Dejan Jasnic · Co-founder & Compliance Lead, Trusty · 20+ years anti-fraud & compliance · ACFE Swiss Chapter Board
Whistleblowing law in the EU protects people who report wrongdoing they come across at work, and it obliges employers with 50 or more workers to run a confidential internal reporting channel. The rules come from Directive (EU) 2019/1937, which every one of the 27 member states has now written into national law.
That sounds simple, but each country added its own rules on top. This guide explains what whistleblowing law requires, how the main national laws differ, what changed in 2026 and how to comply without building a legal department.
under 5 minutes
Need a reporting channel that meets EU whistleblowing law? Trusty sets up a secure, anonymous reporting channel in less than five minutes.
What is whistleblowing law?
Whistleblowing law is the set of rules that protects a person from retaliation when they report a breach of law they learned about through their work. In the EU it does two things: it shields the person who reports, and it requires organisations to give them a safe way to do it.
The EU Whistleblowing Directive sets the minimum standard. National laws such as Germany’s Hinweisgeberschutzgesetz, Spain’s Ley 2/2023, France’s Sapin II framework and Italy’s Legislative Decree 24/2023 apply it locally and often go further.
Companies with 50 or more employees can set up whistleblower software from Trusty in minutes, from €49 a month.
Who does whistleblowing law protect?
Whistleblowing law protects anyone who reports a breach they learned about in a work-related context, not only employees. Under Article 4 of the directive, that includes:
• Employees, civil servants, part-time and fixed-term workers
• Freelancers, contractors, subcontractors and suppliers
• Shareholders, board members, volunteers and trainees
• Job applicants and former workers
• Facilitators who help the whistleblower, and colleagues or relatives who could face retaliation
Protection applies when the person had reasonable grounds to believe the information was true at the time of reporting. Their motive does not matter, and an honest mistake does not remove protection.
What counts as a protected report?
A report is protected when it concerns a breach of law in an area the legislation covers. The directive lists areas of EU law, including public procurement, financial services, money laundering, product and transport safety, environmental protection, food safety, public health, consumer protection, data protection and competition rules.
Many member states widened that list. Germany covers criminal offences and certain administrative offences, and France covers any crime, offence or threat to the general interest. A purely personal workplace grievance usually falls outside whistleblowing law.
What must employers do under whistleblowing law?
Employers with 50 or more workers must set up an internal reporting channel and follow a fixed procedure for every report. Public bodies are covered too, and some sectors, such as financial services, are covered regardless of size.
The core duties under Articles 8, 9, 16 and 18 of the directive are:
1. Provide a channel. People must be able to report in writing, orally, or both. On request, you must also offer an in-person meeting within a reasonable time.
2. Keep identities confidential. The channel must be secure, and staff who are not authorised to handle reports must not be able to access them.
3. Name an impartial person or team. Someone independent must receive reports, follow up and stay in contact with the whistleblower.
4. Acknowledge within 7 days. The whistleblower must receive confirmation of receipt within seven days.
5. Give feedback within 3 months. You must tell the whistleblower what action was taken or planned, no later than three months after the acknowledgement.
6. Explain the external route. You must give clear information on how to report to the competent national authority.
7. Keep records. Every report must be documented and stored only as long as necessary, in line with GDPR.
Does the 50-employee threshold apply per company or per group?
The threshold applies to each legal entity, not to the corporate group as a whole. Companies with 50 to 249 workers may share resources for receiving and investigating reports, but each entity keeps its own obligation.
A channel may be run in-house or provided by an external third party. Either way, the employer stays responsible for confidentiality, deadlines and follow-up.
How do whistleblowing laws differ between EU countries?
National whistleblowing laws share the directive’s core but differ on scope, anonymous reports, authorities and fines. A company with entities in several countries has to meet each local law, not just the EU minimum.
Country | Law | In force since | Anonymous reports | External authority | Maximum fines |
|---|---|---|---|---|---|
Germany | Hinweisgeberschutzgesetz (HinSchG) | 2 July 2023 | Should be processed, but no duty to offer an anonymous channel | Federal Office of Justice | Up to €50,000; up to €500,000 for companies that obstruct reports, retaliate or breach confidentiality; up to €20,000 for having no internal channel |
Spain | Ley 2/2023 | 13 March 2023 | Must be accepted | Independent Whistleblower Protection Authority (AIPI) | Up to €1,000,000 for companies |
France | Sapin II, amended by the Waserman Law and Decree 2022-1284 | 1 September 2022 | Allowed, with protection if the person is later identified | Défenseur des droits | Up to 1 year in prison and €15,000 for obstructing a report |
Italy | Legislative Decree 24/2023 | 15 July 2023 | Allowed, with protection if the person is later identified | ANAC | €10,000 to €50,000 |
Three practical differences matter most for multi-country employers:
• Anonymity. Spain requires you to accept anonymous reports. A system that supports them everywhere is the safest baseline.
