Whistleblowing: do you need an internal reporting channel?

Who it applies to

Every employer owes reporting persons confidentiality and protection from retaliation. A channel is owed by every public entity and by private ones from 50 workers. With no threshold, it is owed within Parts I.B and II of the Annex too.

The dates

The national law had to be in force by 17 December 2021, and by 17 December 2023 for private entities with 50 or more but fewer than 250 workers.

The one thing to do

Set up the channel and its procedure, acknowledge each report within seven days, give feedback within three months, keep records, and never retaliate.

Who needs an internal channel, and from when

The days are the ones the national law had to be in force by, Article 26. Each Member State's own law may start earlier or ask more.

The procedure, Article 9

Article 9(1) lists what the procedure for internal reporting and follow-up includes, and Article 9(2) how a report can be made. In the Directive's words:

• 9(1)(a) channels for receiving the reports which are designed, established and operated in a secure manner that ensures that the confidentiality of the identity of the reporting person and any third party mentioned in the report is protected, and prevents access thereto by non-authorised staff members;
• 9(1)(b) acknowledgment of receipt of the report to the reporting person within seven days of that receipt;
• 9(1)(c) the designation of an impartial person or department competent for following-up on the reports which may be the same person or department as the one that receives the reports and which will maintain communication with the reporting person and, where necessary, ask for further information from and provide feedback to that reporting person;
• 9(1)(d) diligent follow-up by the designated person or department referred to in point (c);
• 9(1)(e) diligent follow-up, where provided for in national law, as regards anonymous reporting;
• 9(1)(f) a reasonable timeframe to provide feedback, not exceeding three months from the acknowledgment of receipt or, if no acknowledgement was sent to the reporting person, three months from the expiry of the seven-day period after the report was made;
• 9(1)(g) provision of clear and easily accessible information regarding the procedures for reporting externally to competent authorities pursuant to Article 10 and, where relevant, to institutions, bodies, offices or agencies of the Union.
• 9(2) 2. The channels provided for in point (a) of paragraph 1 shall enable reporting in writing or orally, or both. Oral reporting shall be possible by telephone or through other voice messaging systems, and, upon request by the reporting person, by means of a physical meeting within a reasonable timeframe.

Records, Article 18

Every report received is recorded, no longer than necessary. A recorded call, an unrecorded one and a meeting are each documented in their own way. The reporting person can check, rectify and sign the transcript or minutes.

18(1) 1. Member States shall ensure that legal entities in the private and public sector and competent authorities keep records of every report received, in compliance with the confidentiality requirements provided for in Article 16. Reports shall be stored for no longer than it is necessary and proportionate in order to comply with the requirements imposed by this Directive, or other requirements imposed by Union or national law.

What every employer owes, whatever its size

These bind an employer with or without a channel: they protect the reporting person and the people around them.

• 16(1)Protect the reporting person's identity
• 17Collect no personal data a report does not need
• 19Never retaliate against a reporting person
• 21(5)Be ready to justify any measure against a reporter
• 23(1)Know the penalties for hindering or retaliating
• 24Waive none of these rights in contracts or policies

The Annex areas where size does not matter

Article 8(4) removes the 50-worker threshold for entities within the Union acts these parts of the Annex list. The areas, in the Directive's words:

• I.B financial services, products and markets, and prevention of money laundering and terrorist financing
• II.A financial services, products and markets, and prevention of money laundering and terrorist financing
• II.B transport safety
• II.C protection of the environment

A directive, through each Member State's law

Directive (EU) 2019/1937 binds through the law each Member State adopted to transpose it. That law can go further, with a channel for smaller entities or anonymous reports that must be followed up. Every state has made one. The table names the act that binds a private-sector employer, as each state notified it to the Commission, read on 18 October 2026.

In Austria, Belgium and Germany a public body may answer to a Land, regional or community act instead. The register lists those too. Every measure each state notified, on EUR-Lex

Read from Directive (EU) 2019/1937 in the Official Journal on 18 October 2026: the consolidated text of 30 December 2024, with its corrections checked and the amending acts reviewed. EUR-Lex

Questions people ask

We have 40 workers. Do we need a reporting channel?

Not under the Directive itself, unless you fall within the Union acts of Part I.B or Part II of the Annex, Article 8(4). Your national law can still require one after a risk assessment, Article 8(7).

How fast do we have to answer a report?

Acknowledge receipt within seven days, Article 9(1)(b). Give feedback within three months of the acknowledgement, or of the end of those seven days if none was sent, Article 9(1)(f).

Can an outside provider run the channel for us?

Yes. Article 8(5) lets a third party operate it, under the same safeguards as the entity's own. The duties to keep confidentiality, give feedback and address the breach stay with you.

Do we have to accept anonymous reports?

The Directive leaves that to each Member State, Article 6(2). Where the national law requires it, anonymous reports are followed up diligently, Article 9(1)(e).

Can StandardOS hold the reports themselves?

No, and it does not try. A report and the reporting person's identity belong in a channel only authorised staff can reach, Articles 9(1)(a) and 16(1). StandardOS holds the procedure and the duties.

Related:Free toolsArticles