Content reviewed October 2026.

CalmER · Workplace guides

EU Whistleblowing Directive: what employers must do in 2026, country by country

For UK and international groups with staff in the EU: who needs an internal reporting channel, what it must do, whether one group channel is enough, how ten countries' laws differ, and a model procedure you can adapt.

Last updated 8 October 202619 min read

Also in: Deutsch

At a glance Does it apply to UK employers?What a channel must do What's changed Group channels Ten countries compared Checklist for groups Free model procedure FAQs

At a glance, as at 8 October 2026

Every company with 50 or more workers in an EU country needs an internal reporting channel, under the law of that country. It must acknowledge a report within 7 days and give feedback within 3 months. The European Commission says a single group-wide channel isn’t enough, some countries allow one, and the national rules on anonymous reports, scope and fines differ a lot.

What	Where things stand
Who needs a channel	Private companies with 50 or more workers, counting each company separately. Financial services and anti-money-laundering firms at any size. Public bodies too, though countries can exempt small municipalities.
The deadlines	Acknowledge a report within 7 days. Give feedback within 3 months of the acknowledgement.
How people report	In writing, by phone or voice message, or both, and in person if they ask.
Who’s protected	Workers, plus the self-employed, shareholders, board members, volunteers, trainees, staff of contractors and suppliers, former staff and job applicants.
Anonymous reports	Each country decides. Spain requires employers to accept them, and Belgium does for companies with 250 or more workers.
Fines	Set by each country, from none in force in the Netherlands to up to €1 million in Spain.
Status	All ten countries in this guide have their laws in force. The European Commission plans its evaluation of the Directive for the last quarter of 2026.

For UK groups

Does the EU Whistleblowing Directive apply to UK employers?

The Directive isn’t part of UK law. The deadline for bringing it into national law, 17 December 2021, came after the UK left the EU and after the Brexit transition period ended on 31 December 2020.

It does apply to your companies in EU countries. Each member state wrote the Directive into its own law, and that law binds the companies set up there. So your German subsidiary follows the German law, your Polish company the Polish law, and so on. Germany’s explanatory memorandum says it directly: groups working across borders must observe the whistleblower law of each country.

If you employ people in an EU country without a local company, check that country’s law too. Spain’s whistleblower authority, in non-binding guidance, reads the Spanish law as covering foreign companies that work in Spain through branches or agents, or provide services there without a permanent base, and counts the 50 workers in Spain.

UK whistleblowing law covers your UK staff, and it sets no deadlines for handling concerns. Our UK whistleblowing policy guide covers what applies there.

The core duty

What every EU internal reporting channel must do

Articles 8 and 9 of the Directive set the minimum that every country’s law builds on. Your channel and procedure need to:

Be open to your workers. You can open it to others who deal with you through work, such as contractors, suppliers’ staff, shareholders and former staff.
Take reports in writing, orally, or both. Oral reports by phone or another voice messaging system, and a meeting in person within a reasonable time if the person asks.
Keep identities secure. Protect the identity of the person reporting and of anyone named, and keep staff who aren’t authorised out.
Acknowledge within 7 days of receiving the report.
Name an impartial person or team to follow up, keep in touch with the person, ask for more information and give feedback.
Follow up diligently, including on anonymous reports where national law requires it.
Give feedback within 3 months of the acknowledgement, or of the end of the 7 days if you sent none. Feedback means telling the person what you’ve done or plan to do, and why.
Explain how to report to the authorities, clearly and somewhere easy to find, such as your website.
Keep a record of every report, for no longer than necessary.

Who can run it. Your own staff or an outside provider, with the same safeguards. In smaller companies the handler can be someone with another role, such as a compliance, HR, legal or finance lead, or a board member, as long as they can act independently. Companies with 50 to 249 workers can share resources to receive and investigate reports, but each one keeps its own duty to protect identities, give feedback and deal with the problem.

