I. Introduction
On 29 September 2026, the Tribunal Judiciaire of Paris ordered the Spanish company Swiftair to pay a fine of 225,000 euros for involuntary manslaughter following the crash of flight AH5017 in 2014, in which all 116 people on board died.
In Spain, however, the same events led to proceedings that ended in a dismissal. The company could not even be investigated, because negligent homicide is not among the offences referred to in Article 31 bis of the Spanish Criminal Code (CP). The French court made this explicit when it rejected the non bis in idem objection to the company's criminal liability. It reasoned that, since Spanish law does not allow legal entities to be prosecuted for negligent homicide, the company ran no risk of being convicted twice.
The comparison is particularly telling: the same facts, attributed to the same entity, receive opposite criminal responses in each legal system. This raises two questions, which are the subject of this article. The first is whether a legal entity can be convicted of negligent homicide in Spain and, if not, what the legal basis for that impossibility is. The second is whether the numerus clausus system that leads to this result is justified.
II. The French judgment
The court applies Articles 121-3 and 221-6 of the Code pénal. The key lies in Article 121-3. Since the loi Fauchon (2000), an individual who causes harm indirectly is only liable if their negligence is qualified (faute délibérée or faute caractérisée), whereas for a legal entity any imprudence or negligence (faute simple) is sufficient, whether causation is direct or indirect.
French law therefore makes it easier to convict the organisation than its managers. Under Spanish law, by contrast, a legal entity cannot be liable for negligent homicide, so the criminal response falls exclusively on individuals.
In this case, the court found four instances of negligence in pilot training proven: the absence of a periodic check of the captain on the anti-icing systems, the lack of recent experience after months of inactivity, only a brief review of the procedure for erratic engine readings, and no training in recovery from engine power loss. This last shortcoming had reportedly already been identified in an IOSA audit in October 2013. Swiftair itself set a deadline to correct it by January 2014 and yet did not do so.
The court summarises this as a négligence générale dans la formation: not the negligence of a specific person, but an organisational defect of the company, a general negligence.
To establish causation, the court repeats the same formula: the company a créé les conditions for the crew's error, that is, it created the conditions that made the failures possible. This reasoning has a weak point that the appeal will foreseeably exploit. The court itself acknowledges that the cockpit voice recorder was unusable, so the crew's conversations in the cockpit could not be established. Without them, it admits, it is impossible to know why the pilots did not activate the anti-icing system. Nevertheless, it states that the causal link is certain (certain). The fine imposed, 225,000 euros, is the maximum provided for by law (Article 131-38 in conjunction with Article 221-6 of the Code pénal).
III. Article 31 bis CP: a gateway clause
In our view, Article 31 bis.1 CP contains two rules. The first is in its opening words: legal entities shall be criminally liable "in the cases provided for in this Code". This means that a company is only liable for offences where the Code itself expressly says so. It is a selection rule: it decides which offences can be attributed to a company, through specific clauses spread across the Special Part of the Code.
The second, in letters a) and b), is an attribution rule: it decides how an offence committed by an individual, whether a manager or a poorly supervised subordinate, is transferred to the company. The first conditions the second. If the offence is not in the catalogue, the attribution rule is not even examined, however serious the organisational defect or the outcome.
The catalogue focuses on economic crime, corruption and some offences of collective risk (environment, radiation, explosives, public health). Excluded are negligent homicide and negligent bodily harm (Articles 142 and 152 CP) and offences against workers' safety (Articles 316 and 317), for which Article 318 only provides for the ancillary consequences of Article 129, not criminal liability in the technical sense.
The exclusion does not cover all negligence. Negligent money laundering (Article 301.3) or negligent environmental offences (Article 331) may fall within it, although the point is disputed. The legislator thus accepts corporate negligence when it harms property or the environment, but not when it harms life.
IV. The Swiftair facts under Article 31 bis
If the facts proven in Paris are tested against each requirement of Article 31 bis, the attribution rule is fully met.
Crew training is a core obligation of an air operator, so the negligence occurs in the course of the company's business and on its behalf. The benefit requirement, traditionally problematic in negligent offences, is also met if it is linked to the conduct rather than the outcome: nobody benefits from an accident, but a company does benefit from training less. The court stresses that the training deficiencies further reduced the time devoted to training. We believe this is the only reading consistent with the presence of negligent offences in the catalogue.
The serious breach of supervisory duties under letter b) finds almost perfect proof in the IOSA audit: a risk that was detected, acknowledged, dated and not corrected. For the same reason, the compliance exemption (Article 31 bis.2 to 5) would not succeed either. An ignored manual and an unexecuted corrective plan show a model that existed only on paper.
And yet none of this matters, because Article 142 CP does not refer to Article 31 bis. The only requirement that fails is the only one that does not depend on the company's conduct, but on the legislator's choice.
