By: Alessandro Galtieri, VP for corporate law and group data protection officer of Colt Group.

After the United Kingdom voted to leave the European Union, I wrote an ACCDocket.com article entitled "Top 10 Brexit Considerations for In-house Counsel." Recently, I had been asked to revisit it in light of what has happened since 2016. It's worth rereading the article, but for time's sake, these are my two most critical recommendations:

  • Don't panic. It will take at least two years to take effect, but start preparing; and,
  • When preparing, involve all parts of the organisation, such as sales, HR, ops, finance, and, of course, legal.

What has happened in the last two years? To be blunt, not much. Initially, I (and many other in-house counsel) thought that, at this stage, the separation negotiations would've begun and the areas of agreement would've been decided. Because of unforeseen complications in internal British politics, there has instead been little progress in the negotiations between the United Kingdom and the other member states of the European Union.

It's also unlikely that there will be more clarity between now and the end of the year. In fact, the situation may become even more muddled, as there might be another referendum and/or another General Election, with unforeseeable outcomes and consequences.

For all practical purposes, there are two scenarios for which in-house counsel should prepare. The first was deemed implausible, but it increasingly looks conceivable. It's the so-called "no deal" scenario. In it, the United Kingdom notified its intention to leave the European Union on the 30 March 2017. By simple application of the relevant EU treaties, the United Kingdom will automatically cease to be a Member State on 30 March 2019.

[Related: Brexit and Beyond: A New Cross-Border Landscape]

The consequences of this scenario could be bad for the EU economy and catastrophic for the United Kingdom. A number of activities that UK-based organisations perform daily would become impossible overnight. They include travelling to other EU states without a visa, purchasing or selling any sort of goods or services tariff-free, and offering professional services cross-border. The consequences are so severe that the United Kingdom has not created plans to mitigate the impact, possibly because they seem futile.

There is very little that we as in-house counsel can do to prepare for such a scenario. We can, however, analyse the possible consequences. If your organisation cannot recruit, trade, or export data as usual, this report could reveal drastic changes to its operations (e.g., closing down, moving to the European Union or another country).

But how can you identify consequences? The European Union has published a number (65 to date) of "notices to stakeholders" that are available here. These explain what it will mean for the United Kingdom to become a "third country" (i.e., not a Member State), and are divided by economic activity or specialist subject. I strongly suggest looking for the ones regarding your organisation's field of activity, then use them to make an assessment of the impact of Brexit on your operations. They cover everything from energy consumption to industrial chemicals, aviation to vehicle manufacturing, and more.

[Related: What Brexit Means for Multinational Employers]

I would also suggest examining the whole list, as there may be impact where you least expect it. Does your UK-based organisation own its European trademarks? They may no longer be recognised. Does it hold any .eu domain names? It will no longer be able to, and it may need to transfer them to an EU affiliate. Does it offer web-based services to EU customers? Other member states may now geo-block those services from their territory.

There are more examples, including some admittedly a bit academic. In theory, UK-incorporated companies may lose the recognition of their limited liability nature and its shareholders may become directly liable in the European Union.

I will only mention three outcomes that will impact most EU and UK organisations:

1. Financial services

The European Union has stressed that UK financial institutions won't be able to freely sell their services in the European Union. This could impact you not only if that's what you do, but also if you're EU-based and suddenly your funding becomes inaccessible, harder to arrange, more expensive, or all of the above.

2. Staffing

It's not just travelling for existing staff that's at risk. After two years, the United Kingdom has yet to clarify what rights (if any) that EU citizens will maintain to live and work in the United Kingdom. The procedures to obtain residency rights are yet to be determined, as well as how employers can recruit EU nationals or if work visas will be required. A solution may well be found, but it will certainly make life more difficult for everyone who needs to recruit or deploy talent on an EU/UK matrix, compared to today's frictionless regime where EU nationals are equal to UK ones.

3. Data Protection

The Data Protection aspect is also increasingly important, as GDPR has now been enforced. If personal data cannot freely be transferred between the United Kingdom and the European Union, every organisation with an HQ in the United Kingdom may not be able to transfer information on its EU-based employees (and vice-versa). How that would affect companies that base their business activity on data transfer (e.g., Facebook and Google, as well as healthcare or insurance organisations) is anyone's guess.

[Related: GDPR: Implications from the New Normal]

This scenario seems extreme but possible. The most likely outcome might be that a minimum-content deal is reached, whereby the United Kingdom retains most (although not all) of its existing ability to access the rest of the EU markets for a transitional period. The duration of this period has been agreed in principle by the European Union, and it is to last until December 2020. After this time, the details of the new and permanent relationship between the European Union and the United Kingdom should be fixed in new treaties and agreements.

The problem is that this is an enormous task, and preparations should have started already but haven't. The "end-state" is therefore likely to be a diluted version of the access that the United Kingdom enjoys today, but with some clear exclusions. However, it's still uncertain what the United Kingdom may be able to negotiate.

Studying and staying updated on the EU Commissions notices is critical, because they'll likely be the best description of the 2019/20 situation. There is, of course, the chance that the United Kingdom may be able to negotiates better transition terms, and that they may be valid also from 1 January 2021. But we don't know what these terms may be, and that day is less than three years away.

As in-house counsel, you know how quickly today's business landscape is changing - from cybersecurity breaches to shifting international regulations. The Association of Corporate Counsel is here to help you navigate these new challenges and opportunities. Download an exclusive compilation of fifteen of the most popular ACC Docket articles on risk management authored by in-house counsel, for in-house counsel, and gain complimentary access to tools to do your job better, easier and faster.