EU Anti-Corruption Directive: Implementation Status by Country

Directive (EU) 2026/1021 was published in the Official Journal of the European Union on 11 May 2026 and entered into force on 31 May 2026. Member States have until 1 June 2028 to transpose core obligations into national law, with a longer deadline of 1 June 2029 for national anti-corruption strategies and risk assessment obligations.

The directive applies to both the public and private sectors, covering conduct involving EU institutions, member state authorities, and private economic activity. There is no minimum company size threshold. Non-EU multinationals with operations or a meaningful commercial nexus in the EU are also in scope. Organisations should assess their exposure regardless of where they are headquartered. Denmark is not bound by this directive.

The directive requires Member States to criminalize seven categories of conduct: bribery in the public sector, bribery in the private sector, trading in influence, misappropriation, unlawful exercise of public functions, obstruction of justice, and enrichment from corruption offenses. Member States must also criminalize concealment of property derived from these offenses. The offenses apply whether or not they involve cross-border elements.

The directive establishes two tiers of fines for legal persons. For the most serious offenses, including bribery in the public and private sectors and misappropriation, fines may reach 5% of total worldwide annual turnover, or €40 million, whichever is higher. For trading in influence, obstruction of justice, and enrichment from corruption offenses, the maximum is 3% of total worldwide annual turnover, or €24 million. Member States may set higher penalties when transposing the directive into national law

Yes, the directive requires Member States to provide for prison sentences for individuals convicted of corruption offenses, ranging from three years for less serious offenses to five years for the most serious. Member States may impose higher penalties. Personal liability may extend to employees, managers, and senior executives where inadequate supervision contributed to an offense.

Yes. The directive applies regardless of where an organization is headquartered, provided conduct affects EU institutions, member state authorities, or entities operating in the EU. Companies with EU operations, EU-based subsidiaries, or significant EU customer and supplier relationships should treat the directive as applicable to them.

No. The directive sets minimum standards, and Member States are free to go further in a number of areas. Definitions, enforcement structures, penalty levels, and the treatment of mitigating factors will vary by country.

The directive does not impose a formal training obligation on private sector organizations. However, Article 13(2) establishes corporate liability where a lack of supervision made possible the commission of an offense by a subordinate, and Article 16(c) recognizes effective compliance programs and ethics awareness as a mitigating circumstance that directly reduces penalties. Training is a primary means of evidencing both. Organizations that invest in structured, evidence-based compliance programs are in a materially stronger legal position.

The directive replaces two earlier EU instruments: Council Framework Decision 2003/568/JHA on corruption in the private sector, and the 1997 Convention on corruption involving EU officials. It also reinforces the EU Whistleblowing Directive (2019/1937), which Article 25 explicitly incorporates. Organizations with existing anti-bribery programs built around the UK Bribery Act, US FCPA, or existing national anti-corruption legislation in their home Member States should assess how the EU directive affects their obligations across Member States.

Start with a structured gap assessment of your current anti-bribery and anti-corruption program against the directive’s seven offense categories, third-party risk procedures, and internal reporting channels. Documenting your compliance program is worthwhile at this stage, given that Article 16 creates a direct incentive to do so. Monitoring national transpositions in the Member States where your organization has the greatest exposure will be important as the map tracker is updated.

The directive’s liability framework extends to conduct carried out by third parties acting on an organization’s behalf. Where a business partner, agent, or supplier commits a corruption offence in connection with your organization’s interests, your organization may face liability. Documented third-party due diligence, covering assessment, monitoring, and evidence of both, is a direct compliance requirement under this framework.

The map tracker provides factual legislative information and does not constitute legal advice. Liberius is a Brussels-based law firm specializing in anti-bribery and anti-corruption, with deep expertise in EU regulatory frameworks. Their specialists advise organizations across the EU on how to prepare for and respond to the directive across multiple jurisdictions.