What staff can report. Breaches of the EU laws listed in the Directive’s annex, in these areas: public procurement; financial services and money laundering; product safety; transport safety; the environment; radiation and nuclear safety; food and feed safety and animal welfare; public health; consumer protection; privacy, data protection and network security; the EU’s financial interests; and competition, state aid and corporate tax. Nine of the ten countries in this guide add national law for all private companies, and Italy adds it only for companies with a Model 231. The Directive doesn’t cover harassment or personal grievances itself, and countries treat those differently.

Protection from retaliation. The Directive bans retaliation in any form, including threats and attempts: dismissal, demotion, a change of duties, pay or hours, withheld training, a bad appraisal or reference, discipline, intimidation, harassment, discrimination, ending a temporary contract, reputational harm, blacklisting and more. If someone suffers a detriment after reporting, the law presumes it was retaliation, and the employer has to prove otherwise. No contract, policy or settlement can waive these rights, which matters for confidentiality clauses.

What the Directive doesn’t require. A document called a policy, accepting anonymous reports, a fixed retention period, a particular language, or registering with an authority. National laws add some of these.

See the Free Model Procedure

Recent changes

What’s changed, and what’s coming

The EU Court fined countries that were late. The Court ordered Poland to pay €7 million, plus €40,000 a day if it still hadn’t complied (25 April 2024). On 6 March 2025 the Court fined Germany €34 million, Czechia €2.3 million, Hungary €1.75 million, Estonia €500,000 plus €1,500 a day if it still hadn’t complied, and Luxembourg €375,000. The fines fell on the governments. Germany and Poland now have their laws in force, and those laws are what employers answer to.
AI Act breaches came into scope. Article 87 of the AI Act applies the Directive to reports of AI Act breaches, from 2 August 2026 under the AI Act as adopted. Germany added AI Act breaches to its own law from 29 July 2026.
More EU laws were added to the list. Since 2021 the Directive’s annex has grown to cover crowdfunding, the Digital Markets Act, fluorinated gases, the sixth anti-money-laundering directive, corporate sustainability due diligence and crypto-assets. The ban on products made with forced labour joins from 14 December 2027.
National laws moved in 2025 and 2026. Italy added breaches of EU sanctions on 24 January 2026. Belgium added them on 7 August and changed its fine levels on 1 September. Spain’s whistleblower authority has been running since 1 September 2025.
The European Commission is reviewing the Directive. The Directive set 17 December 2025 for the evaluation, and the Commission now plans it for the last quarter of 2026. A call for evidence in 2025 drew 74 responses, and a public consultation from January to April 2026 drew 225 replies. The Commission says it will look for scope to simplify the Directive and reduce the administrative burden. One response to the call for evidence, from Germany’s federal chamber of tax advisers, asked for the threshold to rise from 50 to at least 100 workers. We found no Commission proposal to change it.
Coming nationally. In July 2025 the Dutch government said it was preparing a bill on fines and anonymous reporting. A Spanish bill before parliament would merge the whistleblower authority into a new integrity agency, require notice of the system manager to both the national and the regional authority, and add a minor offence for having no internal system.

The hardest question

Group channels: is one channel enough for the whole group?

Under the Directive, the duty sits with each company that has 50 or more workers. Only companies with 50 to 249 workers can share resources, and only to receive and investigate reports.

The European Commission’s view. In its 2021 expert group minutes, repeated in its 2024 report, the Commission said a channel run only at group level can’t replace each company’s own. A group channel can stay as an extra route, and the Commission accepted these arrangements:

The parent’s channel stays open to staff of its subsidiaries.
A subsidiary with 50 to 249 workers can use the parent’s investigators, as long as its own channel stays open, it tells the person reporting who will see the report and lets them object, and it gives the feedback and takes any follow-up action itself.
If a report reveals a problem across the group, the subsidiary can ask the person’s agreement to pass it to the group company that can fix it.
Outsourcing means a provider outside the group, and the provider can’t take over the follow-up.

