05 Sep criminal liability of legal entities

The topic of liability of legal persons e, more generally, of bodies for offenses resulting from crime has assumed increasing importance in recent years in the field of corporate criminal law and corporate compliance. The fundamental point of reference is represented by the legislative decree 8 June 2001, n. 231, which introduced into Italian law a system of liability for entities resulting from the commission of certain crimes by natural persons operating in the organization of the entity. Before the entry into force of the Legislative Decree. 231/2001, the traditional principle expressed by the art. 27, comma 1, Cost., according to which “criminal responsibility is personal”, was interpreted in the sense that liability for the crime could be referred exclusively to the natural person responsible for the criminal conduct, while the entity could possibly suffer civil or administrative consequences according to specific legal provisions. With the Legislative Decree. 231/2001 the legislator introduced a radically more complex system, in which the commission of a crime by a natural person can result, when certain conditions are met, a distinct responsibility of the entity in whose interest or advantage the crime was committed. To discipline, while formally qualifying that of the entity as administrative responsibility, presents clear characteristics of a substantially criminal nature, so much so that legitimacy jurisprudence has progressively spoken of a true "tertium genus" of responsibility, placed in an intermediate position between criminal liability and administrative liability. The Court of Cassation has in fact underlined how the system outlined by the decree is compatible with the constitutional principles of personal responsibility and culpability precisely because the offense of the entity does not coincide with that committed by the natural person, but requires an independent assessment relating to the organizational structure of the entity and its ability to prevent the commission of the underlying crimes. The fundamental principle is contained in the art. 5 del D.Lgs. 231/2001, according to which the entity is responsible for crimes committed in its interest or to its advantage by subjects who hold representative functions, administration or management of the entity or one of its organizational units with financial and functional autonomy, as well as by people who, even de facto, exercise the management and control of the entity, or by subjects subject to the management or supervision of one of the subjects just indicated. The provision therefore identifies two fundamental elements: on one side, the necessary commission of a specific predicate crime; on the other, the existence of a qualified connection between the perpetrator of the crime and the entity and the carrying out of the act in the interest or to the advantage of the latter. Interest and advantage constitute distinct but alternative attribution criteria and jurisprudence has clarified that they must be evaluated according to different perspectives. In fact, interest has a predominantly subjective and teleological dimension, having to be appreciated ex ante, that is, verifying whether the subject's conduct was oriented towards the pursuit of utility for the entity; the advantage, instead, has an essentially objective dimension and must be evaluated ex post, in light of the benefit concretely achieved by the entity as a result of the commission of the crime. This distinction was particularly valued by the United Sections of the Court of Cassation in sentence no. 38343 of the 24 April 2014, relating to the well-known ThyssenKrupp case, in which the issue of the entity's liability for negligent crimes committed in violation of the regulations on health and safety at work was addressed in depth. Case law has clarified that interest and advantage do not necessarily have to be both present, being sufficient, generally, the occurrence of one of the two criteria, provided it is concretely ascertained. In negligent crimes, however, the verification takes on particular characteristics, since it obviously cannot be argued that the harmful or fatal event was intentionally pursued in the interest of the entity. In such cases, according to the elaboration of the United Sections, the interest or advantage can be identified in the conduct carried out in violation of the precautionary rules, when such conduct has resulted, eg, cost containment, greater production speed, a saving on security measures or other economically appreciable benefits for the company. The system outlined by the decree is also characterized by the principle of mandatory nature of the predicate crimes. L’art. 2 del D.Lgs. 231/2001 in fact, it establishes that the entity cannot be held responsible except in relation to an administrative offense expressly provided for by law, while the articles. 24 and following of the decree progressively identify the categories of crimes that can determine the liability of the entity. The list, originally much narrower, it was progressively expanded by the legislator and includes today, among others, crimes against the public administration, corporate crimes, tax crimes, IT crimes and crimes relating to the illicit processing of data, crimes against industry and commerce, crimes relating to money laundering and self-laundering, environmental crimes, crimes relating to health and safety at work, crimes against the individual personality, organized crime crimes, crimes relating to payment instruments other than cash, as well as further cases introduced over the years. Among the most significant changes, the expansion of the discipline to tax crimes must be remembered, through the inclusion in the Legislative Decree. 231/2001 dell’art. 25-fifty million, as well as the evolution of the regulations relating to crimes against cultural heritage and the laundering of cultural assets, which has further expanded the risk area for businesses. The art. assumes particular importance. 