Avoid These 7 Costly Mistakes Before the Launch of Sunshine Reporting in Italy

With the Sanità Trasparente portal currently in a testing phase and awaiting full operation following an official notice in the Gazzetta Ufficiale, the first submission cycle will be a decisive milestone. Law 62/2022 marks the beginning of a new era of public transparency in the relationships between companies and healthcare professionals (HCPs) and healthcare organizations (HCOs) in both the human and veterinary health sectors.

Yet many companies are still in a “wait and see” mode, assuming that further clarifications will arrive before taking action. This is a risky approach. Experience from established regulations such as the U.S. Open Payments system and France’s Loi Bertrand shows a consistent pattern: early preparation is the primary factor determining successful compliance with transparency legislation. Mistakes made today (unclear responsibilities, weak governance, insufficient quality controls) translate tomorrow into real costs: rejected XML files, large-scale corrections, delays, and potential scrutiny from regulatory authorities.

To help organizations start on the right foot, seven recurring critical issues can be identified ones to avoid before transparency obligations come fully into force.

1) Treating Sunshine Reporting as a “one-off” project

The most common (and most damaging) misconception is to treat Sunshine transparency as an annual activity to be addressed close to the deadline. In reality, it is a continuous discipline: data collection, validation, and approvals cannot be improvised. Transfers of Value (ToVs) span functions and intermediaries: grants, sponsorships, consulting, travel reimbursements, events, third-party agencies, clinical trials. It is also important to remember that there are three submissions per year.

To avoid this:
Establish a year-round compliance calendar: quarterly ToV reviews, early quality checks, and verification of report exports required from company systems (e.g., ERP, CRM). When Sunshine transparency becomes part of daily operations, the last-minute rush already experienced in other countries can be avoided.

2) Delaying the definition of roles and responsibilities

The regulation requires the identification of the person responsible for transparency; in some cases, a special power of attorney filed with the Chamber of Commerce may be required. Additionally, the “responsible” role does not necessarily coincide with the person who physically uploads XML files to the platform; they may be two distinct functions.

Technical guidance refers to delegation by the legal representative and user profiling as the “Responsible for data transmission to the Register.”

To avoid this:
Appoint roles now, not weeks before submission. Ensure that each stakeholder has access to and visibility across Legal, Compliance, and Finance. Particular attention is needed for multinational groups: even if data preparation occurs “outside Italy,” responsibility for submission remains with the Italian legal entity. Clear roles reduce confusion and strengthen governance in case of regulatory inquiries.

3) Overlooking governance and integration into the Model 231 framework

Sunshine compliance does not exist in isolation—it intersects with corporate administrative liability controls, including Legislative Decree 231/2001. If Sunshine procedures and controls are not integrated into the company’s governance system (including whistleblowing frameworks), the result is weak reporting with limited traceability and oversight.

To avoid this:
Formalize how data is collected, validated, approved, and archived; integrate these controls into the Model 231 (or equivalent frameworks). This not only protects the organization but also strengthens internal controls: clear assignment of responsibilities, defined escalation processes to senior management, and structured handling of deviations and anomalies.

4) Failing to test systems and XML readiness in advance

The Sanità Trasparente portal will only accept XML files compliant with official XSD schemas. Manual adjustments are not allowed: even a single anomaly can result in rejection of the entire file.

To avoid this:
Conduct testing well in advance. Run validation checks using the required tools long before the submission window opens. Align CRM (Customer Relationship Management) and ERP (Enterprise Resource Planning) systems—including SAP where applicable—with required coding standards: ISTAT codes, professional identifiers, and data naming conventions. Integrate XML validation into the workflow so formatting errors do not become last-minute operational blockers.

5) Underestimating data quality risks: duplicates and omissions

Duplicate records and missing data are among the most common causes of error. Even “minor” inconsistencies can undermine data integrity and the robustness of controls.

To avoid this:
Implement automated controls to detect duplicates and establish reconciliation routines across systems (e.g., Finance, contracts, CRM, events/agencies). Each ToV should appear once and only once—if properly recorded. Omissions, even unintentional ones, may be perceived as a lack of transparency. Proactive internal audits help prevent these issues.

6) Underestimating the “all-or-nothing” logic of data uploads

Unlike other contexts, Italian Sunshine Reporting does not allow partial corrections. If an error exists in the file, it may be necessary to delete and re-upload the entire submission. A single malformed line can affect thousands of records.

To avoid this:
Implement file version control and full traceability of submissions: securely archive each uploaded version, maintain a log of changes, and validate data in blocks (where possible) to reduce rework and troubleshooting time. Operational discipline today = days saved tomorrow.

7) Overlooking monitoring of high-risk interactions

Technical readiness alone is not sufficient. The context of Transfers of Value must also be evaluated. Increased scrutiny can be expected for ToVs occurring during sensitive periods, particularly around public procurement or tender processes.

To avoid this:
Closely monitor ToVs within defined time windows (for example, three months before and after key decisions or contract awards). Document the purpose and rationale for these transfers. A clear and consistent audit trail is often the best defense during inspections.

Preparing now, not later

Every compliance team understands the challenge of building a new operational framework while managing day-to-day activities. However, the structure of Italian regulation leaves little room for delay: XML validations, strict submission windows, and public data visibility require operational excellence from the very first submission.

Those who start early not only reduce risk—they turn transparency into a governance and control advantage. Those who wait, instead, expose themselves to rework, public corrections, and reputational risk.