National laws don’t all agree. The Commission’s 2024 report says a few countries wrongly let groups run channels only at group level, without naming them. Here’s where the ten countries stand:

Country	Position	What the law or regulator says
Ireland	Law is silent or unclear	Channels must be open to workers of the company's subsidiaries and affiliates. The Act doesn't say whether a parent's channel can replace a subsidiary's own. Companies with fewer than 250 employees can share resources.
Netherlands	Each company needs its own	The Huis voor Klokkenluiders says every company with 50 or more employees needs its own channel in its own country, and staff must always be able to report at the subsidiary. Companies with 50 to 249 employees can share resources.
Germany	A group company can run it	The Act is silent on groups. The government's explanatory memorandum says another group company can run the channel as a third party, but each subsidiary stays responsible for fixing the problem, and staff must be able to report in the subsidiary's working language. Employers with 50 to 249 employees can run a joint channel. This conflicts with the European Commission's view that outsourcing must go to a provider outside the group.
France	Official views conflict	The law allows one procedure for several or all companies in a group, on terms a decree was meant to set, but the decree sets none. The Défenseur des droits limits pooling to companies with fewer than 250 employees. The French Anti-Corruption Agency's July 2026 guide favours a central group system with local contacts.
Spain	Group channel allowed	Allowed: one internal system can serve the whole group, with one system manager. The AIPI accepts a foreign parent's system if it is adapted to Spanish law, and says each company stays obliged in its own right.
Italy	A group company can run it	Above 249 employees, ANAC rules out a shared channel. Each company can outsource the work to a third party, the parent included, under a data-processing contract and with a local contact.
Poland	Group channel allowed	Allowed: companies in a capital group can set one joint procedure, with no size limit. Companies with 50 to 249 can share receipt and investigation by contract.
Belgium	Law is silent or unclear	The Act is silent on groups. Companies with fewer than 250 workers can share resources.
Sweden	Each company needs its own	The government bill says the Directive leaves no room to exempt group companies. Employers with 50 to 249 can share receipt and investigation, but not contact with the person reporting.
Denmark	Group channel allowed	Allowed: employers can set up a group-wide scheme, and a group company can run it.

What to ask local counsel. For each country where you have a company with 50 or more workers: can that company rely on the group channel alone, or does it need its own channel and handler? The arrangement the Commission accepts gives each such company its own reachable channel and a local handler responsible for follow-up and feedback, with the group channel as an extra option.

National laws

Ten countries compared

We checked each row against the country’s law, regulator or official legislative papers on 8 October 2026. In Ireland, the Netherlands, France, Spain, Italy and Poland, firms covered by the EU’s sector rules for financial services, anti-money-laundering, transport safety and the environment need a channel whatever their size. Germany, Belgium and Denmark apply this to financial-sector firms.

