The European Union has taken a significant step toward strengthening its legal framework for combatting corruption. Directive (EU) 2026/1021, which entered into force on May 31, 2026, introduces more consistent rules concerning corruption offenses, corporate liability, penalties, prevention, reporting, and enforcement across the participating EU Member States.

Its significance extends beyond criminal law.

For boards of directors, executive management, public officials, regulators, internal auditors, compliance professionals, and others entrusted with authority, the Directive raises an important institutional question: Are existing governance arrangements sufficiently effective to identify, manage, and respond to corruption risks before they result in serious harm?

The answer requires more than reviewing legislation, adopting policies, or demonstrating formal compliance. It requires an informed examination of how authority is exercised, how decisions are made, how internal controls operate, and how individuals and institutions are held accountable.

A Significant Development in the EU’s Anti-Corruption Framework

Adopted on April 29, 2026, and published in the Official Journal of the European Union on May 11, 2026, Directive (EU) 2026/1021 seeks to strengthen and harmonize important aspects of the EU’s response to corruption.

The Directive addresses offenses including bribery in the public and private sectors, misappropriation, trading in influence, unlawful exercise of public functions, obstruction of justice, and enrichment from corruption offenses.

It also establishes minimum requirements concerning penalties, liability of legal persons, preventive measures, institutional capacity, reporting, and cooperation among competent authorities.

Member States bound by the Directive must generally transpose its provisions into national law by June 1, 2028. A later deadline of June 1, 2029, applies to the sectoral corruption risk assessments required by Article 20(5) and the national anti-corruption strategies required by Article 21. Denmark is not bound by the Directive.

Importantly, the Directive is addressed to Member States. The specific legal obligations applicable to companies, public institutions, and individuals must be assessed in light of existing EU and national law and the national measures adopted to transpose the Directive.

Nevertheless, the period preceding transposition provides an important opportunity for institutions to evaluate their corruption exposure, assess existing prevention arrangements, and strengthen the competence of those responsible for governance and decision-making.

Corporate Liability: Why Supervision and Control Matter

One of the Directive’s most significant implications for private-sector decision-makers concerns the liability of legal persons.

Article 13 requires Member States to establish liability for specified corruption offenses committed for the benefit of a legal person by individuals holding leading positions through powers of representation, decision-making, or control.

It also addresses situations in which inadequate supervision or control by such individuals makes it possible for persons under their authority to commit specified offenses for the benefit of the legal person.

This provision deserves particular attention.

A company may maintain an anti-corruption policy, establish a compliance department, and assign responsibility for internal control. Yet the existence of these arrangements does not necessarily demonstrate that they are effective.

Consider a company that engages intermediaries to facilitate commercial transactions. Its procedures may require management approval, contractual documentation, and payment authorization.

But what happens if the intermediary’s beneficial ownership is unknown, the services are poorly documented, the compensation is commercially unjustified, or the approval process is compromised by undisclosed conflicts of interest?

The critical governance issue is not simply whether procedures exist. It is whether the institution can demonstrate that appropriate supervision and controls operate effectively when corruption risks arise.

Article 14 reinforces the significance of legal-person liability by requiring effective, proportionate, and dissuasive penalties or measures. Depending on the offense and national implementation, these may include substantial fines, exclusion from public funding, restrictions on business activities, or other serious consequences.

These provisions should encourage boards and senior executives to examine whether their oversight arrangements provide reliable assurance or merely create an appearance of control.

Corruption Prevention Must Be More Than a Formal Exercise

The Directive also recognizes the importance of prevention.

Article 20 requires Member States to take measures to raise awareness of corruption, strengthen integrity and accountability in public administration, and promote preventive measures tailored to the risks associated with particular activities.

It also requires periodic assessments to identify sectors or occupations most exposed to corruption and the development of measures addressing the risks identified.

This approach recognizes an important reality: corruption exposure differs across institutions, industries, functions, transactions, and decision-making environments.

