A law that every company pays for and almost no one knows
Ask an entrepreneur what the "231 model" is and he will answer with a grimace: a binder of procedures, a supervisory body (Organismo di Vigilanza) to be paid, a consultancy invoice that returns with every update. Ask a citizen and he will not know what you are talking about. And yet Legislative Decree no. 231 of 8 June 2001 is, from an economic point of view, the most successful piece of legislation in contemporary Italian criminal law. It has generated a dedicated practice in every large law firm in the country; an association of supervisory-body professionals with more than one thousand six hundred members; a scholarly journal that has lived off this single subject for more than twenty years; management software, university master's courses, a continuous cycle of conferences, international certifications in which Italy holds — we shall see with what irony — the world record.
The paradox this series documents is that such commercial fortune is matched by meagre judicial application, a body of case law that has remained poor at its essential core and — twenty-five years on — the absence of precisely what the law was meant to produce: a recognisable standard of good organisation, telling companies, before rather than after, what it means to organise themselves well. Before measuring the market (that will be the second part) and asking whether the party is about to end (the third), we must understand what we are talking about. That is the purpose of this part: it is the "didactic" section of the investigation, written for those outside the trade — but the professional reader will find in it, as a watermark, all the uncomfortable questions that will follow.
Where it comes from: the fall of a dogma, under external pressure
For almost two centuries Italian criminal law repeated a textbook dogma: societas delinquere non potest — the company cannot commit a crime. Individuals were punished: the director, the manager, sometimes the unlucky middle manager who had signed the wrong document; the entity, at most, was jointly liable for payment of the fine. Criminal law stopped at the organisation's door, and inside the organisation — where the decisions, the incentives, the omissions that generate economic crimes take shape — no one entered.
The dogma did not fall through an internal rethinking of Italian legal culture. It fell under external pressure, within an international wave that started in the United States: the Foreign Corrupt Practices Act of 1977, which was the first to take international corporate bribery seriously, and above all the federal Organizational Sentencing Guidelines of 1991, which invented the modern exchange between punishment and compliance — the company that equips itself with an "effective" prevention programme pays less, much less. In that wake, in 1997, the OECD countries signed the Convention against the bribery of foreign public officials: Article 2 requires States to provide for the liability of legal persons, Article 3 demands "effective, proportionate and dissuasive" sanctions. It is the same Convention whose Article 5 — the prohibition on bending investigations to the national economic interest — readers of this blog have already encountered in the series on the Eni trial. It is no chance crossing, and it is worth keeping in mind: Decree 231 was born of the same treaty with whose observance Italy is today, once again, under special watch.
The Italian answer came with enabling law no. 300 of 2000 and with the Legislative Decree of 8 June 2001, no. 231: "Rules on the administrative liability of legal persons". Administrative in name — a label chosen to get round Article 27 of the Constitution, which requires criminal liability to be personal — but criminal in almost everything else: the wrong depends on a criminal offence, its determination falls to the criminal judge, in the criminal trial, with the guarantees of the criminal trial. Legal scholars long debated a "fraud of labels"; the Joint Chambers, many years later, would cut the matter short by speaking of a tertium genus, a third kind that is neither the one thing nor the other. Whatever one calls it, the substance is one: for the first time in Italian history, the company as such can be called to answer before the criminal judge for offences committed within it and in its favour.
The flood of the catalogue
The decree was born cautious. The original catalogue of "predicate offences" — the offences of the natural person from which the entity's liability can be triggered — contained few figures: undue receipt of public funds, fraud against the State, bribery and extortion by a public official (concussione). Indeed, the delegated legislator deliberately stopped short of the enabling law, which would have allowed the immediate inclusion of workplace-safety and environmental offences as well: too risky, it was said, for an institution just born.
Then came the flood. Year after year, every emergency and every European obligation has deposited a new layer in the decree: false corporate reporting (2002), offences with terrorist purposes (2003), market abuse (2005), negligent homicide and negligent bodily harm through violation of accident-prevention rules (2007), handling of stolen goods and money laundering (2007), computer crimes (2008), organised-crime offences (2009), environmental offences (2011), self-laundering (2014), illegal gangmastering (caporalato) (2016), tax offences (2019), smuggling, offences against the cultural heritage (2022), down to the most recent grafts. Today the families of predicate offences number in the many dozens, covering hundreds of offence types: a perimeter that covers virtually every imaginable criminal risk of a company.
