SHA-256 hash of every design file, the Swisscom-certified timestamp of creation, and the agency's verified identity, all in a form carrying legal presumption under ZertES. The startup's in-house designer would have had to disprove that certificate, not the agency prove its version of events. The dispute would not have lasted long enough to cost CHF 38,000.

How Automatic Copyright Becomes Enforceable Copyright

The process takes under two minutes:

1. Upload your file. Any format: design file, code, document, PDF, image. The file is not stored. Only its SHA-256 cryptographic hash is processed. Nothing leaves your control.
2. Receive a certified timestamp. Swisscom Trust Services anchors the hash to a certified timestamp. The timestamp is immutable and externally verifiable. It cannot be backdated.
3. Store your certificate. You receive a PAdES-compliant certificate containing the hash, the timestamp, the issuer chain, and your identity. This is your proof.
4. Verify publicly. Anyone, a lawyer, a judge, an investor, can verify your seal at swisstrustlayer.com/validate without login, without contacting you. The system confirms: this exact file existed in this exact form at this certified time.

The Practical Minimum

You do not need to seal everything. You need to seal the right things before you share them. The moment any creative or technical work leaves your exclusive control, the window for establishing uncontested prior art closes. Once someone else has seen or potentially replicated your work, your claim becomes contested. Seal before you share. Every time.

The Math the Basel Agency Did Not Do

The Basel agency settled for an outcome they did not earn, at a cost of CHF 38,000, because they could not prove what they had made. That is not a comparison of products. The Berne Convention gives you copyright automatically. Enforcement is your job. Start at swisstrustlayer.com.

---

See also: ZertES: qualified timestamp protection · eIDAS Art. 41: EU protection