EU Whistleblower Directive 2019/1937
The foundation: confidential internal reporting channels for organizations with 50+ employees across the EU.
EU compliance
EU whistleblowing compliance: one anonymous channel, several EU laws.
The EU Whistleblower Directive (2019/1937), NIS2, the AI Act, CSRD, CSDDD and the Pay Transparency Directive all assume the same thing: people who can raise a concern safely, and an organization that can show what it did about it. Ashio is that anonymous, ISO 27001-hosted reporting channel, with the case record behind it. It is not a substitute for the rest of what each of those laws asks.
Overview
Why one whistleblowing channel can serve several EU laws.
The EU compliance stack includes the EU Whistleblowing Directive for reporting channels, NIS2 for cybersecurity incidents, CSRD for sustainability reporting, and ISO 37002 for management systems.
Regulations covered
Which EU obligations a reporting channel actually covers
The channel requirement in each law, and what Ashio does about it:
NIS2 Directive
NIS2 requires you to notify your CSIRT within 24 hours, 72 hours and one month. Those notifications are yours to make; Ashio gives staff a safe internal route to raise a suspected incident early.
ISO 37002:2021
The international guidance standard for whistleblowing management systems: confidential and free of retaliation.
EU AI Act Article 87
Article 87 applies the Whistleblowing Directive to AI Act infringements, so workers who report bias, safety or fundamental-rights breaches are protected when they do.
CSRD / ESG
CSRD does not require a reporting channel. Its governance disclosures ask how concerns can be raised, and a documented channel is what you describe there.
CSDDD / Supply Chain
CSDDD requires a complaints procedure for affected people, which Ashio can host. The due diligence itself stays with you.
Pay Transparency Directive
The Directive gives workers equal-pay rights and does not prescribe a channel. Ashio records and tracks pay-equity complaints; it does not perform the pay-gap analysis.
Anonymous by design
Across all directives: no IP, no cookies, no fingerprinting. End-to-end encrypted.
How Ashio delivers
Compliance-grade security, set up in minutes.
Where these laws require a channel, the requirements look alike: confidentiality, protection from retaliation, a documented record. Ashio is built for exactly that.
End-to-end encrypted
AES-256-GCM in the browser, per-recipient P-256 key wrapping. Even Ashio can't read your reports.
ISO 27001 Swiss hosting
Data stays in Switzerland under FADP and GDPR. ISO 27001-certified data centers with strict access controls.
Audit-ready case management
Immutable activity logs, 7-day acknowledgment tracking, case timelines — built for regulatory review.
FAQ
Common questions about EU whistleblowing compliance.
Does one platform really cover all these directives?+
For the channel part, yes. Each of these laws needs a confidential, documented way to raise a concern, and one deployment serves all of them. None of them is satisfied by a reporting channel alone.
Which EU directive applies to my organization?+
It depends on size, sector, and whether you handle personal data, supply chains, AI systems, or pay decisions. Most mid-size and large EU organizations are in scope for at least the Whistleblower Directive.
Is Ashio hosted in the EU?+
Not in the EU — Switzerland is not an EU member state. All data is hosted in ISO 27001-certified Swiss data centers. Switzerland is recognized by the European Commission as providing adequate data protection under GDPR.
How long does setup take?+
Most organizations are live in under 10 minutes. No IT integration required.
Is the EU Whistleblowing Directive the same as GDPR?+
No. The EU Whistleblowing Directive (2019/1937) is a separate law focused on protecting people who report EU-law violations. GDPR regulates personal data processing. Both apply to whistleblowing channels — the Directive governs how reports are handled, GDPR governs the personal data inside them. Ashio covers both at once.
Do I need separate channels for each EU directive (NIS2, AI Act, CSRD)?+
No. Where a law requires a channel, nothing stops one channel serving several purposes, and Ashio separates report categories with their own routing and audit trail. That does not turn the channel into your NIS2 notification to the CSIRT or your CSRD report.
What is the EU Whistleblowing Protection Directive and who must comply?+
The EU Whistleblowing Protection Directive (2019/1937) requires all EU member states to protect people who report breaches of EU law. Companies with 50+ employees in the private sector — and all public-sector bodies — must operate an internal reporting channel that meets specific standards for confidentiality, deadlines and anti-retaliation.
What are the deadlines in the EU Whistleblowing Directive?+
Two binding deadlines: (1) acknowledge receipt of every report within 7 days, and (2) give feedback on follow-up actions within 3 months of that acknowledgment. Three months is the ceiling; Ashio tracks both deadlines with reminders and audit-grade timestamps.
Per-directive guides
Dive into each EU directive.
Detailed coverage of every regulation Ashio helps you comply with.
NIS2 Incident Reporting
Cybersecurity incident reporting timelines and internal channels.
Read moreISO 37002:2021
How Ashio aligns with the global whistleblowing standard.
Read moreEU AI Act Article 87
AI Act infringements reported through the whistleblowing framework.
Read moreCSRD / ESG
Whistleblowing for sustainability reporting.
Read moreESG Reporting
Environmental, social, and governance matters.
Read moreCSDDD / Supply Chain
Reporting for human rights and environmental due diligence.
Read morePay Transparency
Channels for pay discrimination reports.
Read moreTruly Anonymous Reporting
No IP, no cookies, no fingerprinting. End-to-end encrypted.
Read moreEU Whistleblower Directive
Requirements, deadlines, and penalties under Directive 2019/1937.
Read moreEU Compliance Deadlines
Every EU reporting deadline in one calendar: whistleblowing, pay transparency, NIS2 and CSRD.
Read moreOne channel for the reporting duties these EU laws share
Set up an anonymous, ISO 27001-hosted channel that covers the reporting requirement in the Whistleblower Directive, NIS2, the AI Act, CSRD, CSDDD and the Pay Transparency Directive.