Across the Union the technology of reporting channels is abundant and its price is falling. What remains scarce is a named person who holds the function, answers for the statutory deadlines and stands behind the qualification of each report. This practice holds that function under a service agreement, audits reporting systems against the Directive and its national transposition, and structures compliance for groups established in more than one Member State.
Article 8(6) permits the sharing of resources only for private entities with 50 to 249 workers. A subsidiary with 250 or more workers needs an internal channel of its own and cannot simply be served by a group hotline, however well that hotline is built.
Article 2(2) is a minimum-harmonisation clause: Member States may extend protection but never reduce it. The consequence is that a group arrangement lawful in one Member State may be insufficient in the next, and the arrangement has to be designed for the strictest requirement it will meet.
The Annex to the Directive has already been amended by six Union acts. Each amendment widens the population of obliged entities in every Member State without any national legislative act, and therefore without any notification reaching the entity concerned.
Identify every establishment in the Union, its headcount and its sector, and determine for each one whether it is caught by the 50-worker threshold of Article 8(3), by the Union acts listed in Parts I.B and II of the Annex under Article 8(4), or by both.
Establish, Member State by Member State, what the national law adds to the Directive: whether group channels are admitted, how anonymous reports are treated, which deadlines are shortened and which sanctions attach.
Fix who receives, who qualifies, who investigates, who decides and who stands aside in case of conflict, and record that architecture in an instrument that a supervisory authority can read.
Take the designation under contract, meet the seven-day and three-month deadlines, and leave a contemporaneous documentary trail capable of surviving inspection or litigation.
An entity operating in several Member States is not subject to one regime but to as many regimes as the Member States in which it is established, all of them built on the same European floor. Understanding that relationship — a common minimum, freely exceeded by national legislatures — is the difference between a group arrangement that holds and one that fails in the strictest jurisdiction it touches.
Directive (EU) 2019/1937 of 23 October 2019. Article 2(2) states the rule that governs everything below it: Member States may introduce or retain provisions more favourable to the rights of reporting persons, and may never reduce the level of protection.
Twenty-seven transposing laws, adopted at different moments and with different choices on anonymity, group channels, personal scope, deadlines and sanctions. The transposing law, not the Directive, is the instrument a national authority will apply.
The Union acts listed in Parts I.B and II of the Annex — financial services, prevention of money laundering, transport safety, environmental protection and others — carry their own reporting obligations and their own supervisors, and prevail in their field.
Article 8 is where most perimeter errors are made, because the headcount threshold is only one of the routes into the obligation and is the only one that entities habitually count.
| Provision | Rule | Operational consequence |
|---|---|---|
| Article 8(3) | Entities with 50 or more workers must establish internal reporting channels | Headcount is measured per legal entity, not per group, unless national law provides otherwise |
| Article 8(4) | Entities covered by the Union acts in Parts I.B and II of the Annex are caught irrespective of headcount | A twelve-person entity in a listed sector is obliged; the sectoral route is invisible to a headcount test |
| Article 8(5) | The internal channel may be operated by a third party | The legal basis for externalising the function, subject to the safeguards of Article 9 |
| Article 8(6) | Private entities with 50 to 249 workers may share resources for receiving and investigating reports | The permission stops at 249; a subsidiary of 250 or more workers needs its own channel |
| Article 8(9) | Public sector entities are covered, with an option for Member States to exempt municipalities of fewer than 10 000 inhabitants or with fewer than 50 workers | Whether the exemption exists at all depends on the national transposition |
Article 9(1) is short and unforgiving. The channel must be designed, established and operated in a secure manner that protects the confidentiality of the identity of the reporting person and of any third party mentioned. Receipt of the report must be acknowledged within seven days. An impartial person or service must be designated to follow up, and that person or service must be the one that maintains communication with the reporting person, seeks further information where necessary and gives feedback. Follow-up must be diligent. Feedback must be given within a reasonable timeframe not exceeding three months from the acknowledgement of receipt.
| Step | Internal channel — Article 9 | External channel — Article 11 |
|---|---|---|
| Acknowledgement of receipt | Within 7 days | Within 7 days |
| Person or service responsible | Impartial person or service designated to follow up | Dedicated staff of an authority that is independent and autonomous |
| Feedback to the reporting person | Reasonable timeframe, not exceeding 3 months from acknowledgement | 3 months, extended to 6 months in duly justified cases |
The external channel matters to an obliged entity even though it does not operate it. A reporting person who receives no acknowledgement and no feedback has, in most transpositions, a clear route to the competent national authority, and the first fact that authority will establish is whether the internal deadlines were met.
Article 19 lists fifteen categories of prohibited retaliation. The list is deliberately broad and reaches well beyond dismissal: it includes the withholding of training, coercion, intimidation, harassment or ostracism, discrimination, the withdrawal of a licence or permit, and referral for psychiatric or medical assessment. Measures that an employer would describe as ordinary management decisions therefore fall within the prohibition when they follow a report.
