News · 24 October 2026

Compliance 231: recent cases put controls back at the centre of the business

From supply chains to public incentives, and the regulatory changes of 2026: why adopting an organisational model is only the starting point.

Compliance 231: documents, controls and responsibilities must work as a single system.

A statement filed to obtain a public incentive. A supplier that moves production to an unauthorised workshop. A check required by a procedure, but of which no trace remains.

Compliance enters the life of a company through concrete decisions. That is why the question a director should ask goes beyond whether a Model 231 exists: who checks the most sensitive steps, what information do they receive, and what happens when an anomaly emerges?

Two recent cases and the regulatory changes of 2026 show how current that question is.

Decree 231 in brief, for international readers

Italian Legislative Decree 231/2001 makes companies and other legal entities liable for certain offences committed in their interest or to their advantage by their managers or employees. The liability is formally administrative, but it is established in criminal proceedings. The sanctions can include fines, temporary bans on activity and the confiscation of profits.

An entity can avoid or reduce that liability if, before the offence, it adopted and effectively implemented an organisational model suited to preventing offences of that kind, and if an independent supervisory body (the Organismo di Vigilanza) oversaw its operation. The law applies to companies established in Italy, and the list of relevant offences is extended from time to time, as the 2026 changes below show.

Public incentives: the risk lies in the declarations

On 23 April 2026 the Guardia di Finanza announced a preventive seizure, in Italy and the Netherlands, of more than 55 million euros. The investigation concerns alleged public funds unlawfully obtained for photovoltaic plants built in the province of Caserta.

The press release also reports a charge under Legislative Decree 231/2001 against the company involved and its Dutch parent. This is a precautionary measure at the preliminary investigation stage: not a final conviction.

The case points to an organisational problem that affects many companies: how are the requirements declared to obtain grants, subsidies and financing checked?

A sound control should make it possible to reconstruct who prepared the application, which documents prove the requirements, who verified the information and who authorised the submission. Entrusting the file to an outside consultant makes it even more important to clarify responsibilities and controls.

The fashion supply chain: knowing a supplier on paper is not enough

On 14 July 2025 the Carabinieri announced the execution of a judicial administration order against a high-fashion company. According to the investigators' reconstruction, the critical issues concerned the ability to verify working conditions and the production structure of the companies involved in the supply chain, through contracting and subcontracting.

Here too, the distinction between investigative hypotheses and established liability must be respected. In addition, judicial administration is a different instrument from the liability of entities governed by Decree 231.

The organisational link is nonetheless relevant. In its 2025 Management Programme, the Court of Milan describes recovery paths for fashion companies in which the updating of 231 models goes together with stronger compliance and internal audit.

For a commissioning company, the reflection is immediate: a contractual clause must be matched by the ability to know the supply chain, check anomalies and intervene. Who really produces? Are times and prices consistent with the work required? Who authorises subcontracting? What follow-up do audit findings receive?

In 2026 the perimeter of risks also changes

Alongside the judicial cases, regulatory changes are already in force.

Legislative Decree no. 211 of 30 December 2025, effective from 24 January 2026, introduced into Decree 231 article 25-octies.2, on offences of violating the restrictive measures of the European Union. For the offences concerned, the measure also provides for penalties calculated as a percentage of the entity's worldwide turnover. This criterion applies to the cases set out in the law: not to all 231 violations.

For companies exposed to these risks, the update requires examining counterparties, transactions, authorisations and relevant controls. Adding the name of a new offence to the list attached to the model does not, by itself, solve the operational problem.

Legislative Decree no. 81 of 21 April 2026, in force since 2 June, has instead transposed the European directive on the criminal protection of the environment. Article 8 amends article 25-undecies of Decree 231, changing the offences covered and the penalties.

The practical consequence is the need to verify, according to the activities actually carried out, whether the mapping of environmental risks and the related protocols are still adequate.

The model must leave traces of how it works

Article 6 of Legislative Decree 231/2001 already distinguishes the adoption of the model from its effective implementation. For offences committed by senior managers, the law also considers supervision, updating and further conditions: holding the document does not grant automatic exemption from liability.

For company management, this translates into verifiable work: identifying exposed activities, assigning responsibilities, applying controls, circulating information and following corrective actions through to their closure.

Technology can help connect documents, checks, deadlines and decisions. Professional judgement remains essential to assess risks, choose safeguards and verify that they work.

The useful question, therefore, is very concrete: if tomorrow we had to reconstruct a sensitive decision, could we show which controls we actually carried out?

Sources

This article is informative and does not replace professional advice on a specific case.

All news and videos Talk to us