The laws, and who needs a channel

Country	Law and dates	Who needs a channel
Ireland	Protected Disclosures Act 2014, as amended in 2022. In force 1 January 2023; employers with 50 to 249 employees from 17 December 2023.	50 or more employees
Netherlands	Wet bescherming klokkenluiders (Whistleblowers Protection Act), as amended in 2023. In force 18 February 2023; employers with 50 to 249 employees from 17 December 2023.	50 or more employees as a rule. The Huis voor Klokkenluiders counts agency workers, volunteers and paid interns.
Germany	Hinweisgeberschutzgesetz (HinSchG). In force 2 July 2023; employers with 50 to 249 employees from 17 December 2023.	50 or more employees as a rule. Financial-sector firms at any size.
France	Loi Sapin II (Loi 2016-1691), as amended by Loi 2022-401, and Décret 2022-1284. In force 1 September 2022 (law) and 5 October 2022 (decree).	50 or more employees, assessed at the end of two consecutive financial years
Spain	Ley 2/2023. In force 13 March 2023; employers with 249 or fewer workers from 1 December 2023.	50 or more workers. The whistleblower authority (AIPI) counts all contract types and, in non-binding guidance, applies the law to foreign companies operating in Spain through branches or agents.
Italy	Decreto legislativo 24/2023. In force 15 July 2023; employers averaging up to 249 employees from 17 December 2023.	An average of 50 or more employees last year, and ANAC counts each company in a group separately. Any company with a compliance model under Decreto legislativo 231/2001 (a "Model 231"), whatever its size.
Poland	Act of 14 June 2024 on the protection of whistleblowers (ustawa o ochronie sygnalistów). In force 25 September 2024 for all employers with 50 or more.	50 or more people doing paid work, counted on 1 January or 1 July, with employees counted as full-time equivalents. Contractors paid for their work count too, unless they employ others to do it.
Belgium	Act of 28 November 2022 (private sector). In force 15 February 2023; employers with 50 to 249 workers from 17 December 2023.	50 or more workers, averaged over the four quarters of the previous year
Sweden	Lag (2021:890), the Whistleblowing Act (visselblåsarlagen). In force 17 December 2021; channels for 250 or more from 17 July 2022, for 50 to 249 from 17 December 2023.	50 or more employees at the start of the calendar year, counted by head
Denmark	Whistleblower Act (lov om beskyttelse af whistleblowere), Lov 1436/2021. In force 17 December 2021; employers with 50 to 249 employees from 17 December 2023.	50 or more employees, averaged over the previous four quarters

Anonymous reports and deadlines

Country	Anonymous reports	Deadlines
Ireland	Optional. You must tell workers whether you accept anonymous reports and on what terms.	7 days to acknowledge in writing, 3 months for feedback, then further feedback every 3 months if the person asks in writing
Netherlands	Not required yet. The Act contains the duty, and it hasn't come into force.	7 days to acknowledge, 3 months from the acknowledgement for feedback
Germany	The internal office "should" handle anonymous reports. There's no duty to make anonymous reporting possible.	7 days to acknowledge, 3 months from the acknowledgement for feedback (3 months and 7 days from receipt if no acknowledgement was sent)
France	Optional. The procedure must say how you handle anonymous reports.	7 working days to acknowledge in writing, 3 months for feedback. If you offer oral reporting, a meeting within 20 working days of a request.
Spain	You must accept and follow them up	7 calendar days to acknowledge, 3 months from receipt for a response, extendable by 3 more months in complex cases. A meeting within 7 days of a request.
Italy	No duty to follow up. ANAC expects you to log and keep anonymous reports.	7 days to acknowledge, 3 months for feedback
Poland	Optional. The procedure must say how you handle anonymous reports.	7 days to acknowledge, 3 months for feedback. A meeting within 14 days of a request.
Belgium	Companies with 250 or more workers must accept and follow them up	7 days to acknowledge, 3 months for feedback
Sweden	Not required	7 days to acknowledge, 3 months for feedback
Denmark	Optional	7 days to acknowledge, 3 months from the acknowledgement for feedback

