Corporate Liability: Ruling 19096/2025 and the Attribution Criteria of Legislative Decree 231/2001

In the Italian legal landscape, corporate administrative liability, introduced by Legislative Decree of June 8, 2001, no. 231, is a matter of crucial importance for companies and professionals. This legislation has revolutionized how legal entities are held accountable for crimes committed in their interest or for their benefit by top management or subordinates. The recent Ruling no. 19096, filed on May 22, 2025, by the Supreme Court of Cassation, presided over by P. R. and rapporteur C. P., offers fundamental clarification on the attribution criteria for such liability, providing valuable guidance for understanding the actual scope of the entity's 'organizational fault'.

Legislative Decree 231/2001: A General Framework

Legislative Decree 231/2001 introduced a system of liability into our legal order that, while administrative in nature, is closely linked to the commission of crimes. The objective is to incentivize companies to adopt suitable organizational, management, and control models (MOG) to prevent the commission of criminal offenses. If a crime is committed by an individual acting for the entity (whether a manager or an employee) in the interest or for the benefit of the company, the latter may be held liable with pecuniary and disqualifying sanctions, unless it proves it has adopted and effectively implemented an adequate MOG.

Ruling 19096/2025: Crucial Clarification on Attribution Criteria

The Supreme Court of Cassation, with Ruling 19096/2025, partially annulled with referral the decision of the Court of Appeal of Milan of 13/05/2024, in the proceedings involving G. B. This pronouncement is particularly significant because it focuses on the prerequisites necessary to establish the entity's liability. The Court reiterated the importance of a 'qualified relationship' between the perpetrator of the predicate offense and the entity, going beyond a mere formal connection.

For the purpose of establishing administrative liability for the entity's own actions for crimes committed in its interest or for its benefit, a qualified relationship must exist between the perpetrator of the predicate offense and the entity. (In its reasoning, the Court specified that a functional relationship must exist between the perpetrator of the predicate offense and the company pursuant to art. 5, paragraph 1, letters a) and b), of Legislative Decree of June 8, 2001, no. 231, and that the conduct of the natural person is a consequence not so much of their subjective attitude, but of a precise 'negligent' organizational structure of the entity, to be understood in a normative sense, i.e., not compliant with the organization and management models provided for by articles 6 and 7 of the aforementioned Legislative Decree).

This maxim is illuminating. The Court of Cassation clarifies that the entity's liability does not automatically arise from the commission of a crime by one of its representatives. A 'functional relationship' must exist between the perpetrator of the crime and the company, as specified by art. 5, paragraph 1, letters a) and b) of Legislative Decree 231/2001. This means that the individual must have acted in a position that allowed them to operate in the interest or for the benefit of the entity. But that's not all. The Court emphasizes that the unlawful conduct of the natural person must be seen not so much as their isolated subjective attitude, but as the consequence of a 'precise 'negligent' organizational structure of the entity'.

Organizational Fault and Organization and Management Models (MOG)

The concept of 'negligent organizational structure' is at the heart of the decision. The Court of Cassation clarifies that such negligence must be understood in a normative sense, i.e., as a non-compliance with the organization and management models provided for by articles 6 and 7 of Legislative Decree 231. This implies that the entity is liable not because it intended the crime, but because it failed to adopt or effectively supervise the adoption of appropriate preventive measures. In other words, the entity's fault is a 'fault of organization'.

To avoid liability, the entity must demonstrate:

• That it adopted, before the commission of the act, organization and management models suitable for preventing crimes of the type that occurred.
• That it entrusted the task of supervising the functioning and compliance with the models to an autonomous body of the entity (Supervisory Body - OdV) with powers of initiative and control.
• That the OdV supervised effectively.
• That the crime was committed by fraudulently evading the organization and management models.

The ruling in question, also referencing important precedents (such as United Sections no. 11170 of 2015), reinforces the idea that the entity is not a mere 'bearer' of others' liability, but is liable for its own autonomous 'organizational fault'.

Conclusions: The Importance of Compliance for Businesses

Ruling 19096/2025 represents a further piece in the complex interpretation of liability under Legislative Decree 231/2001. It strongly reiterates that the mere existence of an Organizational Model is not sufficient; what matters is its actual suitability and implementation. Companies must therefore pay the utmost attention not only to the formal drafting of MOGs but also, and above all, to their constant updating, to the monitoring by the Supervisory Body, and to the dissemination of a culture of legality within the organization. Relying on expert professionals for consulting and implementing 231 models is no longer an option, but a strategic necessity to protect business integrity and continuity.