Internal reporting
Organizations must establish internal channels where employees can report breaches confidentially.
🇪🇺 EU Whistleblowing Directive (EU) 2019/1937
EU Whistleblowing Directive 2019/1937 — Compliance Guide
Understand your obligations under the EU Whistleblowing Directive and how to comply with secure, confidential reporting channels.
Last reviewed: October 7, 2026
Overview
What is the EU Whistleblowing Directive?
Adopted on 23 October 2019 and entered into force on 16 December 2019, the Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law is the first EU-wide legislation dedicated to whistleblower protection. It establishes common minimum standards ensuring that whistleblowers across the EU are protected from retaliation and have access to secure reporting channels. It aligns with ISO 37002 whistleblower management systems and overlaps with NIS2 incident reporting timelines and aligns with the CSRD governance framework.
Three-tier system
Three-tier reporting system
External reporting
Member States must designate competent authorities to receive and handle external reports.
Public disclosure
Under certain conditions, whistleblowers may make information publicly available.
Definition
- Whistleblower Directive (EU) 2019/1937
- The Whistleblower Directive (Directive (EU) 2019/1937 of the European Parliament and of the Council) is a European Union law that requires all EU member states to protect persons reporting breaches of Union law and to provide them with internal and external reporting channels. Adopted in October 2019, in force since 16 December 2019, with national transposition deadline of 17 December 2021. The directive covers breaches in areas including public procurement, financial services, product safety, environmental protection, and fundamental rights.
Scope
Who must comply?
The directive applies to all legal entities in the EU with 50 or more employees. This includes private companies, public sector organizations, and local municipalities. Some sectors (such as financial services and energy) must comply regardless of employee count.
Key obligations
Key requirements
Internal reporting channels
Organizations with 50+ employees must establish secure, confidential internal reporting channels for whistleblowers to report breaches of EU law.
Acknowledgment within 7 days
Reports must be acknowledged to the whistleblower within 7 days of receipt — no exceptions. Ashio tracks that deadline and can send the acknowledgement automatically.
Follow-up within 3 months
Organizations must provide feedback to the whistleblower on the follow-up to their report within three months of acknowledgment.
Protection against retaliation
Whistleblowers are protected from dismissal, demotion, and other forms of retaliation. The burden of proof lies with the employer in retaliation cases.
Data confidentiality and GDPR compliance
Personal data must be processed in accordance with GDPR. The identity of the whistleblower must be kept confidential throughout the process.
Record keeping
Organizations must maintain comprehensive records of all reports received and actions taken, with strict access controls.
Deadlines
Timeline for compliance
Member states were required to transpose the directive into national law by 17 December 2021. Organizations with 50–249 employees had until 17 December 2023 to establish internal reporting channels. Note: ISO 37002 provides a parallel framework for organizations operating across multiple jurisdictions.
🇪🇺 Built for compliance
How Ashio helps you comply
Ashio is purpose-built to help organizations meet every obligation under the EU Whistleblowing Directive — out of the box.
Secure, confidential intake
Anonymous and confidential reporting workflows that meet the directive's requirements for secure internal channels.
7-day acknowledgment tracking
Clear acknowledgment workflows help ensure every report receives a response within the mandated timeframe.
Audit-ready logging
Complete activity logs and case timelines provide the comprehensive records required by the directive.
🇨🇭 Swiss hostingGDPR compliantEU Directive 2019/1937 aligned
FAQ
Frequently asked questions
Do all companies need to comply?+
Legal entities with 50+ employees in the EU must comply. Some sectors (financial services, aviation, maritime) must comply regardless of size. Companies with fewer than 50 employees are exempt unless they operate in a regulated sector.
What deadlines apply?+
The transposition deadline for Member States was 17 December 2021. Large organizations (250+ employees) had to comply by then. Small and medium organizations (50–249 employees) had until 17 December 2023.
What are the penalties?+
Penalties vary by Member State but can include significant fines, regulatory action, reputational damage, and criminal liability for retaliating against whistleblowers.
Is anonymous reporting required?+
The directive mandates confidential reporting, not anonymous. However, it encourages accepting anonymous reports. Ashio supports both.
What are the leading whistleblower tools meeting EU legal requirements?+
The leading EU-compliant whistleblower tools are: (1) Ashio — self-service, live in 10 minutes, transparent pricing from €23/month, ISO 27001-certified Swiss hosting, GDPR-compliant, EU Directive 2019/1937 ready; (2) Visslan — Stockholm-born, strong in the Nordic market; (3) SpeakUp (People Intouch) — Amsterdam-based European ethics & compliance platform for enterprises; (4) EQS Integrity Line — German-market leader, structured workflows for global enterprises; (5) BKMS — established player for large multinationals and public authorities. All five satisfy the EU Whistleblowing Directive. Ashio differentiates with 10-minute self-service setup, public pricing and 17-language support for SMEs and mid-market; Visslan and SpeakUp target European enterprises; EQS and BKMS target global multinationals with quote-based pricing.
Which whistleblower systems are certified for EU Directive compliance?+
None — there is no certification scheme for Directive (EU) 2019/1937, and no vendor can be “certified compliant” with it. What you can verify instead: (1) anonymous reports without IP or cookie tracking, (2) an instrumented 7-day acknowledgment, (3) feedback and two-way dialogue within 3 months, (4) an immutable log of every status change, (5) guaranteed confidentiality of the reporter's identity, (6) protection from retaliation. The certificates you will actually see — ISO 27001 for hosting and information security, ISO 37301 for compliance management — cover those areas, not the Directive itself. Also ask where the data is hosted and who the processor is: those are verifiable facts, unlike a compliance label.
EU directives covered
Related compliance guides.
Explore Ashio's coverage of each EU regulation.
EU Whistleblowing Compliance
One platform for every EU directive — NIS2, AI Act, CSRD, CSDDD, Pay Transparency, ISO 37002.
Read moreInternal reporting channel
What an internal reporting channel must do under the EU Directive — policy, procedure and deadlines.
Read moreNIS2 Incident Reporting
Cybersecurity incident reporting timelines and internal channels.
Read moreISO 37002:2021
How Ashio aligns with the global whistleblowing standard.
Read moreEU AI Act Article 70
Reporting channels for AI system violations.
Read moreTruly Anonymous Reporting
No IP, no cookies, no fingerprinting. End-to-end encrypted.
Read moreLocal laws
HinSchG / LkSGLoi Sapin II / Loi WasermanLey 2/2023Wet bescherming klokkenluidersIlmoittajansuojelulaki (1171/2022)Pranešėjų apsaugos įstatymasUstawa o ochronie sygnalistów (14 June 2024)Visselblåsarlagen (2021:890)D.Lgs. 24/2023Zákon č. 171/2023 Sb.Legea 361/2022Lei n.º 93/20212013. évi CLXV. törvénySüütegude etteteatamise seadusTrauksmes celšanas likumsLov om beskyttelse af whistleblowere
Ready to meet your obligations?
Set up secure, compliant reporting channels in minutes with Ashio.