What staff can report

Country	Beyond EU law	Personal grievances and harassment
Ireland	Any offence, any failure to meet a legal obligation other than the worker's own contract, health and safety, and the environment	The Act excludes interpersonal grievances that affect only the person reporting
Netherlands	Breaches of national law, and dangers to health, safety or the environment, where the public interest is at stake	Individual disputes are out of scope
Germany	All criminal offences, breaches backed by fines where the rule protects life, health or employees' rights, listed areas of federal and state law, and breaches of the AI Act since 29 July 2026	The Act doesn't mention harassment or personal grievances. Discrimination complaints have their own route under the General Equal Treatment Act (AGG, section 13).
France	Any crime or offence, a threat or harm to the general interest, and any breach of EU law, French law or regulation	The law has no exclusion for personal grievances. The Défenseur des droits doesn't treat a victim acting only on their own behalf as a whistleblower. Victims and witnesses of moral harassment have their own protection in the Labour Code.
Spain	Criminal offences, and serious or very serious administrative offences	The law excludes interpersonal conflicts from protection
Italy	For private companies: breaches of EU law, plus offences under Decreto legislativo 231/2001 for companies with a Model 231	The decree expressly excludes personal grievances about the reporter's own employment
Poland	A closed list of areas, including corruption. Parliament removed labour law from the list.	Labour law isn't a listed area. You can open the channel to breaches of internal rules, but people reporting those don't get the Act's protection for reporting outside.
Belgium	Listed areas, plus tax fraud, social fraud, and EU sanctions since 7 August 2026	The Act has no harassment exclusion. The Federal Ombudsman's guidance sends bullying or discrimination that affects only the person reporting to other routes
Sweden	Any wrongdoing that it's in the public interest to bring to light	Reports about the reporter's own working conditions are normally not in the public interest
Denmark	Serious breaches of law and other serious matters	Official guidance puts sexual harassment and other severe harassment in scope. The reporter's own employment matters and conflicts with colleagues are out.

Authorities and fines

Country	Authorities	Fines
Ireland	Prescribed persons (the sector regulators) and the Protected Disclosures Commissioner	On indictment, up to €250,000, up to 2 years in prison, or both, for having no channel, retaliation or hindering a report. The Workplace Relations Commission can bring summary prosecutions for a missing channel.
Netherlands	Huis voor Klokkenluiders, and sector authorities including the ACM, AFM, Autoriteit Persoonsgegevens, DNB, IGJ, NZa, ANVS and NVWA	No fines in force. Any employee can ask the court to order the employer to adopt a procedure.
Germany	Federal external reporting office at the Federal Office of Justice (BfJ), BaFin, and the Bundeskartellamt	Up to €50,000 for hindering a report, retaliation or breaching confidentiality, up to €500,000 for a company. Up to €20,000 for having no channel.
France	42 authorities listed in the decree, and the Défenseur des droits, which directs people to the right one and protects them	Hindering a report: up to 1 year and €15,000. Breaching confidentiality: up to 2 years and €30,000. Companies face five times the fine.
Spain	Autoridad Independiente de Protección del Informante (AIPI), running since 1 September 2025, and regional authorities	Up to €1 million for a company for very serious offences, which include deliberately having no system, retaliation and breaching confidentiality. Possible bans on subsidies and public contracts.
Italy	ANAC (Autorità Nazionale Anticorruzione)	€10,000 to €50,000 for retaliation, hindering a report or breaching confidentiality, and the same for having no channel or a non-compliant procedure
Poland	The Commissioner for Human Rights (Rzecznik Praw Obywatelskich), or the public authority responsible for the area	No procedure: a fine of PLN 20 to 5,000. Retaliation: up to 2 years in prison, 3 if persistent.
Belgium	The Federal Ombudsmen coordinate, with 24 designated authorities	Channel and register breaches: €4,800 to €56,000 criminal or €2,400 to €28,000 administrative, since 1 September 2026. The official texts leave unclear whether a 25% surcharge applies on top. Retaliation, hindering a report and breaching confidentiality: 6 months to 3 years in prison, a fine of €600 to €6,000 plus surcharges, or both.
Sweden	About 30 sector authorities. The Work Environment Authority (Arbetsmiljöverket) handles the rest and supervises internal channels.	The Work Environment Authority can order you to set up a missing channel, backed by a conditional fine. Damages for retaliation.
Denmark	Datatilsynet (the Danish Data Protection Agency), at whistleblower.dk	Fines, with no amount set in the Act. Companies can be liable.

