Whistleblowing channels: what employers with 50 or more staff in the EU must set up

The EU whistleblowing directive requires every private employer with 50 or more workers to run an internal reporting channel. However, a single head-office hotline does not always meet the rules in each country. In addition, reports of AI Act breaches have fallen within the directive’s protection since 2 August 2026. This guide explains what to set up, how to shape your whistleblowing policy and where the UK differs.

What does the EU whistleblowing directive require from employers?

Directive (EU) 2019/1937 requires each private legal entity with 50 or more workers to set up internal reporting channels. It also requires a procedure to follow up every report. Above all, the channel must protect the identity of the person who reports. In addition, an impartial person or team must handle each case.

Member states had to transpose the directive by 17 December 2021. However, employers with 50 to 249 workers had until 17 December 2023 to set up their channels. As a result, every employer in scope should already comply. Also, firms under EU financial services or anti-money laundering rules need a channel at any size.

What must a channel include under the whistleblowing directive?

A compliant channel accepts reports in writing, orally or both, and offers a meeting on request. It acknowledges each report within seven days. It then gives feedback within three months. Finally, it tells reporters how to report to external authorities. Whether it must follow up anonymous reports depends on national law.

Requirement	EU minimum standard
Who must comply	Private legal entities with 50 or more workers
Report formats	Written, oral or both, plus a meeting on request
Acknowledgement	Within seven days of receipt
Feedback	Within three months of the acknowledgement
Anonymous reports	Set by national law

Does the whistleblowing directive threshold apply per company or per group?

The 50-worker threshold applies to each legal entity, not to the group as a whole. According to the European Commission, every entity with 50 or more workers needs its own channel. A group-wide channel can still run, but only alongside local channels.

Entities with 50 to 249 workers may share resources to receive and investigate reports. However, each entity still owns confidentiality, feedback and the response to the breach. Moreover, a third party may operate the channel if it meets the same safeguards.

National rules that shape a whistleblowing policy

National laws settle many practical details, such as anonymous reports, record keeping and employee consultation. Therefore, a group whistleblowing policy usually needs a short local annex for each country. Each annex should follow the national procedure, not just the directive’s minimum.

The Netherlands shows why this matters. The Dutch Whistleblower Protection Act (Wet bescherming klokkenluiders) has applied since 18 February 2023. Under Dutch law, the reporting procedure needs the consent of your works council, if you have one. The procedure must also explain how workers can consult an adviser in confidence.

Do AI Act breaches fall under the whistleblowing directive?

Yes. Since 2 August 2026, Article 87 of the AI Act extends the directive to reports of AI Act breaches. Before that date, protection depended on links to other areas, such as data protection or product safety. Consequently, workers who report unlawful AI practices now have the directive’s protection against retaliation.

In practice, add AI Act breaches to the scope section of your whistleblowing policy. Then brief the people who handle reports. However, do not confuse this date with the high-risk AI deadline. In 2026, EU lawmakers agreed to move high-risk duties for employment AI tools to 2 December 2027.

Does the EU whistleblowing directive apply in the UK?

No. The UK left the EU before the transposition deadline, so the directive does not bind UK employers. Instead, the Public Interest Disclosure Act 1998 protects workers who make qualifying disclosures. It shields them from detriment and, for employees, from unfair dismissal.

Most UK employers have no legal duty to adopt a whistleblowing policy. Even so, government guidance for employers says having one is a good idea. Some regulated firms, such as large banks and insurers, must have one under FCA and PRA rules. In addition, reporting sexual harassment has counted expressly as a protected disclosure since 6 April 2026. The UK regime also sets no seven-day or three-month response deadlines. Therefore, one policy for UK and EU teams needs careful drafting.

How Octagon helps employers meet the whistleblowing directive

Trust in a reporting channel depends on clear local procedures in every country where your teams work. Octagon’s HR experts provide whistleblowing and confidant services, with secure reporting channels and designated confidants. For teams employed through our Payroll EOR Administration, these services form part of ongoing HR support. As a result, you reduce the risk of missed deadlines, confidentiality breaches and gaps between national laws. Meanwhile, you keep full control over how you respond to each report.

Since 1987, Octagon has enabled organisations to operate across borders with clarity, compliance and trust. Planning your next market? First, check your HR foundations with our NL expansion readiness assessment. Then contact Octagon Professionals at info@octagon.nl to review your reporting channels.

Frequently asked questions

What is the EU whistleblowing directive?

The EU whistleblowing directive, formally Directive (EU) 2019/1937, protects people who report breaches of EU law at work. It obliges private employers with 50 or more workers to run internal reporting channels. It also bans retaliation, such as dismissal, demotion or harassment, against people who report within its rules.

Is it a legal requirement to have a whistleblowing policy?

It depends on where you employ people. In EU countries, employers with 50 or more workers must set up a reporting procedure under national law. In the UK, most employers face no such duty. However, UK government guidance recommends a policy, and some FCA and PRA regulated firms must have one.

Can one whistleblowing channel cover a whole group of companies?

Not on its own, according to the European Commission. Each legal entity with 50 or more workers needs its own reporting channel. A central group channel may run alongside those local channels. Subsidiaries with 50 to 249 workers may share resources. Even so, each subsidiary remains responsible for confidentiality, feedback and follow-up.

Do companies have to accept anonymous whistleblowing reports?

The EU directive leaves that decision to each member state. So national law determines whether employers must follow up anonymous reports. In every case, though, the channel must keep the reporter’s identity confidential. Only authorised staff may see it. Beyond that, sharing the identity needs explicit consent, except in narrow cases the law defines.