Member States must provide sanctions that are effective, proportionate and dissuasive, and those sanctions must cover four distinct behaviours: hindering or attempting to hinder reporting; retaliation against reporting persons; the bringing of vexatious proceedings against reporting persons; and breaches of the duty to maintain the confidentiality of the identity of reporting persons. The third of these is regularly overlooked. An entity that responds to a report with litigation may be sanctioned for the litigation itself, independently of its merits.
The material scope of the Directive is fixed by reference to the Union acts listed in its Annex, and that Annex is amended by later Union acts. Six such amendments have already been made. Because the reference is dynamic, each amendment widens the population of obliged entities in every Member State at once, with no national legislative act required and no individual notification to the entities newly caught. Almost no market operator communicates this to its clients, which is precisely why entities discover the change during an inspection rather than before one.
| Amending act | Field | Effect |
|---|---|---|
| Regulation (EU) 2020/1503 | Crowdfunding service providers | Adds a population caught irrespective of headcount |
| Regulation (EU) 2022/1925 | Digital markets | Extends the material scope to obligations of gatekeepers |
| Regulation (EU) 2023/1114 | Crypto-asset markets | Brings crypto-asset service providers within the Annex |
| Regulation (EU) 2024/573 | Fluorinated greenhouse gases | Extends the environmental limb of the Annex |
| Directive (EU) 2024/1640 | Prevention of money laundering | Replaces the anti-money-laundering reference in the Annex |
| Directive (EU) 2024/1760 | Corporate sustainability due diligence | Adds the due diligence limb, later narrowed by Directive (EU) 2026/470 |
The Commission's report on the implementation of the Directive, COM(2024) 269 final of 3 July 2024, is the authoritative account and it is not a comfortable one. Only three Member States transposed by the deadline of 17 December 2021. Eight notified complete transposition during 2022 and thirteen during 2023. The Commission opened infringement proceedings against twenty-four Member States in January 2022 and referred six of them to the Court of Justice in March 2023.
The same report identifies the compliance defects that recur across national laws: the material scope; the personal scope, in particular trainees, volunteers, subcontractors and facilitators; deadlines and acknowledgement of receipt; the exceptions to confidentiality; the reversal of the burden of proof; remedies; and the treatment of anonymous reports, which the Commission found deficient in roughly half of the Member States. The Commission announced that it would deliver the evaluation required by Article 27(3) no later than 2026.
The question asked most often by group compliance functions is whether a single group channel can serve every subsidiary. The Directive answers only part of it. Article 8(6) permits the sharing of resources for private entities with 50 to 249 workers; it says nothing that would authorise a group hotline to displace the internal channel of a subsidiary of 250 or more workers. National transpositions then diverge, and what follows is reported practice rather than a settled reading.
| Reported national approach | Member States | Consequence for a group arrangement |
|---|---|---|
| Group channels admitted regardless of subsidiary size | Denmark, France, Austria, Estonia, Spain | A centralised arrangement is workable, subject to local confidentiality and language requirements |
| Centralisation in a group company permitted under a service agreement | Germany | The arrangement must be documented contractually and the local entity remains answerable |
| Sharing admitted only in groups averaging 249 workers or fewer | Italy | A large group cannot rely on sharing; each qualifying entity needs its own channel |
The difficulties that group compliance functions bring to this practice are rarely solved by acquiring a tool. They are the residue of a question that was never answered with precision: who holds the function, in which entity, under which national law, and who answers when the deadline is missed. This page maps each recurring problem to the service that addresses it.
| Problem | How it presents | Answer |
|---|---|---|
| Nobody credible is willing to hold the designation | The role is assigned to a manager who is conflicted in exactly the reports that matter most | External Whistleblowing Officer |
| A group channel that does not fit every Member State | One hotline serving subsidiaries of every size, including those of 250 or more workers | Multi-jurisdictional Group Compliance |
| No independent evidence that the system works | Self-assessment only, with nothing an auditor, an authority or an acquirer would accept | Independent Audit of the Reporting System |
| A new EU establishment with no function in place | A subsidiary or branch incorporated, staffed and trading before anyone asked who receives reports | EU Market Entry — Establishing the Function |
| The designated officer is conflicted, absent or gone | A report arrives during the vacancy and the seven-day clock runs regardless | Deputising and Contingency |
| Scope drifting silently with the Annex | An amending Union act brings a subsidiary within scope and nobody inside the group notices | Independent Audit of the Reporting System |
Decide who receives, who qualifies, who investigates, who decides and who stands aside in case of conflict, and put that decision in an instrument, not in a habit.
Install a documented procedure that produces the seven-day acknowledgement, a reasoned legal qualification and feedback within three months, in every entity, in every language.
