📝From Clause to Clause: the Emergence of a Contractual Compliance System

MAFR.Law,Compliance,Regulation – English issue of the Newsletter of 26 September 2026

In the series of colloquia that the Journal of Regulation & Compliance(JoRC) is co-organising in 2026 on the theme Compliance et Contrat (Compliance and Contract), 🧱⚙️ see the presentation of the series

the colloquium co-organised with the Université Jean Moulin Lyon 3, and more specifically the Équipe Louis Josserand, under the scientific direction of Marie-Anne Frison-Roche and Jean-Christophe Roda, was held in Lyon on 25 September 2026. Its theme was:

LA CONTRACTUALISATION DE LA COMPLIANCE : CLAUSE APRÈS CLAUSE(THE CONTRACTUALISATION OF COMPLIANCE: CLAUSE BY CLAUSE)

It was held in French

🌐 see the programme and all the reports

The speakers were Marie-Anne Frison-Roche, Professor of Regulation and Compliance Law, Director of the Journal of Regulation & Compliance(JoRC) and of the European School of Regulation and Compliance Law (EeRC); Jean-Christophe Roda, Professor at the Université Jean Moulin Lyon 3, Director of the Centre de recherches Louis Josserand; Thibaut Duchesne, Professor at the Université Jean Moulin Lyon 3; Julia Heinich, Professor at the Université Paris 1 Panthéon-Sorbonne; Joseph-Antoine Morin, Professor at the Université de Reims Champagne-Ardenne; Grégoire Leray, Professor at the Université Côte d’Azur; Ludovic Pailler, Professor at the Université Jean Moulin Lyon 3; Laura Sautonie-Laguionie, Professor at the Université de Bordeaux; Morgane Tirel, Associate Professor (Maître de conférences) at the Université Paris-Saclay; Thibault Goujon-Béthan, Professor at the Université Jean Moulin Lyon 3, Director of the CPC2.

The proceedings were organised in four sessions, of which a first, brief synthesis can be offered.

I. PROLÉGOMÈNES : CLAUSES DE CONFORMITÉ ET CLAUSES DE COMPLIANCE (PROLEGOMENA: CONFORMITY CLAUSES AND COMPLIANCE CLAUSES)

We benefited from 2 presentations.

🔴 Marie-Anne Frison-Roche, Unicité et Diversité des clauses de Compliance : vers un Système Contractuel de Compliance (Unicity and Diversity of Compliance Clauses: towards a Contractual Compliance System)

I opened the proceedings by showing that the “Compliance clause”, a new expression that appears in no legislation, is barely more than a catch-all name: a single term for very varied stipulations. As for the Compliance Obligation, one must distinguish, classify and name, so that the drafter knows what he stipulates and the judge what he/she interprets.

The unicity is at first only apparent, through the lumping together of the stipulation with the legislation. The general clause, which obliges the other party to comply with the Law, has a pedagogical and evidential virtue, but it consolidates the legal obligation without ever discharging it: it is only a starting point. As for the clauses that trace a body of rules (GDPR, French Sapin II or Vigilance Act, CSRD, etc.), they lose the margin where contractual art begins. The fault lies with the “regulations-maker”, who presents the contract as a sort of delegation, whereas Compliance Law is the hallmark of a liberal economy, not of an administered economy.

The diversity of stipulations is, by contrast, real: de jure through contractual freedom, de facto through their porosity to the body of rules concerned, to foreign systems and to the subject matter of the contract. It must be channelled through a nomenclature: between the conformity clause and the Compliance clause, the difference is one of nature, not of degree; obligation of result or of means; “plain sailing clauses” and “heavy weather clauses” (clauses de « vent calme » et de « grand vent »); clauses between the parties or beyond them. This diversity stems from the very activity of the contracting parties: it must not be reduced, but preserved and developed.

The deep and programmatic unicity lies in the systemic goals served (Compliance Monumental Goal), which remain stable and common to both parties. Writing the goal into the clause, making the times of the Legislator, of the Judge, of the industrial project and of the contract converge, stipulating the proof: this is how a Contractual Compliance System must be built, tailor-made for each crucial operator.

🔴 Jean-Christophe Roda, Utilité comparée des clauses de conformité et des clauses de Compliance (Comparative Usefulness of Conformity Clauses and Compliance Clauses)

Jean-Christophe Roda then showed that the conformity clause follows a normative and rather static logic: a norm exists elsewhere, and the contract requires the other party to respect it. The Compliance clause follows a teleological, dynamic and organisational logic: the contract organises the means of preventing, detecting and dealing with a risk. The former contractualises a norm; the latter contractualises a mechanism, a genuine micro-architecture of risk governance.