25-seven times, introduced by law 3 August 2007, n. 123 and subsequently modified by Legislative Decree. 81/2008, which extended the entity's liability to the crimes of manslaughter and serious or very serious negligent personal injury committed in violation of the regulations on the protection of health and safety at work. This extension represented one of the most important steps in the evolution of the system 231, since it demonstrated how the entity's liability can also arise in relation to negligent cases and not exclusively in the presence of malicious conduct. The charging mechanism also varies depending on the position held by the perpetrator of the crime. L’art. 6 del D.Lgs. 231/2001 regulates the hypothesis in which the crime was committed by subjects who hold representative functions, administration or management of the entity or one of its organizational units with financial and functional autonomy, as well as by people who practice, even de facto, the management and control of the institution. In such a situation, the legislator presumes a particular connection between the organization of the entity and the activity of the top management, but it allows the organization to be exempt from liability by demonstrating that the management body has adopted and effectively implemented it, before the commission of the crime, an organization and management model suitable for preventing crimes of the type that occurred; that the task of supervising the functioning and observance of the model and ensuring its updating has been entrusted to a body of the organization with autonomous powers of initiative and control; that the people committed the crime by fraudulently evading the model and that there was no omitted or insufficient supervision by the Supervisory Body. The regulations provided by the art. are different. 7 for crimes committed by subjects subject to the management or supervision of top management. In this case the entity is liable if the commission of the crime was made possible by failure to comply with management or supervisory obligations, it being understood that such non-compliance is in any case excluded when the entity has adopted and effectively implemented it, before the commission of the crime, an organizational model, management and control suitable to prevent crimes of the type that occurred. The organizational model therefore constitutes one of the central tools of the entire system 231, but it is important to underline that its function cannot be reduced to a mere bureaucratic fulfillment. The model must be built on the concrete reality of the company, through a preventive analysis of the activities most exposed to the risk of committing the predicate crimes, the identification of the procedures and controls necessary to reduce these risks, the definition of adequate information flows, the establishment of a disciplinary system suitable for sanctioning failure to comply with the envisaged measures and the identification of a Supervisory Body equipped with the necessary autonomy and independence requirements. L’art. 6, comma 2, identifies some fundamental contents of the model, providing that it must identify the activities in which crimes can be committed, provide specific protocols aimed at planning the formation and implementation of the entity's decisions in relation to the crimes to be prevented, identify methods of managing financial resources suitable for preventing the commission of crimes, establish information obligations towards the body responsible for supervision and introduce a disciplinary system suitable for sanctioning failure to comply with the measures indicated in the model. The model must also be subjected to a constant updating process, since the company risk system is not static and can change according to regulatory changes, the evolution of the company's activity, the introduction of new technologies, the opening of new markets, the acquisition of other companies or business units and the emergence of new risk factors. From this perspective, the principle of effectiveness takes on particular importance: it is not sufficient that the model is formally adopted, but it must be concretely applied and the envisaged procedures must be effectively respected by the recipients. Precisely on this point a significant evolution has developed in the jurisprudence of the Court of Cassation, which has progressively identified the so-called "organizational fault" as one of the fundamental elements of the organisation's offence. Lens, indeed, he is not liable simply because a natural person belonging to his organization has committed a crime. The administrative offense of the entity must be independently ascertained and an organizational deficiency concretely referable to the entity must emerge, such as to have allowed or facilitated the commission of the predicate crime. The Court of Cassation, Criminal Section IV, with sentence no. 39615 of the 20 October 2022, has particularly valued this principle, identifying the predicate crime among the constituent elements of the organisation's offence, the organic and teleological relationship between the perpetrator of the crime and the entity, organizational guilt and the causal link between the organizational deficit and the commission of the crime. The same approach was subsequently reiterated by the Supreme Court, Criminal Section V, with sentence no. 21640 of the 19 May 2023, in which it was clarified that the charging of responsibility to the entity cannot be based on a sort of automatic "transmission" of responsibility from the natural person to the company, but requires the demonstration of a deficiency in the entity's self-organization with respect to the risk of commission of the crime. The ruling takes on particular importance because it highlights the autonomy of the entity's offense compared to the crime committed by the natural person: the company is responsible for its own offence, characterized by its own subjective element and its own reproach, which jurisprudence identifies as organizational fault. In this perspective, the criterion of the