Build a contemporaneous record capable of discharging the entity's burden under Article 21(5), which is the only defence that exists once a detriment is alleged.
Ensure that whoever operates the channel understands both the Directive and the national transposition that will be applied to them, which are not the same instrument.
Training in this practice is directed at the people who will have to act within seven days and answer within three months. It is not an exposition of the Directive for its own sake, and it is not a case-handling course; case investigation is addressed by the site of the ecosystem dedicated to that function. Three programmes are offered, each written for a distinct audience.
For central compliance teams responsible for several Member States. Minimum harmonisation and what it implies for design; the limits of Article 8(6); the divergences that determine whether a group channel is lawful; and how to keep the perimeter current as the Annex is amended.
For the people designated under Article 9(1)(c) in each establishment. Receiving and acknowledging; qualifying a report against the material scope as transposed; conducting diligent follow-up; giving feedback; recognising the fifteen categories of retaliation in Article 19; and building the record that Article 21(5) will require.
For legal, compliance and human resources teams in the United States, the United Kingdom, Switzerland, Brazil and Asia. What the Directive requires that a home-country hotline does not provide; why a global investigations process does not satisfy the deadlines; and the data-transfer question that arrives with the first report.
| Format | Description | Suited to |
|---|---|---|
| In person | Session at the entity's premises, with printed materials | Governing bodies and teams in one location |
| Remote | Live session by video conference, in English | Groups spread across several Member States |
| Blended | Live sessions combined with tutored individual work and a written assessment | Designated officer programmes of longer duration |
This site addresses two audiences, and the distinction between them is not commercial packaging. They arrive with different questions, at different moments, and the answer that serves one is of no use to the other.
Groups already obliged in one Member State that must now comply in several. Their question is architectural: what can be centralised, what must remain local, and who holds the function in each entity.
Groups established in the United States, the United Kingdom, Switzerland, Brazil or Asia that operate in the Union or intend to. Their question is one of translation: what the Directive as transposed requires that their existing ethics framework does not provide.
| Typology | Route into the obligation | Particularity |
|---|---|---|
| Private entities with 250 or more workers | Article 8(3) | Cannot rely on the sharing of resources permitted by Article 8(6) |
| Private entities with 50 to 249 workers | Article 8(3) | May share resources for receiving and investigating reports; benefited from the derogation to 17 December 2023 under Article 26(2) |
| Entities in the sectors listed in the Annex | Article 8(4) | Obliged irrespective of headcount, including entities far below fifty workers |
| Public sector entities | Article 8(9) | Covered, with an optional national exemption for municipalities of fewer than 10 000 inhabitants or with fewer than 50 workers |
| Subsidiaries and branches of third-country groups | Article 8(3) or 8(4), by reference to the establishment | The obligation attaches to the EU establishment, not to the parent, and the parent's hotline does not discharge it |
| Suppliers within a value chain | Contractual imposition rather than legal threshold | Increasingly the operative route as due diligence obligations cascade down supply chains |
Two indicators are commonly cited and are reproduced here with their provenance stated. A private benchmark published by NAVEX on 2024 data reports a European median of 0.70 reports per hundred employees against 1.75 in North America, 59 % of reports made anonymously and a substantiation rate of around 48 % of closed cases. The ACFE Report to the Nations 2026, based on 2 402 cases in 143 countries, reports that 43 % of frauds are detected by tip-off, with a median loss per case of USD 104 000 and a median time to detection of twelve months.
The European figure of 0.70 reports per hundred employees is frequently presented as evidence that European channels work less well. A more defensible reading is that the difference reflects the anonymity treatment, the maturity of the channels and the confidence of the reporting population, all of which are matters of system design rather than of national temperament.
The market intelligence supporting this practice points to a single structural observation. Across Europe the technology layer of whistleblowing is saturated: reporting platforms are numerous, functionally comparable and deflating in price. Yet no operator publishes a named, priced, service-level-backed offer to hold the function and answer for it. The platform market competes on features; the function itself has no visible market. That is the gap this site occupies, and it is why the services here are organised around titularity, architecture and independent verification rather than around software.
The support service answers concrete questions that arise while a regime is being applied, in a format that does not require commissioning a project for a single question. It is available to entities under contract and, on a per-question basis, to entities that are not.
A reasoned answer to a specific question of interpretation or application, identifying the provision engaged, the national transposition relied on and the degree of confidence in the conclusion.
Assistance while a statutory period is running and the entity has to decide, with confidence, on qualification or on the next procedural step.
Critical reading of channel rules, of a communication to a reporting person or of a reasoned decision to close a case, before it is issued.
Clarification of how a given national transposition differs from the Directive on the specific point in issue, with the limits of the answer stated.
The question is sent to the address dedicated to this domain, with the context and the relevant documents.