Employee representatives, registration and records

Country	Employee representatives and registration	Keeping records
Ireland	No consultation duty. No registration.	No longer than necessary and proportionate
Netherlands	The works council must consent to the procedure. Where there's no works council or staff representation, more than half of the employees must agree, unless a collective agreement covers the procedure.	Delete when no longer needed
Germany	The Act sets no consultation duty. No registration.	Delete 3 years after the case closes, unless longer is necessary and proportionate
France	Consult the works council (CSE). The works rules must mention the scheme. No registration.	Only as long as strictly necessary and proportionate
Spain	Consult the workers' legal representatives. Notify the AIPI, or the regional authority where one has the power, of the system manager (Responsable del Sistema) within 10 working days of their appointment or removal.	Keep the register no longer than 10 years. Delete after 3 months if no investigation has started.
Italy	Hear the trade union representatives before activating the channel. We found no duty to notify ANAC.	No longer than 5 years from the final outcome
Poland	Consult the trade union, or worker representatives if there's none, for 5 to 10 days. The procedure takes effect 7 days after you tell staff about it. No registration.	3 years after the end of the calendar year in which follow-up, or any related proceedings, ended
Belgium	Consult the social partners. No registration.	For as long as the contractual relationship lasts
Sweden	No consultation duty in the Act. No registration.	No longer than 2 years after the case closes
Denmark	No consultation duty in the Act. No registration.	As long as necessary and proportionate

In practice

A checklist for groups with EU companies

Count each company’s workers the way its country counts them. Poland counts contractors, the Dutch regulator counts agency workers, and Italy’s regulator counts each company in a group separately.
Give each company with 50 or more workers its own channel and a named local handler, and keep the group channel as an extra route.
Set the clock per country. Acknowledge within 7 days, or 7 working days in France. Feedback within 3 months of the acknowledgement, or of receipt in Spain.
Decide on anonymous reports. Accept them in Spain, and in Belgium for companies with 250 or more workers. In Ireland, France and Poland, say in the procedure how you handle them.
Bring in employee representatives where the law requires it: works council consent in the Netherlands, and consultation in France, Spain, Italy, Poland and Belgium.
Notify the authority in Spain. Tell the AIPI, or the regional authority where one has the power, who your system manager is within 10 working days of appointing or removing them. The AIPI and Madrid’s authority use different tests for which one that is.
Set retention per country. One group-wide period can’t meet both Poland’s fixed 3 years and Sweden’s 2-year limit.
Publish how to report, including to the authorities. Spain wants it on your website’s home page, and Italy in a dedicated section of your website.
Check your contracts and confidentiality clauses. None can limit the right to report.
Train handlers and managers, and watch for retaliation after a report, since the burden of proof falls on you.

Free template

A model internal reporting procedure for your EU companies

An editable Word document you can adapt for a group with companies in EU countries, and we send it to your inbox. It covers what the Directive requires, and a country annex sets out the extra rules in each of the ten countries in this guide. The parts to fill in, such as your channels, handlers and languages, are in [square brackets].

The procedure covers:

Who this procedure covers
Who can report
What you can report
How to report
Anonymous reports
What happens after you report
Who handles reports
Keeping your identity confidential
Protection from retaliation
People named in a report
Reporting outside the group
Records and data protection
Your rights can't be signed away
Review

The country annex sets out, for each of the ten countries: law, in force, who needs a channel, anonymous reports, deadlines, what else can be reported, personal grievances and harassment, group channels, authorities, fines, employee representatives and registration, keeping records.

Free Word template

Get the procedure as a Word document

Enter your work email and the team will send you the model procedure and the ten-country annex as an editable Word document.

Or hear about problems in every country, before a regulator does

CalmER gives staff in each of your countries a way to report in writing or by phone: a hotline, app, web form, WhatsApp, Slack or Teams, named or anonymous. Every concern follows the same structured path, the right person gets an alert, and CalmER drafts your board pack from your live data. Amazon ran this case and concern management setup across its 40+ country corporate workforce and tripled early-stage reporting inside 12 months.

See CalmER →See CalmER pricing

Last reviewed: 8 October 2026. General information, not legal advice. Where official sources disagree, this guide says so. Check the detail with local counsel in each country. We review this guide every quarter and whenever the law changes.

