New EU Anti-corruption Directive: What Private Companies Need To Know

This newsletter offers an overview of the key elements of the Directive, how they compare to current anti-corruption frameworks in Norway, and what actions businesses should take to adapt.

Key summary

• Not EEA relevant, but practically significant. The Directive is not EEA relevant and Norway is not required to transpose it. However, Norwegian companies with subsidiaries, permanent establishments or business relationships in the EU will be directly subject to transposed national laws once member states implement the Directive, with most provisions due by 1 June 2028.
• Turnover-based fines. Member states must ensure that maximum fines for bribery and misappropriation are no less than 5% of a company's total worldwide annual turnover, or EUR 40 million. For other offences, the floor is 3% of turnover or EUR 24 million.
• Corporate liability for supervisory failure. A company may be held liable where a corruption offence is committed for its benefit by a person in a “leading position,” or where such a person fails to supervise or control subordinates, thereby enabling a corruption offence for its benefit. This effectively requires companies to implement genuine internal compliance programmes.
• Compliance programmes as a mitigating factor. For the first time, the EU is harmonising the role of internal compliance programmes across member states: having an effective programme before or after an offence may reduce criminal liability. However, programmes implemented merely for cosmetic purposes will not attract the same protection.
• Expanded jurisdictional reach. Member states must establish jurisdiction where the offence was committed in whole or in part in their territory or where the offender is one of their nationals, and may extend it to offences committed for the benefit of a legal person established in their territory. A Norwegian parent company whose EU subsidiary benefits from corrupt conduct – even conduct initiated from Norway or another third country – may be within the reach of EU enforcement.

Background

Corruption remains one of the most significant threats to democracy, rule of law and economic fairness. The Qatar corruption scandal (widely known as "Qatargate") erupted in the European Parliament in 2022. The case clearly illustrated of how influence-peddling and cash flows can penetrate even the highest levels of EU institutions. At a national level, Norway has also seen renewed scrutiny of corruption, most recently following the publication of the Epstein files.

Recognising the severity of this threat, Commission President von der Leyen has responded with an anti-corruption reform as part of her political agenda. The previous EU framework, dated back to a 1997 Convention on corruption involving EU officials, and a 2003 Framework Decision on private-sector corruption, was widely regarded as too fragmented and too limited to deliver coherent enforcement across 27 member states. Many stakeholders, including Transparency International, had long called for a more robust and unified approach.

The Commission proposed a new directive in May 2023. Following negotiations, the Directive was formally adopted on 29 April 2026 and entered into force on 1 June 2026. Member states have until 1 June 2028 to transpose the Directive into national laws. Obligations relating to national strategies and risk assessments which must be transposed before 1 June 2029.

As judicial cooperation in criminal matters (TFEU Article 82 ff.) does not fall within the scope of the EEA Agreement, the Directive has not been marked EEA relevant. Norway is therefore not obliged to transpose the Directive into Norwegian law. However, this does not mean that the Directive has no consequences for Norwegian businesses. As detailed below, the implications can be significant for any Norwegian company with operations, subsidiaries, or commercial relationships in the EU. Moreover, the Directive is likely to emerge as the de facto benchmark for anti-corruption standards in Europe, and will probably shape expectations for companies operating across borders regardless of formal transposition obligations.

Core Elements of the Directive

The Directive establishes minimum rules for the definition of corruption offences, penalties, and prevention measures across EU member states. In the following, we provide an overview of the core elements of the Directive and how they compare to existing legislation under Norwegian law.

Nine harmonised offences

The Directive defines and requires member states to criminalise a comprehensive set of corruption-related conduct in Articles 3 to 11: (i) bribery in the public sector (both active and passive), (ii) bribery in the private sector (both active and passive), (iii) misappropriation by public officials, (iv) trading in influence, (v) unlawful exercise of public functions, (vi) obstruction of justice, (vii) enrichment from corruption offences, (viii) concealment of corruption proceeds, and (ix) inciting, aiding and abetting, and attempt.

Several of these offences are already recognised under Norwegian law. Active and passive corruption in both the private and public sector is criminalised under Sections 387 and 388 of the Penal Code (the latter being aggravated corruption), and trading in influence under Section 389 of the Penal Code. The Directive is nevertheless significantly more specific than Sections 387 to 389, and several of its other offences – such as concealment, enrichment, misappropriation and unlawful exercise of public functions – are to varying degrees covered by more general provisions of Norwegian criminal law (Sections 171–173, 324, 332 and 337 of the Penal Code). Even where parallels exist, differences in scope and definition are likely.