He proposed a gradation finer than a binary opposition: simple conformity, which refers to the applicable law; reinforced conformity, which adds representations and warranties, notification, registers, audit and a termination clause; and finally Compliance, whereby the contract builds a system (periodic due diligence, training, flow-down, whistleblowing, graduated remediation). The move from one to the other is qualitative: an accumulation of obligations does not make a mechanism.

American contractual practice shows this move from “comply” to “govern”, and French case law already encounters these mechanisms without using the name: in the Biomet case (Paris Court of Appeal, 30 November 2017), the process itself becomes the object of contractual obligations; in the Orange case (Paris Court of Appeal, 16 June 2022), the company’s internal anti-corruption policy becomes enforceable against the other contracting party.

His conclusion is that the criterion is architecture, not subject matter. An anti-corruption clause may be no more than a conformity clause; an environmental or human rights clause becomes a Compliance clause when it organises prevention, information, control, remediation and proof.

II. LES CLAUSES DE COMPLIANCE VISANT L’INFORMATION (COMPLIANCE CLAUSES CONCERNING INFORMATION)

We benefited from 3 presentations.

🔴 Thibaut Duchesne, Les clauses de compliance relatives à la transmission de l’information (Compliance Clauses relating to the Transmission of Information)

The speaker showed that the transmission clause is a link in the chain, which contractual freedom makes it possible to build with precision. First, the information that is qualitatively relevant for the company, in view of its activity, must be designated. The formula “any relevant information” is too indeterminate. It is better to settle relevance by annexing indicators, such as the sustainable value indicators of sustainability bonds, and also to provide for transmission to the very end of the chain (flow-down).

Next, the information must not be distorted, as the debtor may be tempted to summarise it: it is preferable to provide for the transmission of raw information. The clause must provide when it is to be transmitted, by setting a term, as NIS 2 does, or by referring to the materialisation of a risk, with a time limit. Finally, it must provide the channels of transmission according to the information, and their security, and designate its recipients. The risk of a break in the chain must also be prevented: if N-2 does not transmit to N-1, N-1 must be able to question it in case of doubt.

The clause must also settle its performance, its proof, non-performance and its sanction, a penalty clause possibly proving effective.

🔴 Jean-Christophe Roda, Les clauses de compliance relatives à la confidentialité et à la non-transmission d’information (Compliance Clauses relating to Confidentiality and the Non-Transmission of Information)

Jean-Christophe Roda then developed an initial paradox: information is a prerequisite for action, but its circulation may itself create the risk. The goals of Compliance push information upwards (whistleblowing, audit, reporting), whereas some information only achieves its purpose if it does not circulate freely. He demonstrated that Compliance commands neither transparency nor secrecy: it commands a purposive circulation of information.

American experience shows that secrecy may run counter to Compliance: confidentiality agreements have obstructed reporting to the regulator (the KBR and BlueLinx cases before the SEC). Hence the “compliance carve-out”: a good Compliance confidentiality clause organises the situations in which it ceases to be enforceable.

The French Sapin II Act leads to a hierarchy of secrets: the secret that can be lifted, which contractual confidentiality cannot on its own set up against a whistleblowing report; the hard core (national defence, medical secrecy, lawyers’ professional secrecy, etc.), outside the whistleblowing regime; and the new secret that the report itself generates, to protect the whistleblower and the functioning of the mechanism.

Secrecy then becomes an instrument of Compliance: protection of the whistleblower, effectiveness of the internal investigation, secrecy of cybersecurity vulnerabilities, protection of the audited worker. The nuclear sector is the paradigmatic case: there the contract organises the “need to know”, with the twofold obligation not to transmit to unauthorised persons and to transmit without delay any compromise to the legitimate recipient.

The speaker could thus conclude by returning to the distinction between the conformity clause and the Compliance clause. The conformity clause says “this information is confidential”; the Compliance clause organises why, to whom, when and how the information must circulate, or not circulate. The contract no longer builds a wall around information: it organises its switching points.

