Photo by Kelly Sikkema on Unsplash
Most “whistleblowing procedure” pages on the open web list four or five bullets (“encourage staff to speak up, listen, act, follow up”) and stop. That is a culture statement, not a procedure. Under EU Directive 2019/1937 a whistleblowing procedure is a documented sequence of operational steps with named owners, statutory deadlines, and rights for the reporter and the subject. If any step is missing from the written procedure or the case file, the channel does not pass an inspection and the employer cannot rely on the directive’s defences in a retaliation claim. This guide sets out the procedure end to end, with the article references and deadlines that decide whether a channel is Article 4 to 15 compliant.
Direct answer
A whistleblowing procedure under EU Directive 2019/1937 has six operational steps. (1) Confidential intake through a channel that accepts written reports and, on request, an oral meeting within a reasonable time (Article 9(1)(a) and (e)). (2) Acknowledgement of receipt to the reporter within 7 days of intake (Article 9(1)(b)). (3) Triage: scope check against Article 2, conflict-of-interest check, immediate escalation if there is imminent danger. (4) Investigation by an impartial designated person or department (Article 9(1)(c)), respecting the rights of the subject under Article 22. (5) Substantive feedback to the reporter within 3 months of acknowledgement (Article 9(1)(f)). (6) Closure: remedial action, retention to the national period, and a post-mortem feeding the next risk assessment. The procedure must be written, published internally, audit-logged, and reviewed at least annually. Companies with 50 or more workers are obliged to operate it (Article 8); failure to do so is a sanctionable offence under every national transposition.
What the EU directive means by “whistleblowing procedure”
Article 9 is the operational core of the directive. It distinguishes the channel (the technology or address through which reports arrive) from the procedure (the workflow the employer runs once a report lands), and lists seven minimum requirements: confidential channels protecting the identity of the reporter and any third party named, acknowledgement within 7 days, designation of an impartial person or department to handle follow-up, diligent follow-up by that person, acceptance of oral and written reports including an in-person meeting on request, substantive feedback within 3 months, and clear information about external reporting routes. The procedure must be operated and described in writing.
National supervisors (Bundesamt für Justiz in Germany, ANAC in Italy, the Autoridad Independiente de Protección al Informante in Spain, the Office of the Protected Disclosures Commissioner in Ireland) inspect channels against these seven Article 9 requirements and against the local transposition. A written procedure that omits one of them is a procedural defect on its face.
Step 1: confidential intake (Article 9(1)(a) and (e))
The first operational step is intake. The reporter chooses one of the formats the directive accepts: written submission through the secure channel, an oral report by telephone or other voice-messaging system, or an in-person meeting on request within a reasonable time. The employer cannot force a single format. The intake form asks for the categories the report relates to (mapped to the Article 2 areas plus the local-law extensions), the time and place of the conduct, the people involved, and any supporting material the reporter chooses to attach. It does not demand documentary proof: Recital 32 makes that explicit.
The intake step also records procedural metadata that the rest of the procedure depends on: an immutable case code, the date and time of receipt, the language of the report, and the channel used. Confidly issues a server-side case code in the format WB-XXXX-YYYY that the reporter retains as their only identifier when reporting anonymously.
A common procedural defect at this step is to gate the form on a company email or an employee number. Article 4 protects a wider population than current employees, including former workers, applicants, contractors and their staff, suppliers, shareholders, and non-executive directors. A form that excludes any of these categories fails the procedure before the reporter has finished typing.
Step 2: 7-day acknowledgement (Article 9(1)(b))
The acknowledgement is the first hard deadline in the procedure. Within 7 days of receipt, the reporter must receive confirmation that the report was received, the case code, the name and role of the designated case handler, and an outline of the next steps including the 3-month feedback deadline. For anonymous reports the acknowledgement goes through the case timeline that the reporter accesses with their case code. For non-anonymous reports it can also go by email if the reporter agreed to receive email.
The 7 days are calendar days, not business days, and they run from receipt by the channel, not from manual review. A weekend or a public holiday at the front of the period is not a defence. National supervisors in Germany and Italy have flagged late acknowledgements as a common deficiency in 2025 and 2026 inspection rounds. The fix is not to chase manually but to make the acknowledgement system-generated on intake, then to layer a human follow-up message once triage is complete. If the acknowledgement is missing from the case file, the file is incomplete in the regulator’s view.
Step 3: triage and conflict-of-interest check
Triage is the procedural decision about how to route the report. It happens after the acknowledgement and before any substantive work. Three checks run in parallel.