The question is qualified, and it is confirmed whether it can be answered in support or requires a separate engagement.
A written answer is issued, with reasoning and identification of the sources consulted.
Question and answer are recorded, giving the entity a documented history usable as evidence of diligence.
Most missed deadlines are not failures of judgement. They are failures of administration: nobody was counting the days, nobody prepared the communication, nobody kept the file. Technical administration takes those tasks off the compliance function, which is the cheapest available protection against the sanction in Article 23.
Tracking of the seven-day and three-month periods for every open report, in every establishment, with advance alerts to the designated officer.
Drafting of the acknowledgement of receipt, of the feedback communication and of the reasoned closure, for issue by the person who holds the function.
Maintenance of the compliance file with version control and an applied retention policy, consistent with data protection minimisation.
Preparation of periodic activity reports and of the information required by national law from entities and authorities that must report publicly.
| Obligation | Period | Source |
|---|---|---|
| Acknowledgement of receipt of an internal report | 7 days | Article 9(1)(b) |
| Feedback to the reporting person | Reasonable timeframe, not exceeding 3 months from acknowledgement | Article 9(1)(f) |
| Acknowledgement of receipt by a competent authority | 7 days | Article 11(2)(b) |
| Feedback by a competent authority | 3 months, or 6 months in duly justified cases | Article 11(2)(d) |
| Retention of records of reports | As long as necessary and proportionate, under national law | Article 18 |
| Periodic review of the reporting procedure | As fixed by the national transposition | National law, informed by the ISO 37002 guidance |
This repository links only to official sources of the European Union. Where a national transposing law is relevant to an engagement it is read in its own official publication, but this page does not attempt to maintain twenty-seven such links, because a link that goes stale is worse than no link at all. The official text always prevails over any summary presented here, including the summaries on this site.
The regulation relevant to a group is not exhausted by the Directive. Its Annex incorporates a moving body of sectoral Union law; a second Directive protects whistleblowers against abusive litigation; a third imposes due diligence obligations that cascade contractually; and twenty-seven national laws determine what an authority will actually apply.
| Provision | Content | Why it matters to a group |
|---|---|---|
| Article 2(2) | Minimum harmonisation clause | A group arrangement must satisfy the strictest national law it touches, not the Directive alone |
| Article 8(3) to 8(6) | Thresholds, sectoral coverage, third-party operation and sharing of resources | Determines the perimeter and the limits of centralisation |
| Article 8(9) | Public sector coverage and the optional municipal exemption | The exemption exists only where the national law provides for it |
| Article 9(1) | Confidentiality, seven-day acknowledgement, impartial designation, diligent follow-up, three-month feedback | The operational core of the obligation |
| Article 11 | External channels, independent and autonomous, with 7-day and 3-month deadlines | The route a reporting person takes when the internal channel fails |
| Article 19 | Fifteen categories of prohibited retaliation | Ordinary management measures may fall within the prohibition once a report exists |
| Article 21(5) and 21(7) | Reversal of the burden of proof; report relied upon as a defence | The entity's defence is the contemporaneous record of how it handled the report |
| Article 23 | Effective, proportionate and dissuasive sanctions, including for vexatious proceedings | Litigating against a reporting person is itself a sanctionable behaviour |
| Articles 26 and 27 | Transposition deadline, derogation to 17 December 2023, Commission reporting and evaluation | Fixes when each obligation began to bind, which differs between Member States |
| Act | Field |
|---|---|
| Regulation (EU) 2020/1503 | European crowdfunding service providers |
| Regulation (EU) 2022/1925 | Contestable and fair markets in the digital sector |
| Regulation (EU) 2023/1114 | Markets in crypto-assets |
| Regulation (EU) 2024/573 | Fluorinated greenhouse gases |
| Directive (EU) 2024/1640 | Prevention of the use of the financial system for money laundering |
| Directive (EU) 2024/1760 | Corporate sustainability due diligence |
Each of these acts widened the population of obliged entities in every Member State at the moment it took effect, without any national legislative act and without notification to the entities concerned. Maintaining the perimeter against this movement is a standing obligation of the compliance function, and one that the market almost never mentions to its clients.
| Instrument | Content | Status |
|---|---|---|
| Directive (EU) 2024/1069 — anti-SLAPP, of 11 April 2024 | Protects persons engaged in public participation, expressly including whistleblowers, against manifestly unfounded claims and abusive court proceedings | Article 22 sets the transposition deadline at 7 May 2026 |
| Directive (EU) 2024/1760 as amended by Directive (EU) 2026/470 | Corporate sustainability due diligence; the Omnibus I amendment, published in the Official Journal on 26 February 2026, raised the thresholds to undertakings with 5 000 or more employees and worldwide turnover of at least EUR 1 500 million | Transposition by 26 July 2028, application from 26 July 2029 |
| Regulation (EU) 2016/679 — General Data Protection Regulation | Governs the processing of personal data in reporting channels, including retention, minimisation and transfers to third countries | Applies in parallel with the Directive and is not displaced by it |
Twenty-seven transposing laws apply, and the transposing law is the instrument a national authority applies. They differ on the points that determine design: whether group channels are admitted and up to what size; how anonymous reports must be treated, an area the Commission found deficient in roughly half of the Member States; how far the personal scope extends to trainees, volunteers, subcontractors and facilitators; whether deadlines are shortened; and what sanctions attach.