Every extension took place without anyone — government, parliament, legal scholarship — stopping to check whether the instrument was working for the offences already included. And every extension had a side effect never declared: the compulsory updating of all existing models. New predicate offence, new risk mapping, new procedures, new invoice. The ever-lengthening catalogue is, for the market we shall discuss in the second part, what the renewal of collections is for fashion: the guarantee that the product is never bought once and for all.
How the pact works
The mechanism, stripped of jargon, is a pact between the State and the company. The entity is liable when an offence in the catalogue is committed "in its interest or to its advantage" by those who direct it — the top management, the "apicali" — or by those who work under their direction. It is never liable, by express provision, if the perpetrator acted in his own exclusive interest or that of third parties. The sanctions are of four kinds: the pecuniary sanction, calculated in "quotas" (from one hundred to one thousand quotas, each of a variable amount between €258 and €1,549: a theoretical ceiling of little more than one and a half million euros — a figure we shall return to, because it is the heart of the deterrence problem); the disqualification sanctions, the only ones truly feared — suspension of activity, a ban on contracting with the public administration, exclusion from financing, revocation of authorisations —; the confiscation of the price or profit of the offence, always mandatory; the publication of the judgment. In the most serious cases, the judge may place the entity under judicial administration (commissariamento) in place of disqualification, when the interruption of the activity would harm the community.
But the heart of the law does not lie in the sanctions: it lies in the way out, drawn by Articles 6 and 7. If the entity proves that it adopted and effectively implemented, before the commission of the act, an "organisational and management model" suitable to prevent offences of the kind that occurred; if it entrusted supervision of the model's functioning and observance to a body endowed with autonomous powers of initiative and control — the Supervisory Body, the OdV, a figure invented by the Italian statute and unknown to the rest of the world —; and if the perpetrators committed the offence by "fraudulently circumventing" the model, then the entity is not liable. For the offences of senior management this exculpatory proof rests on the company: a reversal of the burden that legal scholars have always contested and that the reform now in the works would finally like to remove. For the offences of subordinates the general rule applies instead: it is the prosecution that must prove the act was made possible by non-observance of the duties of direction and supervision.
A technical aside, necessary because half of the real trials pass through here. What sense does it make to say that a negligent homicide at work is committed "in the interest or to the advantage" of the company? No company wants the accident. The objection seemed insurmountable and for years kept negligence offences out of the courtrooms; the ThyssenKrupp judgment dissolves it: in negligence offences of result, interest and advantage are to be referred not to the event — the death, the injury — but to the conduct that produced it: the violation of the precautionary rule. If the company saved on safety — maintenance, training, safeguards — that saving is its advantage, and it suffices to ground liability (Court of Cassation, Joint Chambers, no. 38343/2014). It is the interpretation that made Decree 231 potentially applicable to every serious workplace accident and every corporate environmental disaster: potentially, precisely — how far it actually has been, we shall see shortly.
The model, the law says, must identify the activities at risk, provide protocols for the formation and implementation of decisions, manage financial resources so as to prevent offences, impose information flows toward the Supervisory Body, and equip itself with a disciplinary system. To guide companies, Article 6 assigns a role to the guidelines of the trade associations — historically, those of Confindustria above all — communicated to the Ministry of Justice. The overall exchange is declared and is, in itself, a good idea: the State forgoes punishing the entity that has organised itself seriously to prevent the offence. Compliance is not an obligation — no rule requires adopting the model — but a burden: whoever does not adopt it is betting on never running into proceedings. On this exchange everything else rests: the model as an insurance policy, the Supervisory Body as guarantor, the consultant as the policy's tailor.
The promise: a cultural wager, with an implicit clause
On paper it was a small revolution, and this must be said without irony. The modern idea the law imported is called "organisational fault": the entity is not punished for another's act, it is punished for its own defect of organisation — for not having built the defences that would have made the offence improbable. The Joint Chambers, in the judgment on the ThyssenKrupp fire, gave this framework their systematic blessing. The declared ambition was to transform corporate criminal law: from a machine that intervenes after the disaster, looking for an individual culprit preferably downstream in the hierarchical chain, into a lever that modifies beforehand the decision-making processes, the incentives, the culture of organisations. Anyone who lived through the trials of the 1990s knows how long-awaited that promise was: the organisational scapegoat — the line supervisor convicted in place of the system — was, and has remained, the most odious constant of the criminal law of labour and the environment.
