The Italian Sunshine Act: What Medical Device Companies Need to Know Before Their First Disclosure
Author
Ned Mumtaz is an international transparency reporting expert with extensive experience producing accurate and compliant transparency reports for over 150 pharmaceutical companies globally.
He has held leadership positions at Pfizer and Otsuka, distinguishing himself by ensuring high standards of accuracy, reliability, and regulatory compliance in reporting processes. He is recognized in the industry for his contributions to the development of global transparency models and for promoting operational best practices in compliance.
Cerchi supporto per la compliance al Sunshine Act?
Hai domande pratiche?
Dai un’occhiata alla nostra sezione Domande Frequenti per risposte chiare su scadenze, obblighi e strategie.
Your company may already have experience tracking and publishing transfers of value under the Confindustria Dispositivi Medici Code of Ethics. You may have built internal processes, trained relevant teams and published annual transfer-of-value information on an individual or aggregate basis, depending on the recipient, category and consent position.
That experience provides a valuable foundation. It does not, however, mean that the transition to the Italian Sunshine Act will be a minor administrative update.
If your medical device business falls within the Act’s broad definition of an impresa produttrice and operates in the Italian healthcare market, Law No. 62/2022 introduces a statutory framework with different scope, recipient-identification requirements, reporting cycles and enforcement consequences.
What the Confindustria Dispositivi Medici Framework Did—and What It Did Not
The Confindustria Dispositivi Medici transparency framework was an important step in formalising disclosure within the Italian medical-device sector.
It requires member companies to publish specified direct and indirect transfers of value to healthcare professionals, healthcare organisations and certain third parties. Relevant categories include participation expenses, professional-service fees, event funding and donations.
The framework already requires individual publication for several categories. For HCPs, however, transfers are published in aggregate where the professional has not consented to individual disclosure. Research and development expenditure, scholarships and certain transfers to third parties are also reported in aggregate.
The code expressly excludes transfers connected with promotional materials, meals, beverages and product samples from its publication requirement.
The result is a mixed individual and aggregate disclosure model. It provides meaningful visibility but does not always reveal the recipient-level detail behind aggregated categories.
How the Italian Sunshine Act Changes the Position
The Italian Sunshine Act was enacted through Law No. 62 of 31 May 2022.
The Ministry of Health subsequently published a draft implementing decree and technical framework for consultation. However, the Sanità Trasparente register and mandatory reporting process are not yet operational.
Once the implementing framework takes effect, the Act will move qualifying companies from an association-based disclosure system to a statutory reporting obligation.
Recipient-identifiable disclosure
Reportable transfers, conventions and agreements will generally need to be linked to the identifiable beneficiary or counterparty rather than disclosed only through company-level aggregate totals.
The required communication includes information such as the recipient’s name or corporate name and tax code, together with the date or reference period, nature, amount or market value and purpose of the relationship. Where applicable, professional-register details must also be included.
Unlike the association-code model, the statutory framework does not provide an equivalent route for converting recipient-identifiable disclosures into aggregate reporting merely because an individual withholds consent.
The Act treats entry into covered relationships or acceptance of covered transfers as consent to publication and processing for the law’s purposes. Companies must nevertheless provide appropriate privacy information and maintain GDPR-compliant data governance.
A broader statutory structure
The Act is not limited to the categories traditionally published under industry codes. It covers qualifying transfers of money, goods, services and other benefits, together with specified conventions and agreements.
Article 3(1) applies monetary thresholds to qualifying transfers and conventions. Article 3(2) separately covers agreements that produce direct or indirect advantages through participation in congresses, educational events, committees, commissions, advisory or scientific bodies, or through consulting, teaching and research relationships.
Companies must also distinguish these Article 3 relationships from the separate annual Article 4 disclosures concerning specified shareholdings, bonds and income from licences for the economic use of industrial or intellectual-property rights.
Intermediaries must be identified
One of the most operationally distinctive requirements is the identification of the intermediary who, on the company’s behalf, established the conditions of the transfer or agreement or managed the relationship with the beneficiary or counterparty.
Depending on the facts, the intermediary may be an external agency, CRO, consultant, distributor or other third party. It may also be an employee of the reporting company.
The determining factor is the role performed—not simply whether a person or entity processed an invoice, booked travel or appeared somewhere in the payment chain.
Where companies use third parties to arrange or manage HCP and HCO engagements, their data-collection processes will need to capture the relevant intermediary information.
Semiannual and annual reporting cycles
The statutory system will use a central telematic register and includes both semiannual and annual reporting obligations.
Once the reporting framework becomes operational, Article 3 communications will be due by the end of the semester following the semester in which the relevant transfer, convention or agreement occurred.
The separate Article 4 disclosures will be due annually by 31 January of the following year.
Draft technical materials envisage structured electronic transmission and detailed technical specifications. Companies should confirm the final format, schema and transmission requirements against the implementing framework in force when the register launches.
Where Medical Device Companies May Find Gaps
In our work with life sciences companies preparing for the Italian framework, several recurring operational challenges have emerged.