Portugal is the home jurisdiction of this practice. Law no. 93/2021 of 20 December has been in force since 18 June 2022, with no transitional provision, because Portugal did not use the derogation available under Article 26(2). Fines reach EUR 250 000 for legal persons in the most serious cases. The Portuguese anti-corruption mechanism opened sixteen administrative offence proceedings between September and December 2025; proceedings were opened, and no final decision is publicly known. The Portuguese regime is treated in Portuguese on whistleblowingofficer.pt.
Four categories of authority matter to an entity operating under the Directive. Three are European and act on the regime as a whole; the fourth is national and is the one that will actually receive an external report or open a sanctioning file.
A reporting channel processes personal data of the reporting person, of the persons concerned and of third parties mentioned, and frequently transfers that data across borders within a group. Data protection supervision is therefore not adjacent to this regime; it runs through it.
Article 11 requires each Member State to designate authorities competent to receive external reports, and to provide them with resources, with independent and autonomous channels, and with the same seven-day and three-month deadlines that bind entities. Who those authorities are differs profoundly: some Member States created a single dedicated body, others distributed the competence across sectoral regulators, prosecutors and inspectorates.
For an obliged entity the practical consequence is that there is no single European address. Identifying the competent authority for each establishment, and knowing what it publishes and how it behaves, is part of establishing the perimeter and is included in the services on this site.
Portugal is named here because it is the jurisdiction in which this practice is established and in which it works daily, and because the Portuguese regime is documented in full, in Portuguese, on the sibling site whistleblowingofficer.pt. No claim of privileged standing before any other national authority is made or implied.
This page links only to official sources of the European Union and to the sibling sites of the ecosystem. It carries no directory of vendors, associations or commentary, because a curated list of third parties is an implicit endorsement and none is intended.
Not as a general proposition. Article 8(6) permits the sharing of resources for receiving and investigating reports only for private entities with 50 to 249 workers. A subsidiary with 250 or more workers needs its own internal channel and cannot simply be served by a group hotline. Beyond that, the answer depends on the national transposition: group channels are reported to be admitted regardless of size in Denmark, France, Austria, Estonia and Spain; Germany is reported to permit centralisation in a group company under a service agreement; and Italy is reported to allow sharing only in groups averaging 249 workers or fewer. These are reported practices, and no formal published Commission or European Data Protection Board document specifically on group channels was located.
Generally not. The obligation attaches to the EU establishment, not to the parent. The Directive requires an internal channel operated with the confidentiality safeguards of Article 9(1)(a), an impartial person or service designated under Article 9(1)(c), acknowledgement within seven days and feedback within three months of that acknowledgement. A global hotline may satisfy the intake function while satisfying none of the rest, and it raises a separate question about transferring the personal data of reporting persons to a third country.
Article 8(5) expressly permits the internal reporting channel to be operated by a third party, and Article 9(1)(c) permits the designation of a person or service to follow up on reports. What cannot be outsourced is accountability: the obliged entity remains responsible for compliance, and the arrangement has to be documented so that a supervisory authority can see who holds the function, who substitutes for them and what response times were undertaken. Some national transpositions add their own conditions, which is why the arrangement is designed per Member State rather than once.
Only if the headcount is the only route into the obligation, which is frequently not the case. Article 8(4) catches entities covered by the Union acts listed in Parts I.B and II of the Annex irrespective of headcount — financial services, prevention of money laundering, crypto-asset services, crowdfunding and others. A twelve-person entity in one of those sectors is obliged. The perimeter question must be asked by sector as well as by headcount.
There is no individual notification, and that is the structural problem. The material scope of the Directive is fixed by reference to the Union acts in its Annex, and six Union acts have already amended that Annex — on crowdfunding, digital markets, crypto-assets, fluorinated gases, anti-money laundering and corporate sustainability due diligence. Each amendment takes effect in every Member State without any national legislative act. Monitoring the Annex is therefore a standing task, and it is one of the reasons the audit service exists.
The Directive leaves Member States free to decide whether obliged entities must accept and follow up anonymous reports, while requiring that a person who reported anonymously and is subsequently identified still benefits from protection. National choices differ, and the Commission's implementation report found the treatment of anonymous reports deficient in roughly half of the Member States. In practice, since a private benchmark reports that 59 % of European reports are made anonymously, a channel that cannot handle them is a channel that will not be used.