Within this promise, however, there was a second, implicit and decisive one, which is the yardstick of the entire series. For the pact to work, the company must be able to know ex ante what makes a model "suitable". The judgment of suitability cannot be a bet on the judge's mood: standards were needed. The path was even mapped out: the trade-association guidelines as a base, scholarship to refine, case law to select case after case, until consolidating model templates by sector and by size — recognisable, opposable parameters, binding within the limits of reasonableness, as happens in every field where law meets technique, from medical negligence to construction. The American model, with all its defects, had taken that road: explicit criteria for "effective" programmes, scores, agency practice. Decree 231 chose instead to hand everything over to the criminal judgment case by case, without metrics and without institutional co-ordination. If the standard does not form, the model ceases to be a technology of prevention and becomes an apotropaic rite: it is bought not because it works, but because one cannot not have it. We shall see that this is exactly what happened.
What Decree 231 is not
Before measuring the results, three misconceptions to clear away, because much misleading advertising thrives on them. First: the model is not compulsory. No State law requires adopting it; what makes it necessary in practice, for many companies, are the demands of clients, public tenders, legality ratings, some regional legislation — and, above all, fear. Second: the model is not a certification. No stamp, no attestation, no ISO certification "saves" the entity: the judgment of suitability belongs to the judge alone, after the fact — with a single, very recent and partial exception of which we shall speak. Third: the model is not an automatic shield. Even the best model does not exonerate if the judge finds that it was not "effectively implemented", or that the offence did not "fraudulently circumvent" it: two formulas that, as we shall see, have consumed twenty years of case law. Adopting the model after the fact, together with compensation for the damage, counts only as a mitigating factor and as a way to avoid the disqualification sanctions. It is worth, finally, recalling the perimeter: Decree 231 applies to companies, to associations even without legal personality, and to public economic entities — not to the State, not to territorial authorities, not to sole proprietorships.
Twenty-five years on: the textbook case lasted twenty
What has the judge said, in a quarter of a century, on the heart of the law — the suitability of the model? The honest answer is: very little, late, and almost always in the negative. The emblematic case, the only one the textbooks can tell in full, is the Impregilo case: a charge of market manipulation against the group's top executives over price-sensitive announcements in 2003. In 2009 the Milan judge delivered the first acquittal of an entity for suitability of the model in the history of the statute; the Court of Appeal confirmed it in 2012, crediting the model's conformity with the Confindustria guidelines and the self-regulatory codes; the Court of Cassation quashed it in 2014, denying that conformity with the guidelines was enough and coining the criterion of "fraudulent circumvention" (Court of Cassation, Fifth Section, no. 4677/2014); and only in 2022 — five rounds of judgment, almost twenty years after the facts — did the Sixth Section close the match by definitively acquitting the company, with the most important judgment ever written on the subject (Court of Cassation, Sixth Section, no. 23401/2022, presiding judge Fidelbo). There one reads, at last, the principle that ought to govern everything: the commission of the offence is not equivalent to proving that the model was unsuitable; the judge cannot demand the impossible of the model, that is, the zeroing of the offence risk; suitability must be judged by ex ante prognosis, not with hindsight. The most authoritative commentary greeted the decision with a title that is already a diagnosis: organisational fault "finds (perhaps) its type" — perhaps, and after twenty-one years (Paliero-Fusco; to the same effect the note by Piergallini and the analysis by Assonime, which spoke of "lights and shadows", flagging the system's pathological slowness).
A legal system that takes twenty years to produce its only textbook case is not building standards: it is living off the rent of uncertainty. And the counter-proof came from the State itself. In 2024 the Ministry of Justice set up a technical working group for the organic reform of the decree — co-ordinated, with perfect circularity, by the president of that panel, Giorgio Fidelbo —; the final report, made public in early 2026, proposes among other things to make organisational fault a constitutive element of the wrong, which the prosecution must prove, for both categories of perpetrators. Translated from the language of ministerial reports: the mechanism devised in 2001 has not worked, and not even the case law has managed to make it work. When it is proposed to rewrite the law because the judges have failed to give it a predictable content, the diagnosis lies in the premise.
