Common grammar of compliance

A "common grammar of compliance" is emerging in modern business law, a shared structure underlying various regulations such as anti-corruption laws, data protection, and corporate sustainability reporting. This framework identifies five key elements—risk identification, prevention procedures, designation of responsible persons, control of effectiveness, and documentation—that recur in all major compliance mechanisms.

Sapin II law and its architecture

The Sapin II law, aimed at transparency and anti-corruption, mandates eight measures for large companies, including risk mapping and internal control mechanisms. The French Anti-Corruption Agency (AFA) emphasizes the governing body's commitment and role clarity. This creates a foundational structure for compliance that includes risk identification, prevention, and documentation.

GDPR and the same framework

The General Data Protection Regulation (GDPR) follows a similar framework with its own terminology. It requires a register of processing and impact assessments for risk mapping, internal procedures for regulation principles, and a data protection officer to ensure compliance. Audits and accountability requirements mirror the structure seen in anti-corruption laws.

Duty of vigilance and CSRD

The duty of vigilance law requires large companies to identify risks in human rights and environmental issues and implement preventive actions. The Corporate Sustainability Reporting Directive (CSRD) also aligns with this structure, requiring double materiality analysis and the publication of sustainability information. Both emphasize risk identification, prevention, and documentation.

Legal illustration of the grammar

A 2026 court ruling on a parent company's failure to cover all subsidiaries in its vigilance plan highlights the importance of the grammar. The court found the risk mapping insufficient, underscoring the first of the five elements. This shows how the same framework applies across different legal areas.

Normative internalization

The shift in legal approach involves normative internalization, where companies are responsible for their compliance. This transforms companies from passive recipients of laws to active participants in ensuring compliance. This change is seen in laws like the Foreign Corrupt Practices Act (FCPA), which assigns compliance responsibility to companies.

Redefining social interest

French law, such as the PACTE law, redefines the social interest in company law, moving from solely shareholder interests to include social and environmental concerns. This shift is evident in the creation of companies with a mission, incorporating social and environmental objectives verified by third parties.

Practical implications and limits

The common grammar of compliance has practical implications for legal professionals, emphasizing the need for transversal tools, integrated governance models, and adapted commercial contracts. However, challenges include resource asymmetry between large and small companies and the complexity of overlapping regulations.

Tensions and challenges

Compliance faces tensions such as resource asymmetry, where SMEs struggle with the same requirements as large companies. Normative complexity arises from overlapping regulations, and the risk of compliance becoming a superficial formality without real change in practices. These challenges require careful navigation by legal professionals.

Conclusion and future outlook

The common grammar of compliance offers a coherent framework for understanding and applying new regulations. It allows legal professionals to anticipate how new laws will integrate risk identification, prevention, and documentation. This approach can transform compliance from a burden into a managed competence, as seen in well-prepared organizations.