The consequence is fixed by national law, because Article 23 requires Member States to provide effective, proportionate and dissuasive sanctions without setting the amounts. In Portugal, the home jurisdiction of this practice, fines reach EUR 250 000 for legal persons in the most serious cases. Independently of the sanction, a missed acknowledgement is the fact a competent authority will establish first, and it is the fact a reporting person will rely on to justify going external.
Article 9(1)(c) requires an impartial person or service, and impartiality is lost the moment the report concerns the officer or their reporting line. The seven-day period does not pause while the entity works out what to do. The only reliable answer is to have designated a substitute in advance, in the entity's own instruments, so that the substitution is a documented mechanism rather than an improvisation. That is the purpose of the deputising and contingency service.
Article 21(5) reverses the burden of proof: once the report and the detriment are shown, the detriment is presumed to be retaliation, and it is for the entity to establish otherwise. Article 21(7) allows the report to be relied upon in proceedings for defamation, copyright infringement, breach of trade secrets or breach of data protection rules, with a right to seek dismissal of the case. Article 23 requires sanctions for bringing vexatious proceedings against reporting persons. Directive (EU) 2024/1069, whose transposition deadline is 7 May 2026, adds a further anti-SLAPP layer. Litigation is, in short, the worst available response to a report.
Much less directly than it did. Directive (EU) 2026/470, published in the Official Journal on 26 February 2026 under the Omnibus I package, substantially raised the thresholds — to undertakings with 5 000 or more employees and worldwide turnover of at least EUR 1 500 million — with transposition by 26 July 2028 and application from 26 July 2029. The directly obliged population shrank sharply. The vector now operates mainly indirectly: undertakings still in scope pass due diligence requirements down to their suppliers by contract, and those requirements commonly include a functioning reporting channel.
Across Europe the technology layer of whistleblowing is saturated and its price is deflating: reporting platforms are numerous, comparable and increasingly cheap. What no operator publishes is a named, priced, service-level-backed offer to hold the function and answer for it. The five services below occupy that gap. They concern the titularity of the function, the architecture that supports it across Member States and the independent verification of the system, and not the academic exposition of the regime or the investigation of an individual case, which belong to other sites of the ecosystem.
| Service | Reference | Engagement type | Indicative timescale |
|---|---|---|---|
| External Whistleblowing Officer | WBO · EU · S1 | Retainer, with a minimum term of twelve months | Operational within 15 to 30 working days of signature |
| Multi-jurisdictional Group Compliance | WBO · EU · S2 | Project, with optional annual review | 6 to 12 weeks, depending on the number of Member States |
| Independent Audit of the Reporting System | WBO · EU · S3 | Project, single or recurring | 4 to 8 weeks |
| EU Market Entry — Establishing the Function | WBO · EU · S4 | Project, with optional transition to the S1 retainer | 4 to 10 weeks, aligned with incorporation |
| Deputising and Contingency | WBO · EU · S5 | Standby agreement, activated per event | Activation within 48 hours of notification |
The function held under contract, with guaranteed response within the statutory deadlines.
Article 8(5) permits the internal reporting channel to be operated by a third party, and Article 9(1)(c) requires the designation of an impartial person or service to follow up on reports. Read together, they make room for exactly what most entities lack: someone who is structurally capable of impartiality because they do not report to the management that a report may concern. Under this service the practice is designated as the person or service responsible for the internal channel, receives reports, qualifies them in law, conducts or directs the follow-up and issues the communications the Directive requires, within the deadlines it fixes.
The designation is documented in a service agreement that identifies the individual who holds the function, the substitute who acts in case of conflict or absence, the response times undertaken and the boundary at which the matter returns to the entity's decision. The engagement is covered by professional indemnity insurance.
Establish which entities in the group are obliged, by which route, and under which national transposition.
Execute the service agreement, formalise the designation in the entity's own instruments and publish the channel information required by Article 7 and its national equivalents.
Receive, acknowledge, qualify, follow up and give feedback, keeping the confidentiality safeguards of Article 9(1)(a) throughout.
Report periodically to the governing body and preserve the contemporaneous record that Article 21(5) will one day require.
Group reporting arrangements designed to survive the divergences between Member States.
A group arrangement fails in the strictest jurisdiction it touches, not in the average one. The common design error is to build a single channel to the standard of the parent's home law and to assume that a floor set by a Directive means uniformity. Article 2(2) says the opposite: Member States may extend protection and many have. This service produces an arrangement that is lawful in every Member State where the group is established, and that states explicitly where centralisation stops.