🔴 Marie-Anne Frison-Roche, La clause d’audit, carrousel de la contractualisation de la Compliance (The Audit Clause, Carousel of the Contractualisation of Compliance)

I then gave a presentation on “Les clauses de Compliance relatives à l’audit” (Compliance Clauses relating to Audit). The audit clause is the stipulation most frequently cited for the assessment of third parties: 69.4% of companies subject to the obligation stipulate it (Agence française anticorruption – AFA (French Anti-Corruption Agency) survey, 2024). A single technique serves three purposes: securing the interests of one party; being the necessary accessory to the conformity of one party; being the necessary accessory to Compliance, so that both contribute to preserving the systems. For the Compliance Obligation requires “detecting”, and therefore being informed; yet the information lies with others: the entity subject to the obligation must obtain through the contract the legitimate power to access it. The audit clause is the very example of a clause which makes it possible, by turning the third party into a party, to go and act within that third party, even to act there as if one were at home.

Within the clause, four objects must be determined: what information (from which persons, on which documents, in which places); what trigger (a periodicity aligned with accountability reporting, or a red flag); who conducts the audit (the concentric circles of its burden); and according to what arrangements. The criterion is proportionality: the further the audit departs from legal normality, the more it must be justified and accepted. Its limits must also be built in from the outset, as they become the justifications of its outcome, together with its risks: the tacit obligation to carry it out, the objection drawn from the rights of the defence, the use of the report as a strategic weapon.

Outside itself, the audit clause is correlated with all the other clauses. Backed by a conformity clause, it makes it possible to verify; backed by a Compliance clause, it makes it possible to strike, but also to collaborate towards the same Goal. Finally, it makes it possible to ally with the third parties concerned, a European expression of Compliance Law. The judge will have to interpret it according to its purpose.

The audit clause thus appears as the “carousel” of the contractualisation of Compliance: where this contractualisation is woven, where conformity and Compliance are distinguished, where the judge contributes to the deployment of Compliance Law.

III. LES CLAUSES DE COMPLIANCE VISANT L’EXÉCUTION DU CONTRAT (COMPLIANCE CLAUSES CONCERNING THE PERFORMANCE OF THE CONTRACT)

We benefited from 4 presentations.

🔴 Julia Heinich, Les clauses de compliance relatives à l’évolution des circonstances (Compliance Clauses relating to Changes in Circumstances)

The speaker showed that these clauses, which belong to the ordinary law of performance, can become Compliance tools: adaptation clauses make it possible to give the contract purposes, those of the Monumental Goals.

The force majeure clause (Article 1218 of the French Civil Code) is already used in Compliance matters. In its judgment of 10 July 2020, the Assemblée plénière of the French Court of cassation held that a bank whose assets had been frozen for almost nine years could not invoke force majeure to escape the payment of late-payment interest: the freeze, imposed because of its own activities, lacked externality. From a drafting point of view, Compliance events must therefore be included in or excluded from the list in the clause, and the value of that list must be specified – exemption from proof or not – along the lines of the simple presumption attached to the ICC list. An impossibility of performance resulting from a Compliance obligation, such as a vigilance plan, will probably not constitute force majeure: this must be specified in the clause, or that characterisation excluded.

Hardship, unforeseeability and adaptation clauses could take into account the additional burden, if significant, that performance of the legal obligation represents. Exceptional circumstances are required, but this is probably possible through an adaptation clause. The adaptation of the contract then fits into the dynamic conception of the Compliance clause.

🔴 Joseph-Antoine Morin, Les clauses de compliance visant à obtenir des comportements adéquats (exemple des relations sociales) (Compliance Clauses aimed at Obtaining Appropriate Behaviour – the Example of Employment Relations)

The speaker showed that the Compliance Monumental Goal is not “exchanged” in the employment contract. The Compliance clause does not exist there, because the employer holds the power and does not need it to achieve the goal: it is a “useless clause for the employer”. Within the company, the employer mobilises numerous legal instruments to give effect to Compliance Law, such as charters, but does not use the employment contract. And the speaker considers that, at first sight, doing so would not be the most appropriate approach.

By contrast, the clause is useful to the employer in its business contracts. The company may insert in them, on Compliance grounds, rules governing the working relations of persons who are not in an employment relationship with it. This is an interference in the management of the other party, which raises the question of the judge who reviews it. Some would argue for a requalification, going as far as a situation of co-employment; others invoke the autonomy of persons and the privity of contracts.

🔴 Grégoire Leray, Les clauses de compliance visant à obtenir l’efficacité des plans de gestion des risques (Compliance Clauses aimed at Securing the Efficacy of Risk Management Plans)

The speaker asked under what conditions the contract genuinely makes the other party contribute to the efficacy of the risk management plan: the plan identifies the risk, the contract allocates the tasks intended to limit its occurrence, the judge or the regulator ensures that the obligations are met.

