The Italian Decreto Legislativo 24/2023 transposed Directive (EU) 2019/1937 into Italian law. From 17 December 2023, all in-scope employers — public sector of any size, private sector with 50+ employees — have been subject to ANAC’s inspection power. Two years in, the Autorità Nazionale Anticorruzione has settled into a recognisable pattern. This is what an Italian whistleblowing inspection looks like from the inside in mid-2026.
Direct answer
ANAC’s inspections of D.Lgs. 24/2023 channels cite five deficiencies most often: (1) acknowledgement delayed past the seven-day rule, (2) substantive feedback overdue at three months, (3) the channel is not actually accessible to non-employees in the protected scope (volunteers, contractors, shareholders), (4) the audit log is editable or absent, (5) confidentiality breach during investigation. Fines through 2026 run from €10,000 to €50,000 per violation under Article 21 of the decree. ANAC distinguishes between “negligence” (lower band) and “wilful misconduct” (upper band) and counts repeated process failures as wilful.
Who ANAC is and what it does
The Autorità Nazionale Anticorruzione (ANAC), headquartered in Rome, is Italy’s anti-corruption authority and the competent external authority for whistleblower reports under D.Lgs. 24/2023. ANAC inherits its inspection power from the earlier Legge 190/2012 anti-corruption framework and from its role in the public-contracts code. Practically: ANAC has staff in Rome and Milan, can request documents under Articles 7 and 21 of the decree, can conduct on-site inspections, and can impose administrative sanctions without going through a court.
ANAC publishes an annual report on whistleblowing. The 2024 and 2025 reports show steady growth in external reports received (~2,000 in 2024, ~2,800 in 2025) and a stable inspection rate of about 150 inspections per year. About a third of inspections result in formal sanction; the remainder close with warnings (richiami) or remedial undertakings.
How an ANAC inspection starts
Three triggers, in descending frequency. First, a reporter who used ANAC’s external channel and was unhappy with the employer’s internal one writes a follow-up complaint; ANAC then inspects the internal channel. Second, ANAC notices that an employer in a sector under its sectoral inspection plan (typically public procurement, healthcare, infrastructure) has no published channel and follows up. Third, a cross-referral from the Guardia di Finanza or the Public Prosecutor’s office during a separate investigation surfaces a whistleblower-protection deficiency.
The inspection begins with a request for documents under Article 7. The list usually runs to 20-30 items: the policy, the operating procedure, the case-handler role description and training records, the case log for the past 24 months, sample acknowledgement and feedback messages, the audit log for two named cases, the DPIA, the works-council consultation record, and the procedura di gestione of the channel.
The five deficiencies cited most often
1. Acknowledgement beyond seven days
Article 5(1)(e) of D.Lgs. 24/2023 requires the case handler to issue an acknowledgement to the reporter within seven days. The rule is identical to Article 9(1)(b) of the underlying Directive. ANAC routinely audits the acknowledgement step by sampling cases from the case log and checking the timestamp; cases that exceed seven days are flagged. The cure is straightforward: an in-channel acknowledgement step that requires a human to complete, with the seven-day clock visible.
2. Feedback overdue at three months
Article 5(1)(f) imports the three-month substantive-feedback deadline, extendable to six in cases of “particular complexity” with notice to the reporter. ANAC examines the case log for any cases that crossed three months without an interim feedback message. The most common defence — “the investigation is ongoing” — does not relieve the obligation: an ongoing investigation must still be reported as ongoing to the reporter, in writing, before the deadline.
3. Channel not accessible to all in scope
Article 3 of D.Lgs. 24/2023 sets the protected scope: employees, the self-employed, contractors, suppliers, shareholders, board members, volunteers, trainees, and former employees and applicants up to six months after the end of the relationship. ANAC asks whether the channel is in practice accessible to all these categories. A channel hidden inside the employee intranet with no public URL fails the test; suppliers and contractors cannot access it. The cure: a publicly accessible URL, communicated on the company website, in supplier onboarding packs, in contracts of engagement.
4. Editable or absent audit log
Article 14 of D.Lgs. 24/2023 requires retention of documentation. ANAC interprets this in line with the implementing Linee guida issued in 2023 to require a tamper-evident record. A log stored in a shared spreadsheet with no version control does not meet the standard. ANAC asks for a sample log export and verifies that the case handler cannot rewrite past entries.
5. Confidentiality breach during investigation
Article 12 of D.Lgs. 24/2023 imposes the Article 16 confidentiality rule with Italian flavour: identity may not be revealed beyond authorised personnel; revelation requires the reporter’s express consent or compulsion by criminal proceedings; deliberate breach is also a sanctionable act by ANAC. The breach is most often through informal channels: a case handler discusses the case with HR or with the implicated manager’s superior outside the role-restricted system. ANAC cites these even where the underlying investigation was otherwise well run, because confidentiality is the foundation of the protection.
The fines actually imposed
ANAC’s sanctions under Article 21 fall into three bands:
- €10,000-€25,000 for first-time procedural deficiencies (late acknowledgement, late feedback, accessibility failures).
- €20,000-€40,000 for substantive failures: confidentiality breach, repeated procedural deficiencies, absent or inadequate channel.
- €30,000-€50,000 for retaliation against an identified reporter, the upper band.
Sanctions can be cumulated across multiple cases. The largest cumulative sanction published through 2025 was €180,000 against a public-sector entity that failed across five separate cases. ANAC publishes sanctions on its website with the entity named for the public sector and anonymised for the private sector.
Sector hotspots
ANAC has signalled additional scrutiny in three sectors during 2026:
- Public healthcare administrations (ASL, hospitals). A 2025 audit found channel compliance below 60% across Italian public health.
- Public procurement contracting authorities. Tied to Article 23 of the new public-contracts code (D.Lgs. 36/2023), which requires anti-corruption integrity in bidder selection.
- Construction and infrastructure private-sector contractors in PNRR projects. EU recovery-fund projects pull additional EU anti-corruption oversight.
In-scope employers in these sectors should expect more frequent inspections in 2026 and 2027 than the baseline.
How to be inspection-ready
Italian inspection-ready setups share six characteristics: a publicly accessible channel URL referenced in supplier contracts, a documented procedura di gestione signed by the legal representative and the works council, an audit log that is exportable and hash-chained, an alternate case handler named in advance and used when conflicts arise, a DPIA dated and updated within 12 months, and a training record for case handlers refreshed annually. Confidly’s audit log meets the tamper-evidence standard out of the box, and the channel URL is publicly addressable by default.
ANAC has been deliberate in 2024-2026: build first, inspect later. The pattern in 2027 is expected to shift to more frequent inspections at a similar fine level. The cost of being unprepared has not yet peaked.