FAQs

Common questions

What is the EU Whistleblowing Directive?

Directive (EU) 2019/1937 sets minimum standards across the EU to protect people who report breaches of EU law. The EU adopted it on 23 October 2019. Each member state had to bring it into national law by 17 December 2021, so employers follow their own country's law, which often goes further.

Who must comply with the EU Whistleblowing Directive?

Every private company with 50 or more workers in an EU country must have an internal reporting channel, and you count workers company by company. Financial services and anti-money-laundering firms need one whatever their size, and so do public bodies, though countries can exempt small municipalities and public bodies with fewer than 50 workers. The Directive gave companies with 50 to 249 workers until 17 December 2023, and some countries set their own dates.

Does the EU Whistleblowing Directive apply to UK companies?

It applies to your companies in EU countries, through the law of each country they're in. UK law doesn't include it. If you trade in an EU country without a local company, check that country's law: Spain's whistleblower authority, for example, reads the Spanish law as covering foreign companies that work in Spain through branches or agents. UK whistleblowing law covers your UK staff.

What are the 7-day and 3-month rules?

An internal channel must acknowledge a report within 7 days of receiving it and give the person feedback within 3 months of the acknowledgement. If you sent no acknowledgement, the 3 months run from the end of the 7 days. Some countries differ: France allows 7 working days, and Spain counts the 3 months from receipt and allows 3 more in complex cases.

Does the Directive require anonymous reporting?

No. It leaves anonymous reports to each country. Spain requires employers to accept and follow them up, and Belgium does for companies with 250 or more workers. Ireland, France and Poland require your procedure to say how you handle them. If anyone works out who made an anonymous report, the Directive still protects that person from retaliation.

Can a group use one whistleblowing channel for all its companies?

The European Commission says no: each company with 50 or more workers needs its own channel, and a group channel can only be an extra route. Companies with 50 to 249 workers can share resources for receiving and investigating reports. National laws differ. Denmark, Poland and Spain allow group channels. Germany's explanatory memorandum and Italy's regulator let a group company run the channel for a subsidiary, though the Commission says outsourcing means a provider outside the group. Sweden and the Netherlands follow the Commission, official views in France conflict, and Ireland and Belgium are silent.

What happens if a company doesn't set up a reporting channel?

It depends on the country. Germany can fine up to €20,000. In Ireland, a conviction on indictment can bring a fine of up to €250,000. In Spain, deliberately having no system counts as very serious, with fines of up to €1 million for a company. Poland can fine PLN 20 to 5,000. The Netherlands has no fines in force, and Sweden's authority can order you to set one up.

Does the EU Whistleblowing Directive cover harassment?

The Directive covers breaches of EU law in listed areas, and harassment isn't one of them. Countries can widen the scope, and a large majority have, though only a few added labour law or workplace health and safety. Denmark's official guidance expressly covers sexual harassment and other severe harassment. Most countries exclude complaints that only affect the person reporting, such as a dispute with a colleague.

What's changing in 2026?

Under the AI Act as adopted, the Directive covers reports of AI Act breaches from 2 August 2026, and Germany added them to its own law from 29 July. Belgium added EU sanctions breaches on 7 August and changed its fine levels on 1 September. The European Commission plans its evaluation of the Directive for the last quarter of 2026, and we found no proposal to change the 50-worker threshold.

How long should whistleblowing reports be kept?

The Directive says no longer than necessary and proportionate, and several countries set fixed periods: Germany deletes records 3 years after the case closes, Poland 3 years after the end of the calendar year in which follow-up ended, Sweden within 2 years, Italy within 5 years, and Spain caps its register at 10 years.

Sources & further reading

References

General information, not legal advice. It reflects our understanding of the EU Whistleblowing Directive and the national laws as of October 2026, so check eur-lex.europa.eu and each country's official sources for the current position.