The risks associated with public procurement, licensing, financial services, construction, healthcare, or state-owned enterprises are not necessarily identical.

Consequently, effective corruption prevention cannot depend exclusively on standardized policies or generic awareness programs.

Institutions need to understand where corruption opportunities arise, which individuals exercise significant discretion, how conflicts of interest may compromise decisions, and whether existing controls are capable of addressing identified vulnerabilities.

For private-sector organizations, this represents an important governance consideration, even though Article 20 principally establishes obligations for Member States rather than imposing an identical preventive program on every company.

For public-sector institutions, it reinforces the importance of integrity safeguards, effective administration, risk-informed prevention, and responsible exercise of public authority.

In both sectors, the central challenge is to translate preventive principles into institutional practices that can be examined and evaluated.

Effective Internal Control Has Renewed Significance

Article 16 provides another important reason for organizations to examine the substance of their corruption prevention arrangements.

It requires Member States to ensure that certain circumstances can, in accordance with national law, be considered when determining mitigation in relevant corruption cases.

For legal persons, these circumstances include the implementation of effective internal control, ethics awareness, and compliance programs intended to prevent corruption, either before or after the commission of an offense.

They may also include rapid voluntary disclosure to competent authorities and remedial measures following the discovery of an offense.

These provisions do not establish that having a compliance program automatically prevents liability or guarantees a reduced penalty. The treatment of mitigating circumstances remains subject to the applicable legal framework and relevant decisions of competent authorities.

However, they reinforce the institutional importance of genuine, effective, and demonstrable corruption prevention arrangements.

A written policy cannot substitute for an operating effective control. A completed training session cannot establish that a decision-maker possesses the competence to identify corruption risks. Similarly, management approval does not necessarily establish that a transaction was legitimate, independently examined, or free from conflicts of interest.

The practical question is whether an institution can provide credible evidence that its prevention arrangements operate effectively.

For boards, executives, compliance officers, and internal auditors, this distinction should be fundamental to evaluating corruption exposure.

Public-Sector Institutions Face Their Own Governance Responsibilities

The Directive’s significance is equally important for public institutions, although their responsibilities must be considered separately from those of private-sector organizations.

Article 20 addresses integrity, transparency, accountability, conflicts of interest, and preventive safeguards in public administration and public decision-making.

Article 24 requires Member States to provide up-to-date training to national officials so they can identify different forms of corruption, recognize risks arising in the exercise of their duties, and respond appropriately to suspicious activities.

It also requires specialized and current training for law enforcement and judicial authorities responsible for investigating and conducting proceedings relating to relevant corruption offenses.

These provisions highlight the importance of professional competence in the public sector.

A public official may have formal authority to approve expenditure, evaluate bids, issue permits, administer public resources, or exercise regulatory powers. However, formal authority alone does not establish the competence required to recognize corruption risks or respond appropriately when warning signs emerge.

Public institutions therefore need to examine how their officials are trained, how conflicts of interest are addressed, how high-risk decisions are reviewed, and how evidence of proper oversight is maintained.

The objective is not simply to increase administrative procedures. It is to strengthen the capacity of public institutions to exercise authority responsibly and protect the public interest.

Reporting, Whistleblowing, and Institutional Accountability

Corruption prevention also depends on the ability of institutions and competent authorities to receive, assess, and respond appropriately to information concerning suspected wrongdoing.

Article 25 requires Member States to ensure that Directive (EU) 2019/1937 applies to reporting the corruption offenses covered by the new Directive and to protecting reporting persons, subject to the conditions established in the whistleblower protection framework.

It further addresses protection, support, and assistance for persons who report offenses, provide evidence, or cooperate with competent authorities in criminal proceedings, in accordance with national law.

The governance implications are substantial.

An organization may establish a reporting channel without ensuring that concerns are examined independently, confidentiality is respected, retaliation risks are addressed, or appropriate corrective action follows.

