Every adviser is telling general counsel that the EU Anti-Corruption Directive changes their exposure. Far fewer will say what the work costs, how long it takes, or which parts can wait. Here is the whole shape of it.
Since the Council adopted the Directive on Combating Corruption in April, the advisory market has produced a great deal of alarm and very little arithmetic. General counsel at mid-market companies know their exposure has changed. What they are not being told is what closing it involves, in weeks and in dollars, and what can safely wait until 2027.
This is that answer, drawn from how the work actually runs.
Most companies have one. Most were built around the FCPA, which means they ask where the company meets public officials and stop there. The Directive criminalises commercial bribery between private parties and trading in influence, so the assessment has to be re-scoped around conduct rather than counterparty status.
For a company operating in six to eight markets, that is three to four weeks of work: interviews with the country managers and sales leadership, a review of the intermediary population, and a scored register you can put in front of a board.
Shorter than it looks. The policy definitions change, any facilitation-payment allowance comes out, and the gifts and hospitality thresholds get restated in terms of conduct. One to two weeks. The real cost is not drafting, it is retraining the people who have been applying the old test for a decade.
The longest piece, and the one that matters most. Intermediaries appear in the large majority of reported enforcement actions, and the controls that address them are the ones mid-market companies have least of: tiering before engagement, verified beneficial ownership, contract clauses carrying audit and termination rights, and payment matched to evidence of work delivered. Six to ten weeks for a company with a few hundred active third parties, and it can run in parallel with everything else.
Documentation is not the paperwork at the end of the project. It is the deliverable. The Directive treats effective compliance measures as a factor in mitigation, which means the question is never whether you had a programme but whether you can show what it did and when. Build the evidence trail as you go and it costs nothing. Reconstruct it after an allegation and it may not be possible at all.
Member States have until mid-2028 to write the Directive into national law, and the obligations that will actually bind you are the national ones, not the Directive itself. So the sequencing is not urgent in every direction.
What cannot wait is anything involving a third party you have already engaged. Renegotiating contract terms takes a renewal cycle. Verifying ownership on a relationship a decade old takes patience and a commercial conversation. Those run on the counterparty's timetable, not yours, which is why they start first.
What can reasonably wait is fine-tuning the policy language to the transposition law of each Member State. That text does not exist yet in most of them. Build to the Directive's floor now and adjust when the national law lands.
If you do nothing else before the end of the year, tier your intermediaries. Not due diligence on all of them, not a new system: a list of every agent, distributor, consultant and customs broker, sorted by the risk each presents, built from the vendor ledger and a conversation with each country manager.
It takes about two weeks. It tells you where the exposure actually is, which makes every subsequent decision cheaper. And if something surfaces before the programme is finished, it is the document that shows you were looking.
For the legal analysis of where a US-built programme falls short of the Directive, see Your FCPA programme will not satisfy Brussels on Oben Legal.
Themis Advisory Group builds and stress-tests anti-corruption programmes for companies with operations or customers in the EU and UK. Tell us where you stand and we will tell you what the work would involve, at no charge.