Staying compliant
The channel is the easy part. This is the operating discipline around it: who may read a report, how fast you have to answer, what you have to keep, and where national law asks for more than the Directive.
Last reviewed: November 1, 2026
Checklist
Set these up once and an auditor, a works council or a labor inspectorate sees a working process instead of a form.
Share the reporting link on the intranet, in the code of conduct and in onboarding. Your whistleblowing policy should name the channel, say who receives reports and state that retaliation is prohibited.
Account admins run branding, team and billing and cannot open a report. Case handlers read reports and never see an invoice. That separation is what makes the promise true: only the case team can read a report.
One handler is a single point of failure: holidays, sickness and the 7-day clock do not negotiate. Invite a second colleague, an external adviser, or both, and keep the role list current.
Automatic acknowledgment confirms receipt the moment a report arrives. Leave it off and confirm by hand the day it lands. Either way the deadline is on the case, and the reporter has a link to follow up.
The clock starts at the acknowledgment, not at the report. Status changes and messages on the case are the record of what the reporter was told, and they export with the case.
Retention is configured per organization, one, three or five years, and printed in the privacy notice the reporter reads. Choose the period your national law requires instead of leaving the default.
Roles and independence
Independence is a legal requirement in most member states, not a style preference. Two decisions follow from it: who gets access to reports, and who has to be kept out of a case. Both are best made before the first report arrives.
Yes, in principle. EU whistleblowing law does not expressly prohibit a CEO from acting as the person responsible for receiving and following up on whistleblowing reports. This may be a practical arrangement, particularly in smaller organizations without a dedicated compliance department.
However, the designated reporting function must operate impartially, independently and without conflicts of interest. The EU Whistleblower Protection Directive recognizes that, in smaller organizations, the reporting function can be combined with another company role, provided those safeguards are maintained.
A CEO may therefore handle reports concerning other matters, provided they can act impartially and independently. They should not handle reports concerning their own conduct, or circumstances in which their personal interests or responsibilities create a conflict of interest. In those situations the report has to be handled by another impartial and appropriately qualified person, which can be another employee, a member of a supervisory body or an external adviser.
Ashio separates account administration from case handling. The account administrator manages subscription settings, billing, team members and platform configuration without automatically having access to confidential reports, and the case handler role gives access to reports and case management without requiring access to billing information. The CEO can therefore own the subscription, receive invoices and manage the account while also acting as a case handler where appropriate.
Our recommendation: even if the CEO acts as the primary case handler, put an alternative in place before the first report arrives, so that another employee or an external adviser in the case role can take over the moment a conflict of interest arises. That gives smaller organizations flexibility while helping to maintain the impartiality and credibility of the process.
A person who is directly implicated in a whistleblowing report should not be responsible for assessing or following up on that report. Doing so would create a conflict of interest and undermine the impartiality of the process.
If the organization has only one designated case handler, it should establish an alternative arrangement for these situations. Depending on its structure, this could involve another appropriately qualified employee, a member of a supervisory body or an external adviser or service provider.
EU law allows reporting functions to be supported by external third parties, provided the necessary safeguards for independence, impartiality and confidentiality are maintained.
Ashio keeps the two roles apart, and the alternative is arranged in the team list: a second person in the case role, an employee or an external adviser, is there when the report arrives and can take it over when the primary handler is implicated. A case role granted afterwards does not reach a report that has already been submitted.
Our recommendation: even if your organization has only one regular case handler, put the alternative in place before the first report arrives. That helps ensure that every report can be handled impartially.
Not in Ashio, and that is the point of having two roles. An account admin cannot grant themselves the case handler role, so access to reports always needs a second person to confirm it.
Every role change is written to the team activity log with the person who made it, so the question of who gave whom access to reports is answerable months later without relying on memory.
A one-person organization has to invite a colleague first, because nobody can grant themselves the case role. If that feels like friction, it is the same friction as a second signature on a payment, and it buys the same thing: nobody can quietly let themselves in.