Corporate liability

The Directive introduces an important corporate liability framework. Legal persons can be held liable where a corruption offence is committed for their benefit by a person in a "leading position" – that is, someone with power of representation, decision-making authority, or authority to exercise control (Article 13). Liability also arises where a person in a leading position fails to supervise or control a subordinate, thereby enabling that subordinate to commit a corruption offence for the company's benefit (Article 13(2)). This effectively imposes an implicit obligation for companies to implement genuine internal compliance programmes, the nature of which would naturally depend on the size of the company and its exposure to corruption-related risks.

While the Directive imposes liability on legal persons only for offences committed by persons in a "leading position," the Norwegian Penal Code Section 27 extends potential liability to offences committed by anyone acting on behalf of the enterprise. In this sense, the personal scope of Norwegian law is broader than what is required for EU member states under the Directive. On the other hand, the Directive appears to go beyond current Norwegian corruption legislation by criminalising failure to supervise or control subordinates. Such circumstances may be relevant under Norwegian law when assessing whether criminal liability should be imposed in specific cases (see below), but would likely not suffice as a standalone offence in Norway – both because no equivalent provision exists under Norwegian law and because negligent complicity in corruption is not criminalised.

Penalties

The penalty framework for legal persons stipulated in Article 14 of the Directive is also substantial. For bribery (public and private sector) and misappropriation, the maximum fine must be set at no less than 5% of the company's total worldwide annual turnover or alternatively EUR 40 million. For trading in influence, obstruction of justice, and enrichment offences, the maximum level shall be no less than 3% of worldwide turnover or EUR 24 million. Member states are free to set higher maxima. The Directive requires member states to ensure that the penalty is proportionate to the gravity of the conduct and to the individual, financial and other circumstances of the legal person concerned. Beyond fines, the Directive also requires member States to make available a range of additional sanctions, including exclusion from public funding including tenders, grants and licences, withdrawal of permits, disqualification from business activities, judicial supervision, judicial winding-up, closure of premises, and publication of the judgment. The Directive also stipulates specific minimum sanctions for violations committed by individuals (Articles 12 and 14).

The minimum fines prescribed by Article 14 of the Directive have no direct legislative parallel in Norwegian law, where corporate fines – including in corruption cases – are determined on a broader basis. That said, new guidelines from the Norwegian National Authority for Investigation and Prosecution of Economic and Environmental Crime ("Økokrim") came into force on 12 June 2026. The guidelines are set out to provide better foreseeability for corporate criminal liability in international corruption cases covered by the OECD Convention, including calculation models that differ from those prescribed by the Directive. Under the new guidelines, fines should be calculated using one of three alternative methods: (i) a percentage (200–400%) of expected gains from the corruption (the primary method), (ii) a percentage (400–800%) of the bribe amount, or (iii) a percentage (5–10%) of the entity's or group's turnover or operating income. The latter is broadly comparable to the 5% floor under the Directive for bribery and misappropriation. However, unlike the Directive, the Norwegian approach does not set an absolute monetary threshold – it is one of three alternative methods intended to serve as a general guideline. Wikborg Rein recently published a newsletter taking a closer look at what the guidelines entail and what measures Norwegian companies should consider going forward. 

Compliance programmes as a mitigating factor

The Directive formalises, for the first time across the EU, the role of compliance programmes in determining corporate criminal liability for corruption. Where a legal person has implemented effective internal controls, ethics and compliance programmes prior to or following the commission of an offence, this may be treated as a mitigating factor (Article 16(c)). The same applies where a legal person, upon discovering an offence, rapidly and voluntarily discloses the offence to the competent authorities and takes remedial measures (Article 16(d)). However, compliance programmes implemented merely for cosmetic purposes – so-called "window dressing" – will not attract the same protection (Recital 29). Companies should note that effective compliance is a mitigating factor only, not a complete defence. This contrasts with the "adequate procedures" defence available under the UK Bribery Act, though it is consistent with Norwegian law, which similarly does not offer a complete compliance defence.

The Directive's regulation of compliance programmes as a mitigating factor also has a parallel in Norwegian law. Whether or not compliance programmes could have prevented the offence shall be taken into account when assessing whether a corporate fine should be imposed under Sections 27 and 28 of the Penal Code, as corporate criminal liability is facultative (i.e., does not necessarily have to be imposed) even if a criminal offence has been committed. In the new guidelines, Økokrim expresses that companies that self-report and actively contribute to the investigation and prevention of offences may achieve a significant reduction in penalties, and in exceptional cases, a fine assessed at zero.