The central constraint is Article 8(6). It permits the sharing of resources for receiving and investigating reports only for private entities with 50 to 249 workers. Beyond that threshold the subsidiary needs its own internal channel, and whether a group channel may nonetheless serve it depends on the national transposition — admitted regardless of size in some Member States, permitted under a service agreement with a group company in Germany, and restricted to groups averaging 249 workers or fewer in Italy, according to reported practice.
Establish the perimeter: every establishment, its headcount, its sector and the Union acts in the Annex that apply to it.
Read the applicable transposing laws against the design questions that actually determine the architecture, and record where the answer is unsettled.
Fix the architecture — centralised, local, or hybrid — and justify each boundary by reference to a provision rather than to convenience.
Produce the contractual and procedural instruments that implement the design and make it auditable.
Re-examine the arrangement when the perimeter changes, when a transposing law is amended or when the Annex is widened by a Union act.
Third-party verification against the Directive, the national transposition and the ISO 37002 guidance.
An entity that has implemented a reporting system usually cannot demonstrate that it works. Self-assessment is not evidence, and the internal audit function is rarely independent of the compliance function that built the system. This audit is conducted by a third party with no role in the design or operation of the system under examination, and produces a finding that a board, an acquirer, an insurer or a supervisory authority can rely on.
The audit is conducted against three references read together: the Directive; the national transposition applicable to each establishment in scope; and the ISO 37002 guidance on whistleblowing management systems. Conformity is verified against the ISO 37002 guidance — that standard is guidance and is not certifiable — and, where the entity operates a compliance management system under ISO 37301, the audit can be aligned with that certifiable standard.
Fix the establishments in scope, the applicable national transpositions and the audit criteria.
Read the channel rules, the designation instruments, the retention policy and the records of processing.
Sample the case record and test the deadlines, the qualification and the feedback actually given, under confidentiality safeguards.
Speak with the designated person or service, with the governing body and, where appropriate, with those who have used the channel.
Issue findings, a conformity statement and a remediation plan, and present them to the governing body.
Installing the compliance function in newly established EU subsidiaries and branches.
A group established in the United States, the United Kingdom, Switzerland, Brazil or Asia that incorporates a subsidiary or opens a branch in the Union acquires, at the moment the headcount or the sector triggers it, an obligation that has no equivalent in its home system. A parent-level ethics hotline built to a home-country standard does not discharge it: the Directive requires an internal channel operated with the safeguards of Article 9, an impartial person or service designated to follow up, and deadlines that run in days and months rather than at the pace of a global investigations team.
This service installs the function at the point of establishment, before the first report arrives, and connects it to the group's existing ethics and investigations architecture without pretending that the latter satisfies the former.
Establish when and how the obligation attaches to the new establishment.
Compare the group's existing framework with the Directive as transposed, and state precisely what is missing.
Produce the channel rules, the designation and the employee-facing information, in the required languages.
Fix the lawful basis, the retention and the transfer arrangements before the first report is received.
Train the internal designee, or transition the function to the external retainer under S1.
Standing in when the designated officer is conflicted, absent or the post is vacant.
The seven-day acknowledgement period does not pause because the designated officer is on leave, has resigned, or is the subject of the report that has just arrived. Article 9(1)(c) requires an impartial person or service, and the moment a report concerns the designated officer or their reporting line, impartiality is lost precisely when it is most needed. Most entities discover this in the week it happens.
Under a standby agreement the practice is identified in advance, in the entity's own instruments, as the substitute for the designated officer. Activation is by notification, the function is assumed within forty-eight hours, and it is returned on defined terms when the impediment ends.
Identify the substitute in the entity's instruments before any impediment arises.
Assume the function within forty-eight hours of notification, on the terms fixed in the standby agreement.
Receive, acknowledge, qualify and follow up for the duration of the impediment, under the same deadlines as S1.
Hand back the function with a complete case record and a written account of the decisions taken.
Report on the cause of the impediment and on the architectural change that would prevent it recurring.
Audiqcer, Lda. is the entity responsible for this website and for the services presented on it. You may write to the address dedicated to this domain, which routes directly to the team assigned to this practice, or use the general institutional contacts.
Parque Tecnológico de Moura, Apartado 45, 7860-909 Moura, Portugal
Moura · Lisboa
A short description of the entity, its headcount, the Member States concerned and the service required. The reply sets out scope, timescales and terms.
Technical clarification on the Directive, on national transposition in a given Member State, or on the content of this website.
Access to the support service for entities under contract, routed to the assigned engagement manager.
This page summarises the processing of personal data associated with the use of whistleblowingofficer.eu. The full policy, containing the information required by Articles 13 and 14 of the General Data Protection Regulation, is available on the compliance platform of the responsible entity.