so-called "posthumous prognosis" also assumes importance, through which the judge must ideally place himself in the moment before the commission of the crime and verify whether the adoption and effective application of an adequate organizational model could have prevented or reduced the risk of commission of the crime that occurred. The verification must therefore not be limited to establishing that the crime was committed and that the model was absent, incomplete or inadequate, but it must concretely identify which specific organizational deficiency made the event possible and what causal relationship exists between this deficiency and the predicate crime. The same approach was reiterated by the Supreme Court, Criminal Section IV, with sentence no. 18413 of the 10 May 2022, according to which organizational guilt constitutes a constitutive element of the entity's offense and cannot be confused or superimposed on the guilt of the natural person who committed the crime. This principle is particularly important in proceedings relating to accidents at work, in which it is common for the administrator, the employer or other top management person is held personally liable for the crime of manslaughter or negligent personal injury and, at the same time, the company is held accountable for the offense provided for by the art. 25-septies del D.Lgs. 231/2001. However, the two assessments must remain distinct: the liability of the natural person derives from the violation of the specific precautionary rules applicable to his position, while that of the organization requires the ascertainment of a culpable organizational deficit, causally linked to the commission of the crime. The Cassation, with sentence no. 570 of January 11th 2023, it actually censured a decision in which the director's responsibility profiles had been substantially superimposed on those of the organisation, reiterating that the mere absence of the organizational model does not automatically determine the responsibility of the company. Subsequent case law also confirmed this approach. With sentence no. 4210 of the 31 January 2024, the Court of Cassation highlighted that the absence, the unsuitability or ineffective implementation of the model does not constitute, alone, sufficient elements to automatically establish the entity's liability, a specific organizational fault and the related causal connection with the crime must be identified and proven. That doesn't mean, naturally, that the adoption of the model is irrelevant. Unlike, an effectively adequate and concretely implemented model represents one of the main tools through which the organization can prevent the commission of crimes and, in the cases provided for by the articles. 6 e 7 of the decree, demonstrate that they have adopted an organizational system suitable for preventing the risk of crime. The issue of effective implementation is therefore central: a merely "paper" model, devoid of actually applied procedures, of training, of controls, of information flows and effective activity of the Supervisory Body will hardly be able to carry out the exempt function attributed to it by the legislator. La compliance 231 it must therefore be conceived as a permanent process and not as the one-off drafting of a document. In this perspective, The Supervisory Body provided for by art. also assumes particular importance. 6, comma 1, became. b), of the decree, who is entrusted with the task of supervising the functioning and observance of the model and ensuring that it is updated. The Supervisory Body must be able to operate autonomously and with effective powers of initiative and control and must receive adequate information on company activities relevant to the prevention of crimes. The adequacy of the internal control system must also be assessed taking into account the size, the complexity and structure of the company, avoiding both excessively generic models and disproportionate control systems lacking effective functionality. A further characterizing element of the discipline is represented by the sanctioning system. The articles. 9 and following of the Legislative Decree. 231/2001 predict, indeed, financial penalties, interdictory sanctions, confiscation and publication of the conviction. Disqualification sanctions can be particularly serious, which may consist of a ban from carrying out the activity, in the suspension or revocation of authorizations, licenses or concessions functional to the commission of the offence, in the prohibition of contracting with the public administration, in exclusion from benefits, financing, contributions or subsidies and in the possible revocation of those already granted, as well as the prohibition on advertising goods or services. The financial penalty is determined through the quota system provided for by the articles. 10 e 11 of the decree, which allows you to modulate the amount of the sanction taking into account the seriousness of the offense and the economic and financial conditions of the entity. The regulation of precautionary measures is also particularly significant, since the entity can be subjected, during the proceedings, to interdictory measures when the conditions set out in the art. 45 del D.Lgs. 231/2001. It follows that a procedure 231 can produce significant effects on the operations of the company even before the definitive definition of the judgment. Precisely for this reason, risk prevention 231 cannot be considered exclusively a question of a criminal nature, but it must be integrated into the overall corporate governance. The organizational model should communicate with the internal control system, with accounting and financial procedures, with the disciplinary system, with human resources management, with safety at work, with environmental procedures, with systems for managing relations with the public administration, with the management of procurement and suppliers e, more generally, with all the areas in which the company activity presents risks of commission of predicate crimes. Of particular interest is also the art. 12 del D.Lgs. 