Dan Ostergaard · Co-founder, Trusty · Former Novartis Global Head of Compliance · Founder of PolicyStore
A €990 billion problem
Corruption remains one of the most significant financial and regulatory risks in the European Union. Estimates suggest that corruption costs the EU up to €990 billion each year. In response, the Directive introduces a more unified and enforceable framework designed to standardise how corruption is defined, prosecuted, and penalised across Member States. This marks a major shift away from fragmented national approaches toward a more coordinated and consistent system.
What’s in the EU anti-corruption Directive
One of the most important aspects of the EU Anti-Corruption Directive is the introduction of harmonised corruption offences. These go far beyond traditional definitions of bribery and include areas such as trading in influence, misappropriation, obstruction of justice, and the concealment of corruption-related assets. The scope of what constitutes corruption risk is therefore expanding, and companies must reassess their exposure accordingly. Even informal or indirect influence over public officials can now fall within the scope of enforcement.
Another critical development is the expansion of corporate liability. Under the Directive, companies can be held accountable not only for the actions of senior leadership but also for failures in supervision and control. This means that organisations are expected to actively prevent misconduct, not just react to it. If an employee engages in corrupt behaviour due to weak oversight or inadequate controls, the company itself may face enforcement action.
Penalties under the Directive
Penalties under the Directive are designed to be significant enough to drive real behavioural change. Companies may face fines of up to five percent of global turnover or tens of millions of euros, alongside additional sanctions such as contract annulment, exclusion from public procurement, or judicial supervision. These measures reflect a clear intention by regulators to move beyond symbolic enforcement and ensure that non-compliance has meaningful consequences.
The Directive also introduces expanded jurisdiction rules, allowing authorities to pursue cases with only partial connections to the European Union. This means that even companies headquartered outside the EU may fall within scope if their activities impact EU markets or entities. As a result, multinational organisations must consider their global operations when assessing compliance risk.
Putting compliance policies into practice
Despite these changes, many companies continue to rely on traditional compliance approaches that are no longer sufficient. Having policies in place is not enough. Regulators are increasingly focused on whether compliance programmes are effective in practice. The Directive explicitly highlights that superficial or “window dressing” compliance measures will not be sufficient to mitigate liability.
This creates a fundamental shift in expectations. Companies must now demonstrate that their employees understand corruption risks and are able to apply policies in real situations. However, this is where many organisations struggle. Employees often lack clarity on what constitutes risky behaviour, particularly in areas such as third-party relationships or indirect influence. Without clear understanding, even well-designed policies can fail.
This gap between policy and understanding is where modern compliance strategies must evolve. Static documents and annual training sessions are no longer effective on their own. Organisations need ways to ensure that knowledge is absorbed, retained, and applied consistently across teams.
This is where AI-driven learning solutions such as Trusty Compliance App are transforming compliance. Instead of relying on manual content creation, companies can transform complex regulatory documents into interactive learning experiences within seconds. A directive, policy, or legal briefing can be converted into structured quizzes with automatically generated questions, answers, and explanations. This allows organisations to test real understanding rather than simply track completion.
The advantage of this approach is not only efficiency but also measurability. Companies gain clear visibility into whether employees actually understand key compliance concepts. This creates a defensible position in the event of regulatory scrutiny, as organisations can demonstrate that they have taken concrete steps to ensure awareness and understanding.
The bottom line
The timeline for the EU Anti-Corruption Directive suggests formal adoption in 2026, followed by a transposition period extending to 2028. While this may seem distant, the reality is that compliance transformation takes time. Companies that act early will be better positioned to adapt, while those that delay may struggle to meet new expectations.
Ultimately, the EU Anti-Corruption Directive represents more than a regulatory update. It reflects a broader shift toward accountability, transparency, and demonstrable compliance. The organisations that succeed will not be those with the longest policies, but those that can prove their people understand and follow them.
For companies preparing for this new landscape, the key question is no longer whether a compliance programme exists. The real question is whether it works.
Frequently asked questions
Beyond bribery, it covers trading in influence, misappropriation, obstruction of justice and the concealment of corruption-related assets.
Companies can be held accountable not only for the actions of senior leadership but also for failures in supervision and control, so they are expected to prevent misconduct actively rather than react to it.
Fines of up to five percent of global turnover or tens of millions of euros, together with sanctions such as contract annulment, exclusion from public procurement or judicial supervision.
Its expanded jurisdiction rules allow authorities to pursue cases with only partial connections to the EU, so companies headquartered elsewhere can fall within scope if their activities affect EU markets or entities.
Related reading: the last mile of compliance, employee compliance training that proves comprehension, third-party screening for SMEs, and the Compliance App for the policies the Directive expects.
POLICIES, TRAININGS AND HOTLINE
Trusty Compliance App: company policies, compliance training and a whistleblowing channel in one app for your employees. 10 ready-made policies, 6 trainings, free trial, no IT setup.