V. The reasons for the numerus clausus
Neither Organic Law 5/2010 nor Organic Law 1/2015 explains, as far as we know, why negligent homicide was excluded. The reasons can be reconstructed.
The first is historical. The 2010 reform largely responded to European and international obligations requiring legal entities to be sanctioned for specific offences: corruption, money laundering, trafficking, terrorism, environment. The catalogue is more an inventory of commitments than a theory of which offences are typical of organisations. No instrument required negligent homicide to be included, and it was not.
The second is doctrinal: the catalogue made it possible to introduce gradually an institution that broke with the principle societas delinquere non potest. France did the same. Its 1994 Code pénal also required an express provision for each offence, until the loi Perben II generalised the system in 2005.
The third is legal certainty (Article 25 of the Spanish Constitution): a closed catalogue allows a company to know its criminal risk and design its compliance on a defined map.
VI. Critical assessment
These reasons justify the existence of a catalogue, but not its current content.
The system measures a company's criminal risk by the nature of the offence and not by the nature of the organisational defect. A company is liable for subsidy fraud by a poorly supervised employee, but not for more than a hundred deaths caused by deficient training that was audited and not corrected. It is liable for endangering life with explosives or radiation (Articles 343 and 348), but not for destroying it.
Moreover, serious accidents are the organisational offence par excellence. Blame is spread across departments and years and becomes difficult to pin on any one individual. This is the so-called organised irresponsibility that corporate criminal liability was meant to address; excluding it precisely here means giving up its main function. And letter b) of Article 31 bis is already based on an organisational fault with a negligent structure: there is no explanation for why it can be used to attribute a fraud but not a death.
The serious objection is the risk of convicting a company for any accident through hindsight. The Swiftair case itself, with its causation reconstructed without a voice recorder, illustrates this. But that objection concerns how negligent homicide should be included, not whether it should be. The Italian model proves it: Legislative Decree 231/2001 has a closed catalogue and yet its Article 25-septies includes negligent homicide and bodily harm committed in breach of workplace safety rules.
VII. The transnational paradox
The Spanish catalogue did not protect Swiftair: it was the argument with which Paris rejected ne bis in idem. Technically, the stronger ground would have been the lack of identity of the person concerned required by Article 54 of the Convention Implementing the Schengen Agreement (CISA) and Article 50 of the EU Charter of Fundamental Rights. If the Spanish proceedings were not directed against the company, as they could not be, there can be no double prosecution. In addition, the CJEU denies that effect to decisions given without an examination of the merits (Miraglia, C-469/03; Kossowski, C-486/14), and it would be necessary to know whether the Spanish dismissal was provisional or final.
The practical conclusion is that the numerus clausus does not limit the real criminal risk of Spanish companies, only their risk before the Spanish courts. Victims find more criminal protection against a Spanish company in France than in Spain. Once final, the fine could even be enforced in Spain under Law 23/2014, a question that deserves separate study. For a group with operations abroad, compliance designed solely around Article 31 bis is incomplete compliance.
VIII. Conclusions
A company cannot be convicted in Spain of negligent homicide or negligent bodily harm. The obstacle is not the attribution criteria of Article 31 bis, all of which would be met in the Swiftair case, but its opening clause, which acts as a selection rule. The exclusion owes more to the origins of the reform than to a considered decision, is inconsistent with the rest of the catalogue and leaves organisational fault unanswered where it matters most. Nor does it protect Spanish companies outside Spain.
We propose adding Articles 142, 152, 316 and 317 CP to the catalogue, with three safeguards: limiting liability to outcomes caused in breach of safety rules, as in Italy; requiring the organisational defect to be proven independently rather than inferred from the outcome; and keeping the exemption for effective compliance. In the meantime, companies with international operations should build their risk map jurisdiction by jurisdiction. In the Swiftair case, the most compelling evidence did not come from the prosecution, but from the company's own records.
Frequently asked questions
Can a company be convicted of manslaughter in Spain?
No. Article 142 of the Spanish Criminal Code does not refer to Article 31 bis, so a legal entity cannot be investigated or convicted of negligent homicide. Criminal liability falls only on individuals, such as managers or employees.
Which negligent offences can be attributed to a legal entity in Spain?
Among others, negligent money laundering (Article 301.3 CP) and negligent environmental offences (Article 331 CP), although the point is disputed in legal scholarship.
Can a Spanish company be convicted abroad for an accident?
Yes. The Swiftair case shows it: a French court convicted a Spanish company for facts that could not be attributed to it in Spain. This is why a compliance programme for companies with international operations should assess criminal risk in each jurisdiction.
If your company operates in several countries and you want to review its criminal risk map, contact our team. Our white-collar crime team was named White Collar Crime Team of the Year by Iberian Lawyer.