On the basis of a corpus of clauses drawn in particular from the duty of vigilance (EQUANS, Savelys, LEHVOSS, Danone, FARO, Microsoft, Google), he distinguished two drafting techniques. “Ready-to-wear” refers to the plan or to a standard, at the risk of a boilerplate clause, which nonetheless has pedagogical virtues. “Tailor-made” adapts the obligation to the risk, to the sector and to the position of the partner, and offers a materially performable obligation. The two can be combined.

He proposed a systematisation: an architecture (plan, relay document, incorporation clause, contextual specifications) and an eight-point template (goal, scope, prevention, information, proof, control, remediation, breach). A well-conceived clause organises a virtuous circle: the performance of the contract brings up the information that leads to modifying the plan, which is then imposed on the partner.

But contractual precision also becomes a yardstick of the expected conduct, as the Erika judgment showed: it increases the company’s legal exposure. And the sanction, though necessary, remains a point of fragility, as the breach may become a bargaining chip in commercial negotiation, to the detriment of the Compliance purpose.

🔴 Ludovic Pailler, Les clauses de robustesse (Robustness Clauses)

The speaker described the “robustness clause” as the one that requires one of the contracting parties to ensure the robustness of one of the elements of the system. It is found in particular in the general terms and conditions of artificial intelligence companies, and the word is key in cybersecurity. As a risk management instrument, it may shift this burden onto someone who does not always bear it, or who comes to help. It makes it possible to manage what someone other than the entity subject to the legal obligation can do – for example the user of personal data, even though that user is the person protected by the system. Can this method release the former from sanction?

These clauses are not mandatory, but they may be necessary to complete the Compliance mechanism, Article 24 of the GDPR not referring to the contract. The clause informs the other party, who lies outside the scope of the regulations, of its role, thereby fostering in particular “digital hygiene”.

It enables the entity subject to the obligation to occupy the field beyond the regulations by “caging” the other party, for example through multi-factor authentication or the requirement of sufficient password entropy. It has evidential force, since it feeds documentation, and normative force, since the consent obtained novates the legal obligation into a contractual obligation. The clauses thus arrange responsibilities, but the robustness clause cannot transfer the liability of the entity subject to the obligation.

IV. LES CLAUSES DE COMPLIANCE VISANT LA PRÉVENTION ET LA GESTION ANTICIPÉE DES CONFLITS (COMPLIANCE CLAUSES AIMED AT PREVENTING AND MANAGING DISPUTES IN ADVANCE)

We benefited from 3 presentations.

🔴 Laura Sautonie-Laguionie, Les clauses de compliance relatives aux sanctions (Compliance Clauses relating to Sanctions)

The speaker showed that sanction clauses are valid even where the conduct targeted is not wrongful: it suffices that the other party has not adopted the merely preventive conduct expected of it.

Should they therefore be used systematically? Laura Sautonie-Laguionie considers that, depending on the countries in which the other party operates, the sanction may be delicate, or even illusory. It is thus noteworthy that, for the European directive on the duty of vigilance, the solution is suspension rather than sanction.

Contracts contain few penalty clauses, probably for fear of litigation: the damage, linked to a risk, is difficult to assess, and the judge will probably reduce the penalty. The clause must therefore be drafted with care, so as not to incur the characterisation of significant imbalance: it must be made bilateral.

🔴 Morgane Tirel, Les clauses de compliance relatives à la remédiation (Compliance Clauses relating to Remediation)

The speaker started from what “remediation” generally means, and therefore in Anglo-American law: a “right to cure”. This right of the debtor to correct its breach before the creditor sanctions it is found in the UNIDROIT Principles and in the Vienna Convention. The remediation clause compensates for the absence of this mechanism in French law. Model clauses exist (American Bar Association, European Commission, universal registration documents). They are developing in the legal vigilance tool, to which remediation is inherent, in a very broad conception taken up by the CS3D.

In its “correction” component, the clause is both graduated and bilateral. The breach is notified, then a plan is drawn up. A reasonable period is allowed for correction, and termination occurs only in the event of failure. The principal is entitled to require this plan, whereas classical law gives this power to the debtor. At its heart: the remediation period and quantitative and qualitative indicators. A single 30-day period for every type of breach, as at Shein, is excessive. Differentiated periods are needed, punctuated by assessments, together with objective recovery criteria, which presupposes internal standard-setting, as within the Danone Group. Affected persons must be involved in the process and in the finding of its success. And the creditor itself must help: this bilaterality takes the clause away from the “right to cure”.