Jurisdiction, prevention obligations and other amendments

Further, the Directive includes an obligation for member states to establish their jurisdiction over criminal offences in two cases: (i) where the offence was committed in whole or in part within their territory, and (ii) where the offender is one of their nationals (Article 18). Member states are also mandated to extend their jurisdiction to other situations, including, amongst others, where the offence is committed for the benefit of a legal person established in their territory. These jurisdictional rules differ to some extent from what follows from Sections 4 to 7 of the Norwegian Penal Code. However, the precise discrepancies will depend on how member states transpose the Directive, as they are given a significant margin of appreciation in regulating jurisdiction beyond the two mandatory cases mentioned above.

The Directive also imposes a range of prevention, reporting and investigation obligations on member states (Articles 20 ff.). Under these provisions, each member state is required to put in place a national anti-corruption strategy, designate one or more dedicated anti-corruption bodies with sufficient resources and operational independence, carry out regular risk assessments covering sectors and professions particularly exposed to corruption, and deliver targeted training to public officials and law enforcement personnel. Member states must also ensure that effective investigative tools – including those used for organised crime – are available to prosecutors. These obligations will likely lead to certain differences between Norway and EU member states, for example given that Norway currently does not have a standalone national anti-corruption strategy or a single specialised anti-corruption authority, as the enforcement function rests principally with Økokrim.

Implications for Norwegian companies

Although it is not EEA relevant, the consequences of the Directive for Norwegian businesses are real and can arise in more than one way.

First of all, Norwegian companies with subsidiaries or permanent establishments in EU member states will be subject to transposed national law once member states implement the Directive, with implementation of most of the provisions in the Directive due by 1 June 2028. The nine defined offences, the expanded corporate liability standard, and the new penalty framework will all apply to their EU operations directly.

The Directive's jurisdictional provisions deserve particular attention. Several member states are expected to assert jurisdiction over offences committed for the benefit of a legal person established in their territory, or in respect of business conducted in whole or in part in their territory. Therefore, a Norwegian parent company whose EU subsidiary benefits from corrupt conduct (even conduct initiated from Norway or another third country), can in principle be within reach of the EU enforcement. Jurisdiction may even be triggered by an entity’s digital connection to a member state, such as the use of IT infrastructure within their territory (recital 33 to the Directive). This could widen the scope of exposure for companies with no physical EU presence.

In light of the above, companies with EU operations or exposure should consider the following steps: 

• Review and update anti-corruption compliance programmes to ensure coverage of all nine offences under the Directive.
• Map EU-facing personnel and governance structures to identify individuals who hold "leading positions" under the Directive's corporate liability framework, and ensure they have the resources, information, and authority needed to exercise effective oversight.
• Scrutinise relationships with intermediaries – agents, lobbyists, consultants, and other third parties – in dealings with EU public officials or authorities, and review contracting, due diligence, and monitoring arrangements in light of the broader trading in influence offence.
• It is not enough for compliance programmes to exist on paper. They need to hold up under scrutiny, which means conducting and properly documenting risk assessments, keeping training records up to date, carrying out third-party due diligence with genuine rigour, and following through on internal audit findings. If a mitigation argument ever becomes necessary, the quality of that documentation will matter.
• Monitor how individual EU member states transpose the Directive. The Directive only prescribes minimum standards, and a number of member states are expected to go further. That means the compliance landscape across the EU will not be uniform, even once every member state has completed transposition.
• Ensure that internal whistleblowing channels specifically cover corruption reporting, and that investigation and incident-response processes are designed to handle parallel individual and corporate proceedings that may arise under the Directive’s framework.
• Review anti-bribery and anti-corruption clauses in commercial contracts with EU counterparties, agents and intermediaries. Existing ABAC provisions may need to be updated to reflect the Directive’s broader catalogue of offences (including trading in influence and concealment), and the expanded scope of corporate liability for supervisory failures. Consider whether contractual representations, audit rights and termination triggers adequately address the new risk landscape.

There is also a question of whether the Directive may prompt the Norwegian legislator to amend domestic anti-corruption legislation, even though Norway is not legally required to do so under the EEA Agreement. It is not uncommon for Norwegian law to be influenced by EU measures falling outside the EEA Agreement. In addition, a report on Norwegian legislation on corporate criminal liability and corruption was presented even before the EU Directive was adopted. The report includes, among other things, proposals for the Norwegian authorities to introduce regulatory requirements for anti-corruption work in larger businesses and the public sector, and that a dedicated "Anti-Corruption Authority" be established. The proposals are partly in the process of being followed up, and this is a development worth monitoring.