Audiqcer — Auditing, Quality & Certification Services, Lda., VAT identification number PT515234583, with registered office at Parque Tecnológico de Moura, Apartado 45, 7860-909 Moura, Portugal. Contact for data protection matters: info@audiqcer.com.
| Category | Purpose | Lawful basis |
|---|---|---|
| Contact data submitted voluntarily | Responding to requests for information, proposals or support | Steps prior to entering into a contract, and performance of a contract |
| Strictly necessary browsing data | Operation and security of the website | Legitimate interest in information security |
| Aggregate audience measurement | Assessing the performance of the website | Consent, where applicable |
Contact data is retained for as long as necessary to reply and, where a contractual relationship exists, for the applicable statutory retention periods. Browsing data is retained only for the technically necessary period.
This website follows a minimal-cookie policy. No behavioural advertising or profiling cookies are used, and no non-essential cookie is set before the visitor has expressed a choice.
| Category | Purpose | Consent required |
|---|---|---|
| Strictly necessary | Operation, security and session preferences | No |
| Aggregate audience measurement | Visit counting without individual identification | Yes |
| Advertising and profiling | Not used on this website | Not applicable |
Preferences may be changed at any time through browser settings, including blocking and deleting cookies already set. Blocking strictly necessary cookies may affect how the website works.
This legal notice identifies the entity responsible for the website and discharges the information duties applicable to information society service providers.
| Item | Information |
|---|---|
| Corporate name | Audiqcer — Auditing, Quality & Certification Services, Lda. |
| VAT identification number | PT515234583 |
| Registered office | Parque Tecnológico de Moura, Apartado 45, 7860-909 Moura, Portugal |
| Offices | Moura · Lisboa |
| Telephone | (+351) 285 107 010 |
| Institutional e-mail | info@audiqcer.com |
| E-mail for this website | info@whistleblowingofficer.eu |
| Institutional website | www.audiqcer.com |
| Domain | whistleblowingofficer.eu |
| Associated extensions | whistleblowingofficer.eu |
| Nature of the website | Informational website presenting professional services |
| Publishing technology | Static website, deployed on Cloudflare Pages |
| Version | 1.0 |
| Version date | 27 August 2026 |
The regulatory information on this website is provided for information purposes and does not constitute legal advice. References to legislation point to official sources, which prevail over any summary presented here. Applying a regime to a specific case requires individual assessment, and national transposition differs between Member States.
Original content on this website belongs to Audiqcer, Lda.. Legislative texts cited are in the public domain and reproduction refers to the respective official source.
This page brings together the visual identity elements of the website, for consistent use across digital and communication materials. Every element is vector-based and designed to work in light and dark themes, as well as in monochrome reproduction.
Solid-ground mark for the vector favicon; the 🇪🇺 emoji serves as tab identifier in preview builds.
| Role | Typeface | Use |
|---|---|---|
| Display | Instrument Serif | Page titles, section headings and featured figures |
| Body | Public Sans | Running text, lists, tables and navigation |
| Labels and codes | IBM Plex Mono | Eyebrows, service codes, references and metadata |
This website is version 1.0 and is ready to publish as it stands. This page records, transparently, what the current version covers and what has been identified for version 2.0, so that the site evolves by plan rather than by improvisation.
A structured page per Member State, recording the transposing law, the treatment of group channels, the position on anonymous reports, the personal scope, the deadlines and the sanctions. Each entry requires verification against the official national publication before it is published, which is why nothing partial appears in version 1.0.
An interactive comparison allowing a user to select two or more Member States and see, side by side, the provisions that determine group design. It depends entirely on the transposition tables above and cannot precede them.
German, French, Spanish and Italian versions of the core pages, which are the languages of the Member States most frequently in scope for the groups this site addresses. Translation must be legal-technical rather than literal, because the terminology of the transposing laws differs from the terminology of the Directive.
A published register of the Union acts that amend the Annex to the Directive, with the date of effect and the population newly caught, updated as further acts are adopted. It is the single most useful thing this site could publish and the one that requires a standing commitment.
The market research supporting this practice shows that the technology layer publishes price while the function layer does not. Publishing a named price for holding the function would be a genuine differentiator, and it requires a prior decision by the principal on positioning.
Client references, anonymised engagement summaries and activity indicators, each subject to express authorisation and to verification. No element of this nature has been assumed in version 1.0.
The response times undertaken under the S1 retainer are currently described in prose. Publishing the service level agreement itself, with the remedies for failure, would convert a claim into a commitment.
Contact, information-request and proposal-request forms routing to the address dedicated to this domain, carrying the processing information required by Articles 13 and 14 of the General Data Protection Regulation.
The legal pages currently link to the root of the responsible entity's platform. They should link to the specific data protection policy, cookie policy and legal notice pages.
The lump sum imposed on Germany in Case C-149/23 is confirmed from the official source. The figures reported for Czechia, Hungary, Estonia and Luxembourg rest on a qualified secondary source and are deliberately not reproduced. They should be verified against the official judgments before any use.