Data is distributed across systems and functions
Transfers of value and HCP or HCO engagements are rarely managed by one department.
Sales teams may arrange HCP training, marketing may manage congress activity, medical affairs or legal may oversee consulting arrangements, and finance may record the resulting payments. These functions may use different systems, including SAP, Concur, CRM platforms, event-management tools and spreadsheets.
Those systems may not have been configured to capture all of the fields and relationships required by the Italian statutory framework.
Bringing the information together into a consistent, traceable and technically usable dataset therefore requires clear ownership and deliberate coordination.
Recipient master data may be incomplete
The Act requires recipient-identifiable information for individuals operating in the healthcare sector, including the tax code and, where applicable, professional-register information.
Companies may find that their CRM or master-data systems contain missing tax codes, duplicate recipients, outdated information or records that do not align with the relevant professional-register details or other authoritative identification sources.
Resolving material identification discrepancies before reporting will be essential to producing complete and defensible submissions.
Third-party activity may not be fully captured
Companies frequently use agencies, event providers, CROs and other vendors to support HCP and HCO activities.
The data received from those providers may not contain the fields or structure needed for the Italian reporting framework. It may also fail to identify the person who established the terms of the relationship or managed the interaction on the company’s behalf.
Companies should consider defining these information requirements in contracts, statements of work and recurring data-exchange processes.
Starting Your Preparation Now
Early preparation can reduce the volume of data remediation, classification decisions and technical issues that must be addressed close to the first reporting deadline.
The foundations include:
- identifying relevant transfer, convention and agreement flows;
- assessing current processes against the requirements of Law No. 62/2022;
- defining ownership across compliance, legal, finance, medical affairs, commercial teams and IT;
- improving recipient master-data quality;
- establishing processes for capturing intermediary information;
- documenting classification and approval decisions; and
- preparing systems for structured technical reporting.
These capabilities are considerably harder to design, test and embed when work begins only shortly before a reporting deadline.
The statutory obligations and penalties are established, even though the final operational reporting process has not yet commenced. Companies that use this period to strengthen their data, processes and governance will be better positioned to manage the recurring Article 3 reporting cycle and the separate annual Article 4 process once the register becomes operational.
Have questions about where your organisation stands on Italian Sunshine Act readiness? Browse our expert answers and resources.
Stay informed about Italian Sunshine Act deadlines, implementation developments, webinars and events.
Your company may already have experience tracking and publishing transfers of value under the Confindustria Dispositivi Medici Code of Ethics. You may have built internal processes, trained relevant teams and published annual transfer-of-value information on an individual or aggregate basis, depending on the recipient, category and consent position.
That experience provides a valuable foundation. It does not, however, mean that the transition to the Italian Sunshine Act will be a minor administrative update.
If your medical device business falls within the Act’s broad definition of an impresa produttrice and operates in the Italian healthcare market, Law No. 62/2022 introduces a statutory framework with different scope, recipient-identification requirements, reporting cycles and enforcement consequences.
What the Confindustria Dispositivi Medici Framework Did—and What It Did Not
The Confindustria Dispositivi Medici transparency framework was an important step in formalising disclosure within the Italian medical-device sector.
It requires member companies to publish specified direct and indirect transfers of value to healthcare professionals, healthcare organisations and certain third parties. Relevant categories include participation expenses, professional-service fees, event funding and donations.
The framework already requires individual publication for several categories. For HCPs, however, transfers are published in aggregate where the professional has not consented to individual disclosure. Research and development expenditure, scholarships and certain transfers to third parties are also reported in aggregate.
The code expressly excludes transfers connected with promotional materials, meals, beverages and product samples from its publication requirement.
The result is a mixed individual and aggregate disclosure model. It provides meaningful visibility but does not always reveal the recipient-level detail behind aggregated categories.
How the Italian Sunshine Act Changes the Position
The Italian Sunshine Act was enacted through Law No. 62 of 31 May 2022.
The Ministry of Health subsequently published a draft implementing decree and technical framework for consultation. However, the Sanità Trasparente register and mandatory reporting process are not yet operational.
Once the implementing framework takes effect, the Act will move qualifying companies from an association-based disclosure system to a statutory reporting obligation.
Recipient-identifiable disclosure
Reportable transfers, conventions and agreements will generally need to be linked to the identifiable beneficiary or counterparty rather than disclosed only through company-level aggregate totals.
The required communication includes information such as the recipient’s name or corporate name and tax code, together with the date or reference period, nature, amount or market value and purpose of the relationship. Where applicable, professional-register details must also be included.
Unlike the association-code model, the statutory framework does not provide an equivalent route for converting recipient-identifiable disclosures into aggregate reporting merely because an individual withholds consent.
The Act treats entry into covered relationships or acceptance of covered transfers as consent to publication and processing for the law’s purposes. Companies must nevertheless provide appropriate privacy information and maintain GDPR-compliant data governance.
A broader statutory structure
The Act is not limited to the categories traditionally published under industry codes. It covers qualifying transfers of money, goods, services and other benefits, together with specified conventions and agreements.
