Compliance Model 231 reform: what businesses need to know after Cabinet approval.

On 4 August 2026 the Government approved the bill reforming corporate administrative liability. Organisational fault becomes the sole basis for attributing liability, the burden of proof shifts to the prosecution, new grounds for extinguishing the offence are introduced, and simplified procedures arrive for SMEs. Meanwhile, the catalogue of predicate offences keeps growing: Article 30 of Legislative Decree 81/2008 (workplace health and safety) has already changed. For any organisation with an existing Compliance Model 231, 2026-2027 is the right window to act.

A reform twenty-five years in the making.

Legislative Decree 231/2001 (Italy's corporate criminal liability regime) turns twenty-five and is facing its first comprehensive overhaul. The process originates from the technical working group set up at the Ministry of Justice (decree of 7 February 2024) and coordinated by Giorgio Fidelbo, a presiding judge at the Supreme Court. The work, launched on 12 June 2024 and concluded on 30 October 2025, produced a roughly seventy-page report and a draft text, delivered to the Minister in December 2025 and published in January 2026. Throughout 2026 the text was discussed with Confindustria, Confcommercio, Assonime, the Association of Supervisory Board Members, and the accountants' national 231 Observatory.

The decisive step came on 4 August 2026: on a proposal from Justice Minister Carlo Nordio, the Cabinet approved the reform bill. Three watchwords stand out: organisational fault as the sole basis for attributing liability, expanded grounds for extinguishment, and strengthened compliance models and guidelines.

A caveat before getting into the detail: this is still a bill. It must pass through Parliament and, for some parts, require the exercise of legislative delegated powers. Until then, Legislative Decree 231/2001 remains in force in its current form.

Organisational fault: from a defence for the company to an element of the offence.

This is the heart of the reform. Today Article 6 effectively reverses the burden of proof for offences committed by senior managers: it is the company that must show it adopted a suitable compliance model, that the offender fraudulently circumvented it, and that there was no failure of supervision. Under the reform, organisational fault is no longer a ground for exemption but a constitutive element of the offence: the burden of proof therefore shifts to the prosecution.

The distinction between offences committed by senior managers and by subordinates also disappears: organisational fault becomes the sole criterion of subjective liability. The company is liable only if a causal link is established between the failure to adopt - or the ineffective implementation of - a model suited to preventing that type of offence, and the commission of the offence itself.

In practice, the public prosecutor will need to identify the specific organisational shortcoming, the missing or breached preventive rule, the risk that rule was meant to govern, and the causal chain linking the gap to the offence. It will no longer be enough to argue that, because the offence occurred, the model must have been inadequate. Correspondingly, the company is not liable if the offence was unforeseeable or unavoidable even with diligent organisation: an isolated individual act, incompatible with the control system, falls outside the scope of liability.

Note the counterweight for negligence-based offences: for these, a presumption of interest or advantage to the company is introduced whenever non-compliance with operational rules has produced an appreciable cost saving or increased output.

The Compliance Model becomes more prescriptive - and more defensible.

The reform defines the essential content of the Compliance Model, the procedure for its adoption and revision, and the criteria courts must use to assess its adequacy. Two presumptions change the defence strategy:

• 01models compliant with trade association guidelines are presumed adequate: a court wishing to depart from this must give specific reasons for finding them unsuitable;
• 02in the field of workplace health and safety, models built on the UNI ISO standard are presumed compliant, with exempting effect.

For SMEs, a decree of the Minister of Justice will set out simplified procedures for adopting and implementing the Compliance Model: the first organic set of rules dedicated to smaller businesses, together with proportionate reductions in sanctions.

The common thread is clear: the Compliance Model must be assessed as an integrated prevention system - risk assessment, protocols, information flows to the Supervisory Board, effective training, an operational disciplinary system, controls that are actually applied - rather than as a stack of documents.

Extinguishment of liability: a probationary scheme for companies.

The new Article 8-bis introduces a post-offence reward mechanism. Within 90 days of being served notice of the conclusion of investigations, the company may request time to remedy the shortcomings identified by the prosecutor: by submitting a reorganisation proposal, offering compensation, indicating remedial actions, and making the illicit profit available. The judge assesses the proposal under Article 127 of the Code of Criminal Procedure and, if the company complies, declares by judgment that the offence is extinguished, without prejudice to confiscation of the profit.