In its “reparation” component, reparation is defined very broadly: compensation, reimbursement of expenses advanced, restoration of the damaged environment. The issue is then the allocation of the cost and the monitoring of performance. This component is for the moment little developed, since the regulations impose reparation only on its author. The available models moreover exclude third-party beneficiaries, even when they are affected.

The speaker thus concluded that the remediation clause is in no way a “right to cure”, stressing that what separates it from one is above all its purposes.

🔴 Thibault Goujon-Béthan, Les clauses de compliance relatives à la procédure, à l’expertise et à la mise en état (Compliance Clauses relating to Procedure, Expert Assessment and Pre-Trial Case Management)

The speaker pointed out at the outset that the category of “procedural clauses” is very broad, to be analysed in relation to the Judge, who is always called upon to intervene. To achieve the Compliance Monumental Goals, an alliance is needed, not merely obedience, and the situation in which the dispute arises must be known.

First, there are the clauses that procedurally enable alliances. Before the court is seised, mediation, negotiation, escalation or conciliation clauses give rise to a plea of inadmissibility. They have an affinity with Compliance: they produce a dialogue different from that of the trial, bearing on substance, and mediation builds the future better, the object of Compliance Law. Pre-trial case management clauses are new: in French Law, the 2025 pre-trial management agreement organises only burdens, not contractual ones. Ex Ante clauses could feed it, in order to obtain priority listing, eliminate procedural incidents, or even reach an agreement on the merits.

Next, there are the clauses that procedurally enable the search for truth, which is very important in Compliance whereas it is not central in civil proceedings. This search is facilitated by the contractual expert assessment clause, before the trial (a substitute for Article 145 of the French Civil Procedure Code) or during it. Since the French 2025 decree, the judge may intervene to make it work, and it has the same value as a court-ordered expert assessment. This contractual search for truth is fed by the statements of the parties and of witnesses, enhanced by the ability to create evidence ex novo.

Finally, truth must serve truth, through the publicity of the trial and of the judgment: the clause lifting the confidentiality of the ADR process, stipulated before or within the agreement, may contribute to this. So does the mandatory homologation clause, an undervalued mechanism which gives enforceability to this contractual instrument that takes hold of the future: in this respect, it is a perfect instrument for Compliance Law.

Some observations by way of synthesis

Having had the good fortune to listen to these excellent presentations, reported here, I was struck by their convergence and complementarity.

When the contractualisation of Compliance is approached through clauses, it appears ordered by its purposes. The contract thus mirrors Compliance Law itself, a teleological branch of Law: what holds for regulations holds for contracts. Thus the conformity clause contractualises only a norm (which is no small thing), whereas the Compliance Clause contractualises a mechanism, even a System invented by the company itself.

Information is the key: it must be transmitted raw and to the very end of the chain, its switching points must be organised up to secrecy, and it must be sought out from the other party through audit. Performance is the place for adaptation to circumstances, for obtaining behaviour, for the efficacy of risk management plans and for robustness, which makes the other party an actor in the system. Disputes are prepared for through sanction, remediation, procedure and expert assessment: “calm-weather” clauses and “high-wind” clauses must be tied to one another.

Techniques certainly vary according to the contract, the sector and the period, but the goals are constant and systemic in nature. In this “Compliance Clause”, thus identified, the system is incorporated through the will of the company and of all its partners, through the use they make of their contractual freedom, joining the political ambitions of Compliance Law. Crucial operators are thus at the centre, able to build Contractual Compliance Systems, tailor-made, to give effect to political ambitions, protect systems, protect human beings and support the Rule of Law.

Ordinary Contract Law thus consolidates the unicity of Compliance Law which, beyond the multiplicity of regulations (Sapin II, NIS 2, FCPA, etc.) and techniques (Vigilance, audit, etc.), allows this Ex Ante interweaving to take hold of the future.

TO GO FURTHER

This colloquium continues in the colloquium of 7 October 2026, 🧮 Compliance et Droit commun des contrats (Compliance and General Contract Law), organised by the JoRC and the Institut de Recherche Juridique de la Sorbonne (IRJS) of the Université Paris 1 Panthéon-Sorbonne.

The contributions from this colloquium will form a chapter of the book 📕Compliance et Contrat(Compliance and Contract), published in the Régulations & Complianceseries and co-published by the JoRC and Éditions Lefebvre-Dalloz.

____

follow Marie-Anne Frison-Roche on LinkedIn

follow Marie-Anne Frison-Roche on Instagram

subscribe to the Newsletter MAFR Regulation, Compliance, Law

subscribe to the Video Newsletter MAFR Surplomb

subscribe to the Newsletter MaFR Droit & Art