The rest of the picture: banks, supervisory bodies, convictions
Outside the Impregilo saga, the occasions on which judicial scrutiny truly entered the merits of the organisation can be counted, and they have almost never ended well for the entity. The Milan Court, in the trial over the Monte dei Paschi derivatives, found the bank's model unsuitable, pointing the finger at the inertia of the Supervisory Body, which had remained passive in the face of the Bank of Italy's findings (Milan Court, no. 10748/2021): that conviction was later swept away on appeal, but for a reason that has nothing to do with the model — the non-existence of the predicate offence — so that the finding of unsuitability was never contradicted on the merits: it merely became irrelevant. The Venice Court of Appeal, in the Banca Popolare di Vicenza case, upheld the entity's liability, noting an "almost total osmosis" between the Supervisory Body and top management: the guardian was furniture (Venice Court of Appeal, no. 3348/2023). These are the exceptions that illuminate the rule: when the organisational merits are touched, the ordinary outcome is conviction or irrelevance; acquittal for suitability remains an event as rare as an eclipse.
How rare, the numbers say. The judgments on the merits traceable in the public and specialist collections that have acquitted an entity by recognising the suitability of the model number, in twenty-five years, two: Impregilo, and a 2024 judgment of the Milan Court — hailed by commentators as "extremely rare" — which acquitted the company while convicting the natural persons, crediting management's intentional bypassing of the protocols (Milan Court, no. 1070/2024). To these can be added a handful of dismissals known only because some practitioner has recounted them: the cases in which the model "works" at the investigation stage leave, by definition, no public trace. The only sketch of a positive standard arrived in September 2025 and is sectoral: for workplace-safety models conforming to recognised international standards, certification counts as a rebuttable presumption of adequacy (Court of Cassation, Fourth Section, no. 30039/2025). A beginning, after a quarter of a century, confined to one subject.
The real litigation: the details
And the rest? The rest of the case law — the mass of it — has been consumed on side issues. Who may represent the entity in the trial when the legal representative is under investigation (Article 39: a strand that by itself occupies a good part of the recent headnotes); how and when the model should be produced in court; the statute of limitations for the wrong; the confiscation and seizure of the profit, terrain of the Gubert Joint Chambers; liability within corporate groups; applicability to the foreign entity. Serious questions, in part; but questions that stand to the heart of the law as road signs stand to the engine. The datum strikes anyone who opens the case digests: for every ruling that discusses what makes an organisation well organised, there are dozens on how to sign a special power of attorney. The living law of Decree 231 is, in very large part, a procedural law of detail grown up around a substantive void.
The overall numbers confirm the disproportion between the noise of the market and the silence of the courtrooms. The only systematic census in existence — and the very fact that it took an agreement between a university and a court to count them is a clue, to which we shall return — concerns the Milan Court, the most active in Italy: in the period 2016-2022, 228 measures applying the decree, with 63 acquittals, 73 plea bargains and 51 convictions; and of 343 entities judged, only nineteen per cent had adopted a model before the fact. Read that last figure twice: in the court of reference of Italian capitalism, eighty-one per cent of the companies put on trial had no model at all. The market for models and the real judicial flow, quite simply, almost never meet: those who buy compliance do not end up on trial, for other reasons — size, visibility, selection of proceedings — and those who end up on trial had bought nothing. At national level, the data collected by the OECD for foreign bribery alone record, between 2011 and 2022, ninety investigations of entities, seventy-two proceedings and twenty-two convictions; in the following two years, one new investigation and no new proceedings. We shall return to this: for now the snapshot suffices.
The de facto equivalence
There is one last feature of the picture, and it is the gravest, because it touches logic even before law. In applied practice — the most alert scholars have been denouncing it for years — the judgment on suitability tends to resolve itself into an inverted syllogism: the offence occurred, therefore the model did not work, therefore it was unsuitable. It is hindsight elevated to a criterion of judgment: what the literature calls hindsight bias and what one Italian scholar has christened, with an exact formula, the mechanism of "self-fulfilling prophecies" (Colacurci). Defending oneself by proving the suitability of a model against an offence already committed has been described, not wrongly, as a probatio diabolica, an impossible proof; those who have analysed the reasoning of the judgments up close speak of assessments "endemically corroded by a conspicuous component of subjectivity" (Mongillo). The Cassation of 2022 denied the automatism in words; the distribution of outcomes says that, in practice, the automatism has won almost always. With a caveat of honesty that the reader of this blog expects: a share of the defence's successes dies silently in dismissal, and no public database records the decisions on the merits; so we cannot even measure precisely how dark the picture is. The statistical opacity of the system — no one knows how many proceedings, with what outcomes, on what models — is itself one of its constitutive defects. And it is, for those who sell certainties by catalogue, a perfect commercial condition.