The benefit is not available to everyone. It requires a Compliance Model already adopted and implemented before the offence, meeting the requirements of Article 6, an effectively functioning Supervisory Board, and gaps that are actually remediable: a partially inadequate model can be salvaged, a sham one cannot. The mechanism, moreover, cannot be used more than twice for offences arising from an intentional crime.

Other grounds for extinguishment are added: withdrawal of a criminal complaint and the offence being of particularly minor gravity, where the company's wrongdoing is an isolated occurrence; in environmental matters, extinguishment following certified remediation of the shortcoming (new Article 318-septies.1 of the Environmental Code); and in tax matters, extinguishment conditional on certified remediation and full payment of the amount due (new Article 13-bis.1 of Legislative Decree 74/2000). On limitation periods, two alternative options remain on the table: alignment with the limitation period of the predicate offence, or a single six-year period suspended once judgment is handed down at first instance.

What has already changed, reform aside.

Those waiting for parliamentary passage risk losing sight of adjustments that are already required.

Workplace safety. Since 7 April 2026 a new version of Article 30 of Legislative Decree 81/2008 has been in force (Law 34/2026), placing greater emphasis on record-keeping, allocation of functions, and an explicit disciplinary system applicable also to senior managers. INAIL (the national workplace-injury insurer) must produce simplified models for SMEs within 120 days of entry into force.

EU restrictive measures. Legislative Decree 211/2025, implementing Directive (EU) 2024/1226, introduced new Articles 275-bis et seq. of the Criminal Code and new Article 25-octies.2 of Legislative Decree 231/2001. The novelty lies in sanctions: for these offences, the fine is calculated as a percentage of the company's global turnover, between 0.5% and 5%, departing from the usual unit-based system, with disqualification orders of up to six years for offences committed by senior managers.

Artificial intelligence. The draft decree implementing Regulation (EU) 2024/1689 (the AI Act), given preliminary approval on 10 June 2026, introduces Article 437-bis of the Criminal Code - failure to adopt safety measures in high-risk AI systems and unlawful tampering with such systems - and new Article 25-vicies of Legislative Decree 231/2001, dedicated to offences committed using AI systems, which also references the deepfake offence under Article 612-quater of the Criminal Code introduced by Law 132/2025.

Whistleblowing. On 14 May 2026 Confindustria published its updated operational guide on Legislative Decree 24/2023: paragraph 9 expressly calls for coordination between the whistleblowing framework and the Compliance Model 231.

What to do now: five priorities.

• 01Verify the existence and date of the pre-offence Compliance Model: this will be the gateway condition for the new grounds of extinguishment. A model adopted and implemented before the fact, with an effective Supervisory Board, becomes a defensive asset of measurable value.
• 02Rebuild traceability: activity records, Supervisory Board minutes, evidence of training, and concrete application of the disciplinary system. In proceedings centred on causation, documentation is the proof of effectiveness.
• 03Align safety practices with the new Article 30 and with UNI ISO 45001: the presumption of compliance rewards those who structure their management system to the standard, not those who stop at minimum procedures.
• 04Update risk assessments to cover the new perimeters: EU restrictive measures, professional use of high-risk AI systems, tax, and cyber are the areas where the catalogue of predicate offences has expanded most.
• 05Integrate whistleblowing with the Compliance Model: channels, roles, protections and the relationship with the Supervisory Board should be spelled out in the Model, not left to parallel procedures.

Leexè's view.

The reform shifts the centre of gravity from form to substance. Those who built their Compliance Model as a paperwork exercise may find that their defence no longer holds: the prosecution will need to identify a specific shortcoming, but this will be all the easier to prove the more the system is a facade. Those who invested in real organisation gain three advantages instead: the presumption of adequacy tied to industry guidelines, access to the probationary scheme with extinguishment of liability, and, for smaller entities, simplified procedures and proportionate sanctions.

The months of parliamentary passage are a useful window for an orderly gap assessment, before the new rules become the yardstick for judgment. Leexè supports companies and organisations in reviewing Compliance Models 231, reorganising information flows to the Supervisory Board, and updating the special sections covering new predicate offences.

This article is for information purposes only and does not constitute legal advice. The bill approved on 4 August 2026 is not yet law and its content may change during the parliamentary process. Updated as of August 2026.

Copyright Leexè 2026 | riproduzione riservata