Yes. EU law explicitly allows organizations to appoint external third parties to receive and follow up on whistleblowing reports. Recital 54 of the EU Whistleblower Protection Directive names external lawyers, auditors and external reporting platform providers as examples.
For smaller organizations this can be a practical way to have reports handled impartially without appointing a dedicated internal compliance team. The external adviser can be given responsibility for receiving reports, communicating with whistleblowers and coordinating the follow-up.
The external provider must offer appropriate guarantees of independence, confidentiality, data protection and professional secrecy.
Ashio makes external case handling straightforward. Invite your external lawyer or adviser as a team member with the case handler role. They reach the relevant reports, the deadlines and the audit history through their own account, and everything they do is attributed to them.
Two things are easy to get wrong. The adviser needs a mandate: Ashio provides the reporting channel and the case management, but it does not investigate reports or act as your legal representative, so the organization agrees the scope with the adviser. And access is per organization: an adviser working for several legal entities has to be invited to each one separately.
That lets an organization use outside expertise while keeping responsibility for its whistleblowing arrangements clearly defined.
The Directive expressly permits external lawyers and advisers, but the national law that implements it may add conditions, and appointing an adviser does not move the organization's own legal responsibilities onto them.
Country-specific requirements
These are some of the national differences that can affect how you configure and operate your whistleblowing channel.
The internal reporting office must operate independently and without conflicts of interest. Case handlers may perform other duties, provided these do not create conflicts, and must have the necessary expertise.
All reports must be documented and records generally deleted three years after the conclusion of the procedure, unless longer retention is necessary and proportionate under applicable law.
Where a works council exists, its co-determination rights should be assessed, particularly if the software qualifies as a technical system designed to monitor employee behavior or performance.
Organizations subject to the internal reporting procedure requirements must establish a procedure for receiving and following up on reports. The procedure must identify the appropriate person, department or external third party responsible for handling reports.
The CNIL requires organizations to establish appropriate data retention periods based on the purpose of processing and applicable GDPR principles. There is no single fixed retention period applicable to every whistleblowing case.
Loi Waserman expanded whistleblower protection and revised the French reporting framework to align it more closely with the EU Directive.
The organization must appoint a Responsable del Sistema, the person responsible for the internal information system. This person is appointed by the governing body and must perform their duties independently and autonomously, without receiving instructions in that role.
The organization must acknowledge receipt within 7 calendar days and provide a response within 3 months of receiving the report. In particularly complex cases, this period may be extended by up to a further 3 months.
The appointment and removal of the responsible person must also be notified to the competent authority within 10 working days.
The internal reporting channel must be entrusted to an autonomous person or department with specifically trained personnel. Depending on the organization, this function can be performed internally or externally.
Reports must generally be acknowledged within 7 days and followed up within 3 months. ANAC, the National Anti-Corruption Authority, is responsible for the external reporting channel and has supervisory and enforcement powers, including the power to impose sanctions.
Employers subject to the internal reporting procedure requirements must designate independent officers to receive reports and ensure their careful follow-up.
The procedure must provide for acknowledgment within 7 days and feedback within a maximum of 3 months after acknowledgment.
The law also allows smaller private-sector employers with 50 to 249 employees to share resources for receiving and investigating reports, subject to the applicable conditions.
The internal reporting procedure must identify the person or organizational unit authorized to receive reports and an impartial internal person or unit responsible for follow-up.
Reports must generally be acknowledged within 7 days and feedback provided within a maximum of 3 months, subject to the statutory conditions.
Before establishing the internal reporting procedure, the organization must consult the relevant trade union organization or, where none exists, employee representatives. These consultations must last between 5 and 10 days.
Legal information should be checked against current national legislation before implementation. This overview covers selected EU Member States, not all 27. National requirements may change and may depend on the organization's size, sector and structure.
This page is operational guidance, not legal advice. The statute, your works council and your legal advisers decide what applies to you. Each country page states when it was last reviewed.
Start the channel, invite a second handler and let the deadlines track themselves. 14 days free, no credit card.