Who should care, besides the defendants
One last question, before drawing up the balance: why should any of this interest those who do not run companies and are not lawyers? For two reasons, which are in the end the reasons for this blog. The first concerns the victims. The offences for which Decree 231 is most often charged — the Milan data say so: environment, public administration, workplace safety — are offences with diffuse and concrete victims: the workers, the inhabitants of contaminated territories, the community robbed. For them the promise of Decree 231 was the most important of all: that the one to answer would no longer be only the last link in the chain — the supervisor, the shift leader, the plant manager offered up in sacrifice — but the organisation that had created the conditions of the act. If the judgment on the organisation does not work, that promise is betrayed twice over: the system remains unpunished, and the individual scapegoat again becomes the currency with which trials are closed. Those who have studied organisations have described this downward off-loading mechanism with precision; Italian criminal law, which had even built the instrument to counter it, still practises it every day.
The second reason concerns the public money of trust. Every euro spent on façade compliance is a euro that buys reputational impunity: the company displays the model, the social report, the certification, and public opinion — and sometimes the judge — draws from them an impression of seriousness that no one has ever verified. A system that does not distinguish real prevention from paper is not neutral: it rewards those who package the paper best. It is the very definition of adverse selection, and the reader can see for himself who pays the cost.
The bill that does not add up
Let us recapitulate, so that the paradox can carry the next part. A law born to transform the culture of companies has produced, on the judicial plane: a single textbook case, which lasted twenty years; two acquittals on the merits for suitability of the model; no general standard of good organisation, with a single sectoral presumption arriving in 2025; litigation dominated by procedural details; a judgment of suitability that remains, for those subjected to it, a retrospective lottery; and an applicative flow so meagre and so opaque that counting the trials of a single court took a dedicated university research project. Any product with this performance would have disappeared from the market. The 231 model, instead, has never been sold so much, at such high prices, by so many professionals, with so little verification of results. How that is possible — who buys, who sells, how much it earns; why the absence of a standard is not a defect of the product but its ideal commercial condition; and what Italy's world record in anti-bribery certifications has to do with the OECD's judgment on our sanctions as "inadequate to the purpose" — is the question of the second part: "Paper Compliance, Gold for the Consultants".
A note on method
This series is built on verifiable public sources, referred to in the text and listed at the end. As with every whitecollarcrimes publication, every report of errors or inaccuracies will be checked and, if founded, accepted and corrected, with an account given of the correction. The documentary research was also conducted with artificial-intelligence tools; every citation detail has been checked against an open source. The assessments are the collective's.
Main sources for this part
Legislative Decree no. 231 of 8 June 2001 and enabling law no. 300 of 29 September 2000 (normattiva.it) · OECD Convention of 17 December 1997, Arts. 2, 3 and 5 (oecd.org) · U.S. Sentencing Guidelines, ch. 8 (ussc.gov) · Court of Cassation, Joint Chambers, 18 September 2014, no. 38343, ThyssenKrupp (giurisprudenzapenale.com) · Milan Court, judge for preliminary investigations, 17 November 2009, and Milan Court of Appeal no. 1824/2012, Impregilo (olympus.uniurb.it; archiviodpc.dirittopenaleuomo.org) · Court of Cassation, Fifth Section, 30 January 2014, no. 4677 (aodv231.it) · Court of Cassation, Sixth Section, 15 June 2022, no. 23401, with a note by C. Piergallini (sistemapenale.it) and C.E. Paliero–E. Fusco, L'happy end di una saga giudiziaria; Assonime, Il Caso 4/2022 (assonime.it) · Milan Court, no. 10748/2021, MPS (giurisprudenzapenale.com) · Venice Court of Appeal, no. 3348/2023, BPVi (giurisprudenzapenale.com) · Milan Court, Second Section, no. 1070/2024 (sistemapenale.it; osservatorio-231.it; dlapiper.com) · Court of Cassation, Fourth Section, 1 September 2025, no. 30039 (ambientediritto.it) · Observatory on the 231 case law of the Milan Court, data 2016-2022 (University of Milan; presentation of 19 December 2023) · OECD, Implementing the OECD Anti-Bribery Convention – Phase 4 Report: Italy (2022) and Two-Year Follow-Up (2024) (oecd.org) · M. Colacurci, L'idoneità del modello nel sistema 231, Dir. pen. cont. – Riv. trim., 2/2016 · V. Mongillo, La responsabilità penale tra individuo ed ente collettivo (2018) and later writings · Final report of the ministerial technical working group co-ordinated by G. Fidelbo, 2025-2026 (compliancehub.it; altalex.com).
whitecollarcrimes a collective byline · guarantor: Avv. Luca Santa Maria · 8 July 2026