• Language. Reporters need information and forms they can understand, so offer the channel in each local language.
• Separation of entities. Each legal entity needs its own case handling and access rights, even when the group shares one platform.
This article is general information, not legal advice. Check the current text of each national law, or ask local counsel, before finalising your policy.
multi-country groups
Running entities in several EU countries? Trusty accepts anonymous reports, keeps case handling separate for each entity and runs everything on one platform. Or book a demo.
What changed in whistleblowing law in 2026?
Two things changed in 2026: the directive now explicitly covers reports about the EU AI Act, and the European Commission is evaluating the whole framework.
AI Act reports are now protected. Since 2 August 2026, the directive’s protections explicitly cover reports of EU AI Act violations, under Article 87 of the AI Act. If your organisation builds or uses AI systems, your reporting form and policy should name AI as a reportable topic.
The directive is under review. The Commission’s evaluation of the directive is due to be completed by the fourth quarter of 2026. It could lead to proposals to tighten or widen the rules.
Enforcement attention is shifting. All 27 member states have passed their laws, but monitoring groups report that none is fully compliant with the directive. Expect national rules to keep moving, and review your channel at least once a year.
What counts as retaliation against a whistleblower?
Retaliation is any harmful act or threat taken because someone made a report. The directive bans it outright, including dismissal, demotion, a withheld promotion, a pay cut, a negative reference, harassment, blacklisting and early termination of a supplier contract.
The burden of proof sits with the employer. If a whistleblower shows they reported and then suffered a detriment, the employer must prove the measure had nothing to do with the report.
What are the penalties for breaking whistleblowing law?
Penalties are set by each member state and can reach €1,000,000 for companies in Spain. Article 23 of the directive requires penalties for anyone who:
• Hinders or tries to hinder a report
• Retaliates against a whistleblower
• Brings vexatious proceedings against a whistleblower
• Breaches the duty to keep the whistleblower’s identity confidential
Several countries, including Germany and Italy, also fine employers that have no internal channel at all. Beyond fines, courts can order reinstatement and compensation, and a mishandled report often becomes a public one.
How can employers comply with whistleblowing law quickly?
The fastest route to compliance is a dedicated whistleblowing system that builds the legal requirements into the workflow. Trusty is a whistleblowing platform designed around the EU Whistleblowing Directive, and you can set up an internal channel in less than five minutes.
What the law requires | How Trusty covers it |
|---|---|
Written and oral reporting | Online report form plus in-browser voice messages with voice disguising |
Confidentiality and restricted access | Role-based access, with separate case handling for each legal entity |
Contact with the whistleblower, including anonymous ones | Two-way anonymous inbox that the reporter reopens with an access code |
7-day acknowledgement and 3-month feedback | Case dashboard that shows every report and its status |
Record keeping | Qualified eIDAS timestamp on each report and a tamper-proof audit log |
GDPR-compliant processing | Hosting in ISO/IEC 27001 certified data centres in Germany |
Information and awareness | Ready-made compliance policies and included employee training |
Try Trusty free for 7 days at trusty.report, or book a short demo to see the reporting channel live.
Frequently asked questions about whistleblowing law
Whistleblowing is reporting wrongdoing that you learned about through your work, such as fraud, corruption, safety breaches or data misuse. The report can go to your employer, to a public authority or, in limited cases, to the public.
In the EU, Directive (EU) 2019/1937 and the national law that implements it protect you. Examples are the Hinweisgeberschutzgesetz in Germany, Ley 2/2023 in Spain, Sapin II in France and Legislative Decree 24/2023 in Italy.
Private companies with 50 or more workers and public sector bodies must have an internal reporting channel. Some sectors, such as financial services, must have one regardless of size.
Yes. A company headquartered outside the EU must comply for each EU legal entity that employs 50 or more workers, under the law of the country where that entity is based.
Yes. A person who reports anonymously and is later identified has the same protection as a named whistleblower. Whether employers must accept anonymous reports depends on the country, and Spain requires it.
An employer must acknowledge the report within seven days and give feedback on the follow-up within three months of that acknowledgement.
Yes. A whistleblower may report to the competent national authority without using the internal channel first, and keeps full protection. Employers are encouraged to make internal reporting the easier option.
Yes. Since 2 August 2026, reports of EU AI Act violations are explicitly covered by the EU Whistleblowing Directive.
Sources
• Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law, EUR-Lex
• Whistleblowing and the EU AI Act, EU Artificial Intelligence Act
• EU Evaluation of Whistleblowing Directive Now Underway, EU Whistleblowing Monitor
• Roundup of Updates April 2026, EU Whistleblowing Monitor
• Trusty, product information
with EU Directive & GDPR
Whistleblowing software made simple, built by compliance experts.