Article 3(1) applies monetary thresholds to qualifying transfers and conventions. Article 3(2) separately covers agreements that produce direct or indirect advantages through participation in congresses, educational events, committees, commissions, advisory or scientific bodies, or through consulting, teaching and research relationships.
Companies must also distinguish these Article 3 relationships from the separate annual Article 4 disclosures concerning specified shareholdings, bonds and income from licences for the economic use of industrial or intellectual-property rights.
Intermediaries must be identified
One of the most operationally distinctive requirements is the identification of the intermediary who, on the company’s behalf, established the conditions of the transfer or agreement or managed the relationship with the beneficiary or counterparty.
Depending on the facts, the intermediary may be an external agency, CRO, consultant, distributor or other third party. It may also be an employee of the reporting company.
The determining factor is the role performed—not simply whether a person or entity processed an invoice, booked travel or appeared somewhere in the payment chain.
Where companies use third parties to arrange or manage HCP and HCO engagements, their data-collection processes will need to capture the relevant intermediary information.
Semiannual and annual reporting cycles
The statutory system will use a central telematic register and includes both semiannual and annual reporting obligations.
Once the reporting framework becomes operational, Article 3 communications will be due by the end of the semester following the semester in which the relevant transfer, convention or agreement occurred.
The separate Article 4 disclosures will be due annually by 31 January of the following year.
Draft technical materials envisage structured electronic transmission and detailed technical specifications. Companies should confirm the final format, schema and transmission requirements against the implementing framework in force when the register launches.
Where Medical Device Companies May Find Gaps
In our work with life sciences companies preparing for the Italian framework, several recurring operational challenges have emerged.
Data is distributed across systems and functions
Transfers of value and HCP or HCO engagements are rarely managed by one department.
Sales teams may arrange HCP training, marketing may manage congress activity, medical affairs or legal may oversee consulting arrangements, and finance may record the resulting payments. These functions may use different systems, including SAP, Concur, CRM platforms, event-management tools and spreadsheets.
Those systems may not have been configured to capture all of the fields and relationships required by the Italian statutory framework.
Bringing the information together into a consistent, traceable and technically usable dataset therefore requires clear ownership and deliberate coordination.
Recipient master data may be incomplete
The Act requires recipient-identifiable information for individuals operating in the healthcare sector, including the tax code and, where applicable, professional-register information.
Companies may find that their CRM or master-data systems contain missing tax codes, duplicate recipients, outdated information or records that do not align with the relevant professional-register details or other authoritative identification sources.
Resolving material identification discrepancies before reporting will be essential to producing complete and defensible submissions.
Third-party activity may not be fully captured
Companies frequently use agencies, event providers, CROs and other vendors to support HCP and HCO activities.
The data received from those providers may not contain the fields or structure needed for the Italian reporting framework. It may also fail to identify the person who established the terms of the relationship or managed the interaction on the company’s behalf.
Companies should consider defining these information requirements in contracts, statements of work and recurring data-exchange processes.
Starting Your Preparation Now
Early preparation can reduce the volume of data remediation, classification decisions and technical issues that must be addressed close to the first reporting deadline.
The foundations include:
- identifying relevant transfer, convention and agreement flows;
- assessing current processes against the requirements of Law No. 62/2022;
- defining ownership across compliance, legal, finance, medical affairs, commercial teams and IT;
- improving recipient master-data quality;
- establishing processes for capturing intermediary information;
- documenting classification and approval decisions; and
- preparing systems for structured technical reporting.
These capabilities are considerably harder to design, test and embed when work begins only shortly before a reporting deadline.
The statutory obligations and penalties are established, even though the final operational reporting process has not yet commenced. Companies that use this period to strengthen their data, processes and governance will be better positioned to manage the recurring Article 3 reporting cycle and the separate annual Article 4 process once the register becomes operational.
Have questions about where your organisation stands on Italian Sunshine Act readiness? Browse our expert answers and resources.
Stay informed about Italian Sunshine Act deadlines, implementation developments, webinars and events.
Author
Ned Mumtaz is an international transparency reporting expert with extensive experience producing accurate and compliant transparency reports for over 150 pharmaceutical companies globally.
He has held leadership positions at Pfizer and Otsuka, distinguishing himself by ensuring high standards of accuracy, reliability, and regulatory compliance in reporting processes. He is recognized in the industry for his contributions to the development of global transparency models and for promoting operational best practices in compliance.
Recent Blogs
-
La Legge italiana sul Sunshine Act: cosa devono sapere le aziende di dispositivi medici prima della prima comunicazione
-
Codice fiscale, GDPR e Sunshine Act italiano: cosa devono sapere le aziende globali sui dati HCP in Italia
-
Il parallelo con il GDPR: come potrebbe evolvere l’Italian Sunshine Reporting nei prossimi cinque anni
Cerchi supporto per la compliance al Sunshine Act?
Hai domande pratiche?
Dai un’occhiata alla nostra sezione Domande Frequenti per risposte chiare su scadenze, obblighi e strategie.