Therefore, the effectiveness of a reporting arrangement should not be judged solely by its existence.

Decision-makers should understand whether reporting channels are accessible and trusted, whether allegations are assessed appropriately, and whether lessons from substantiated incidents lead to improvements in internal control and institutional accountability.

Competent Questioning: Connecting Knowledge, Evidence, and Accountability

Understanding the Directive is necessary, but understanding legislation alone is insufficient to strengthen corruption prevention.

Institutional effectiveness also depends on the competence of those entrusted to govern, manage, audit, regulate, supervise, and approve.

This is particularly relevant to Competent Questioning, an anti-corruption governance concept authored by Mike Masoud and published by The American Anti-Corruption Institute (AACI) on April 27, 2026.

The concept emphasizes disciplined, relevant, timely, and evidence-seeking questioning that helps identify corruption risks before they develop into misconduct or institutional failure.

Crucially, Competent Questioning does not end when a question is asked. It also requires decision-makers to evaluate the quality and reliability of the answers and supporting evidence.

For example, asking whether an institution has an anti-corruption policy provides limited assurance.

A more substantive examination considers whether the policy addresses actual corruption exposure, whether relevant personnel understand their responsibilities, whether controls are operating as intended, and whether significant exceptions or failures are identified and corrected.

Similarly, asking whether a transaction received the required approval is different from determining whether the approval was legitimate, independent, sufficiently informed, and free from conflicts of interest.

Competent Questioning does not replace legal compliance, internal control, risk management, or auditing. It strengthens the ability of those exercising oversight to evaluate their effectiveness.

In the context of Directive (EU) 2026/1021, this approach provides a practical connection between the Directive’s institutional implications and the responsibility of decision-makers to exercise informed judgment.

Five Questions Decision-Makers Should Be Asking

The following questions offer a practical starting point for institutional reflection:

1. Corruption Exposure: Do we understand where corruption risks are most significant within our institution, operations, transactions, and third-party relationships?
2. Governance and Authority: Are responsibilities for high-risk decisions clearly assigned, and can we demonstrate that supervision and oversight operate effectively?
3. Internal Control: What evidence supports management’s assertions that our anti-corruption controls are properly designed, implemented, and operating effectively?
4. Reporting and Accountability: Are suspected misconduct and control failures reported, assessed, escalated, and addressed without inappropriate interference or retaliation?
5. Professional Competence: Do the individuals entrusted with governance, management, supervision, and approval possess sufficient knowledge and judgment to recognize corruption risks and challenge inadequate explanations?

These questions are not a legal compliance checklist, nor do affirmative answers establish compliance with the Directive.

Rather, they are intended to help decision-makers begin a more disciplined assessment of institutional readiness and corruption prevention capacity.

The Responsibility of Decision-Makers

Directive (EU) 2026/1021 is an important legal development. Its implementation will require attention from legislators, regulators, enforcement authorities, public institutions, and private-sector organizations.

Its broader significance, however, lies in the opportunity to strengthen the quality of corruption prevention and institutional accountability.

For private-sector decision-makers, this means examining how corruption risks are identified and managed, whether governance and internal control arrangements are effective, and how leadership exercises supervision.

For public-sector decision-makers, it means strengthening integrity, professional competence, responsible decision-making, preventive safeguards, and accountability in the exercise of entrusted authority.

The American Anti-Corruption Institute (AACI) considers the competence of decision-makers, effective internal control, and accountable governance fundamental to strengthening corruption prevention.

The Directive provides a timely reason for institutions to examine these matters with greater seriousness.

The ultimate test of an institution’s corruption prevention arrangements is not whether it can demonstrate that policies and procedures exist. It is whether those arrangements help decision-makers identify corruption risks, exercise effective oversight, and respond responsibly when weaknesses or warning signs emerge.

That is a governance responsibility worth addressing before an institutional failure occurs.