231/2001, which regulates cases of reduction of the pecuniary sanction, lies the art. 17 provides specific conditions to avoid the application of disqualification sanctions, including full compensation for damages, the elimination of the harmful or dangerous consequences of the crime and the elimination of organizational deficiencies through the adoption and implementation of a model suitable for preventing crimes of the type that occurred. The regulation therefore confirms the predominantly preventive function of the system 231: the objective is not only to punish the entity for the crime committed, but encourage them to adopt organizational structures and control systems capable of reducing the risk of committing crimes. In this sense, responsibility 231 represents one of the tools through which the legislator has progressively transformed the culture of prevention within companies, shifting attention from the sole individual responsibility of managers and administrators towards the overall quality of the company organisation. The most recent legitimacy jurisprudence has further consolidated this approach. The ruling of the Court of Cassation, Criminal Section IV, n. 8397 of the 28 January 2026, filed on 4 March 2026, reiterated that the entity's liability cannot be automatically based on a simple failure, unsuitability or ineffective implementation of the organizational model. The Court once again placed "organizational fault" at the center of the investigation, clarifying that the prosecution must identify and demonstrate the concrete violation of organizational and preventive rules and the connection of this deficit with the commission of the crime. The ruling takes on particular importance because it confirms the orientation according to which the responsibility of the entity must be constructed through an independent judgment on its organization and not through a simple "rebound" responsibility compared to that of the natural person. The most recent jurisprudence is therefore moving towards an increasingly rigorous conception of responsibility 231, in which the interest or advantage of the entity, the predicate crime, the qualified position of the author, organizational fault and the causal link must be the subject of a specific and reasoned assessment. Particularly significant, in this direction, it is also the ruling of the Court of Cassation, Criminal Section III, n. 24402 of the 10 April 2026, filed on 2 July 2026, which reiterated the autonomy of the entity's responsibility and provided further methodological indications on the ascertainment of organizational fault and the requirements of interest or advantage. A picture emerges in which the Legislative Decree. 231/2001 it can no longer be considered a purely sectoral discipline or intended for large companies, but it now constitutes a structural component of business risk management. Although the adoption of the organizational model is not, in general, mandatory for all businesses, the choice not to have a system 231 must be carefully assessed in light of the company's concrete exposure to the predicate crimes, of its organizational structure, relations with the public administration, of the management of financial resources, of production activities, of workplace safety risks, the international dimension of the activity and the characteristics of the supply chain. The adoption of an adequate model does not constitute, indeed, an absolute guarantee of exemption from liability, but it represents a fundamental tool for prevention and risk management, mostly, allows the company to demonstrate that it has equipped itself with an organizational system concretely oriented towards the prevention of crimes. The correct implementation of the discipline 231 therefore requires careful risk assessment activity, the mapping of sensitive areas, the analysis of decision-making and financial processes, the preparation of protocols and procedures proportionate to the actual risks, training of employees and interested parties, the establishment of adequate information flows to the Supervisory Body, the introduction of an effective disciplinary system and the periodic updating of the model in relation to regulatory and organizational changes. Ultimately, the system envisaged by the Legislative Decree. 231/2001 determines a significant change in perspective in corporate responsibility: attention is no longer directed exclusively to the conduct of the individual perpetrator of the crime, but also to the organisation's ability to prevent, intercept and counteract illicit behaviour. The company, in other words, it is not called to account simply because a crime has been committed within it, but why, in compliance with the further conditions established by law, that crime can be traced back to an organizational deficiency of the institution. It is precisely in the distinction between the responsibility of the natural person and the responsibility of the organization that one of the fundamental principles of the entire system is found 231: the crime committed by the individual constitutes the necessary prerequisite for the organisation's wrongdoing, but it does not exhaust its content. Ascertaining the company's liability requires an independent examination of the organization, of the procedures, of controls, of corporate decisions and preventive measures adopted, as well as their actual ability to impact the risk of committing the crime. From this approach derives the growing importance of corporate compliance and the construction of organizational models truly integrated into the structure of the company, not prepared exclusively for documentary needs, but conceived as dynamic tools for the prevention and management of criminal risk. He D.Lgs. 231/2001, therefore, it does not just represent a sanctioning system, but today it constitutes a real governance model of crime risk, in which organization, control and prevention play a central role in protecting the company, of its directors, of employees, of collaborators e, more generally, the continuity of economic activity.