Client updates / Regulation

On August 5, 2026, the Israel Securities Authority (ISA) published a new draft directive issued under the Regulation of Investment Advice, Investment Marketing and Portfolio Management Law of 1995, which will supersede its 2011 directive and allow licensees to publicize past returns on portfolios for the first time. Public comments will be accepted until September 4, 2026.

On July 26, 2026, the Israeli Capital Market, Insurance and Savings Authority published a policy document for implementing a reform in the guarantee market, along with a draft update to the licensing procedure for regulated financial services and supplementary draft circulars. Public comments were accepted until August 16, 2026 and discussions of the comments will be held on September 7, 2026.

At the end of June 2026, in the Afikim Water case, Israel’s Supreme Court for the first time set out a clear test for calculating financial sanctions under the Consumer Protection Law. The CPFTA quickly adopted the ruling in a legal statement and temporary enforcement directive, changing how sanctions are calculated in practice. This unusual speed suggests the authority attributes considerable significance to the judgment.

Article 50 of the EU AI Act has applied since 2 August 2026 and imposes transparency obligations requiring organizations to make clear when individuals are interacting with AI or are being exposed to AI-generated or AI-manipulated content. It applies to providers and deployers of certain AI systems, including generative and interactive AI systems and deepfakes.

Amendment 74 to the Consumer Protection Law introduces, for the first time, obligations to record sales-related conversations, retain those recordings, and provide them to consumers upon request. The amendment applies to certain transactions listed in the law where the transaction value exceeds ILS 750, or where the price is unknown at the time of the call.

Israel’s Privacy Protection Authority (PPA) has published the final version of its position statement on the appointment of a data protection officer (DPO). Although, formally speaking, it is only a position statement rather than binding guidance, it is expected to have a significant practical impact on the PPA’s supervision and enforcement going forward.

The upcoming corporate credit database is expected to significantly affect Israel’s business credit market, expand credit data use, increase competition and access to credit, and require financial and other entities to prepare for reporting or relying on the database.

The reform expands options for importers, manufacturers, and marketers in Israel by lowering barriers and creating an additional route for products that meet the statutory conditions. However, it does not grant broad relief, since eligibility remains subject to conditions, exceptions, and documentation requirements, and compliance with applicable Israeli law must still be reviewed. Businesses should therefore prepare in advance to identify qualifying products, required documents, and points of interaction with existing Israeli regulation.

On June 29, 2026, the Ministry of Finance and the Capital Market, Insurance and Savings Authority published a draft bill for public comment until July 20, 2026, which, for the first time in Israel, would establish a specific licensing and supervisory framework for stablecoin issuers.

An Israeli District Court imposed personal liability, jointly and severally, on the directors of a company for trademark infringement, without lifting the corporate veil. Whenever a tort is committed, including intellectual property infringement, any officer or director who personally committed the tort may be ordered to pay out of his or her own pocket, even without lifting the corporate veil.

For the first time, Israel’s Supreme Court has established a clear test for calculating financial sanctions under the Consumer Protection Law, depending on whether the conduct constitutes a single act or multiple separate acts.

On June 12, 2026, Anthropic announced that the US government had ordered it to immediately suspend foreign nationals’ access to its advanced AI models, Fable 5 and Mythos 5, pursuant to an export control directive issued on national security grounds.

Following progress on the Omnibus legislative package, the European Commission has published draft guidelines on the classification of high-risk AI systems. While not legally binding, the draft guidelines provide an early indication of how the Commission is likely to interpret and apply the AI Act’s risk-based framework in practice.

Installing a “robot” for algorithmic trading and defining its parameters is not deemed a “technological service” but may constitute investment portfolio management, which requires a license. This is because the service provider retains material discretion (choice of platform, transaction volume, profit and loss targets, and risk management), even when the account and funds are in clients’ names.

The European Parliament has announced that agreement has been reached on the Digital Omnibus proposal for changes in the EU AI Act. Although still subject to completion of the formal legislative process, these changes represent a significant regulatory development and provide greater clarity as to the direction of EU AI legislation.

At the end of April 2026, the Israel Securities Authority (ISA) published a new draft directive regulating the activities of licensed investment advisors and marketers when providing one-off services and services in relation to alternative assets. The purpose of the directive is to reduce information asymmetries and mitigate potential conflicts of interest identified during ISA audits that, in some instances, even resulted in enforcement proceedings.

In March 2026, the Ministry of Economy and Industry published a draft bill to replace the current dual-use export control orders with comprehensive primary legislation. The proposed law aims to broaden regulatory oversight and establish a more effective, modern framework for controlling exports of civilian, nuclear, biological, and chemical items.

The Israeli Privacy Protection Authority (PPA) has published a position paper clarifying its interpretation of Regulation 2(4) regarding the transfer of personal data abroad. In this context, it emphasizes the requirements applicable to organizations transferring data outside of Israel, including to the United States.

In its final position statement, the PPA presents a stricter interpretation of the law that more closely aligns with the approach used in European law (the GDPR), under which data subjects must issue active, free, and informed consent. At the same time, the PPA limits the possibilities of relying on the concept of “tacit consent” found in the law.

The draft National Cybersecurity Law was published in January 2026. This significant regulatory measure is likely to have broad implications for organizations across the economy, especially digital service providers and entities that provide technological infrastructure.