The EU Whistleblower Directive (Directive (EU) 2019/1937) changed how organisations across Europe are expected to handle reports of wrongdoing. For many companies, the first reaction is to publish an email address and consider the job done. In practice, the requirements go much further.
This guide explains which companies may need an internal reporting channel, what a sound whistleblowing process includes, and the common mistakes to avoid. National laws transposing the Directive differ in detail, so always confirm local obligations with your legal advisers.
Which companies may need an internal reporting channel
As a general rule, private-sector legal entities with 50 or more workers must establish internal reporting channels. Some member states apply stricter thresholds, and companies in certain regulated sectors, such as financial services, may be covered regardless of headcount.
For international groups, the obligation is typically assessed per legal entity. A group with several subsidiaries may therefore need channels that work across entities while respecting local rules on languages, recipients and timelines.
What an internal whistleblowing process should include
A reporting channel needs clear ownership and defined steps from the moment a report arrives until it is closed.
- A secure way to submit reports in writing, orally, or both
- Acknowledgement of receipt to the reporter, typically within seven days
- An impartial person or team designated to follow up
- Feedback to the reporter within a reasonable timeframe, typically no more than three months
- Clear, accessible information on how to report internally and externally
Confidentiality and anonymous reporting
The identity of the reporter must be protected and disclosed only to authorised staff. Whether anonymous reports must be accepted depends on national law, but many organisations choose to allow them because they encourage people to speak up.
Confidentiality is difficult to guarantee with shared mailboxes, forwarded emails or spreadsheets. Access should be restricted to the people handling the case, and every access should be traceable.
Follow-up and case handling
Each report should move through a defined workflow: triage, assessment, investigation where needed, outcome and feedback. Assigning cases, tracking deadlines and communicating securely with the reporter, including anonymous reporters, are central to doing this well.
Documentation and audit trail
Organisations should keep records of every report received, in line with confidentiality and data retention rules. A complete audit trail of actions, decisions and communications allows you to show regulators, auditors and boards that reports were handled consistently.
Common mistakes when setting up a reporting channel
- Relying on a general email address that many people can read
- No designated, impartial case handler
- Missing the acknowledgement and feedback deadlines
- No record of how and when each case was handled
- Employees not knowing the channel exists or how to use it
- One channel for the whole group without considering local requirements
What to look for in whistleblowing software
Dedicated software turns the requirements into a repeatable workflow. When evaluating tools, look for:
- Confidential and anonymous submission options
- Role-based access so only authorised handlers see a case
- Case assignment, status tracking and deadline reminders
- Secure two-way communication with the reporter
- A complete, exportable audit trail
- Support for multiple legal entities and countries
Learn more on the Sommet360 Alert Line page.
Run a structured whistleblowing workflow
Explore how Sommet360 Alert Line supports structured whistleblowing workflows.