The first is the material scope check against Article 2. Does the conduct alleged fall inside one of the ten EU areas (public procurement, financial services and AML, product safety, transport safety, environment, radiation and nuclear safety, food and feed safety, public health, consumer protection, privacy and network security) or inside an area added by the local transposition (HinSchG, D.lgs 24/2023, Ley 2/2023, the Irish Protected Disclosures Acts all extend the floor). If the report falls outside material scope, the file records that and redirects the matter to the appropriate procedure, keeping a record either way.
The second is the conflict-of-interest check on the designated case handler. The handler verifies their own independence in writing and recuses if they have a personal relationship to a named subject, sit in the chain of command, or have a financial interest in the outcome. Where a conflict exists, the named alternate takes over. For cases involving senior management, escalation to the audit committee or supervisory board is documented. The directive requires the designated person to be impartial (Article 9(1)(c)); an undocumented conflict turns into a procedural defect on inspection.
The third check is imminent danger. If the report alleges an immediate safety, security, or criminal risk, the case is flagged for parallel notification to the appropriate authority (police, regulator, occupational-safety body). The whistleblowing procedure does not replace mandatory reporting obligations; it runs alongside them.
Step 4: investigation and the rights of the subject (Articles 9, 16, 22)
Investigation is the longest step in the procedure and the one where most of the operational effort sits. The directive does not prescribe a single investigation method; it sets boundary conditions.
Confidentiality of identity (Article 16). The identity of the reporter is not disclosed to anyone outside the authorised case team without the reporter’s express consent. There is a narrow exception for necessary and proportionate disclosure in the context of investigations or judicial proceedings (Article 16(2)), in which case the reporter must be informed in advance unless that would jeopardise the investigation.
Rights of the subject (Article 22). The person concerned by the report has the right to be presumed innocent, to be informed of the allegations, to be heard, and to have an effective remedy. These rights are operationalised at the subject-interview step, which sits late in the investigation after documentary review and peripheral witness interviews. The subject is told the conduct alleged but not the identity of the reporter.
Evidence handling. The investigation preserves relevant documents on a legal hold before collection. Witnesses are interviewed in order of distance from the subject, with the subject interviewed last. Each interview produces a signed and dated memorandum. The findings memorandum sets out the methodology, the evidence reviewed, the factual findings, the rule analysis, and the conclusion on each allegation, with the standard of proof stated explicitly (typically the balance of probabilities).
A detailed step-by-step on the investigation phase sits in our 12-step playbook for whistleblower investigations. The procedural rule for this guide is narrower: the investigation must be diligent (Article 9(1)(c)), impartial, and documented in a way that the audit log shows each step occurred on time.
Step 5: substantive feedback within 3 months (Article 9(1)(f))
The second hard deadline in the procedure is the substantive feedback. Within 3 months of the acknowledgement the reporter receives a substantive update on the action envisaged or taken as follow-up, and on the grounds for that action. The feedback does not have to disclose privileged material, individual disciplinary outcomes, or the identity of any subject. It does have to state the position the case handler has reached and the rationale.
If the 3 months are going to slip (a common reality on complex cases) the reporter is told before the original deadline, with the reason for the extension and a new target date. National regulators treat a silent missed deadline as a separate procedural breach distinct from any substantive failure on the underlying matter.
For anonymous reports the feedback goes through the case timeline. The reporter can post follow-up questions through the same channel. A procedure that publishes a generic “your report is being handled” text instead of substantive feedback fails Article 9(1)(f) in spirit even if it appears on time.
Step 6: closure, remediation, and record-keeping
Closure is the final operational step. It includes three sub-steps that the procedure must describe and that the case file must show.
Closure decision. The case handler recommends an outcome for each allegation (substantiated, partially substantiated, unsubstantiated). The recommendation is reviewed by a closure panel (typically the head of compliance plus one other senior officer not in the chain of command of the subject) and approved or revised. The approval and the names of the panel members are logged.
Remediation. Where allegations are substantiated, remedial action follows: HR consequences for the subject, policy or training fixes, system controls, or referral to authorities. Each remedial action is linked to the case and tracked to completion. Aggregated patterns inform the next year’s risk assessment.
Retention. Case records are kept for the period specified by the national transposition: 3 years post-closure in Germany under the HinSchG, the duration of the case plus 3 years in France under Loi Sapin II, 10 years where criminal proceedings are involved in Spain under Ley 2/2023, between 5 and 7 years across most other transpositions. The audit log is preserved beyond the retention of the case content itself, so that procedural compliance can be evidenced even after the substantive file is purged.
A post-mortem is run quarterly across closed cases to identify systemic patterns, refresh training, and update the risk assessment. The post-mortem output is the input for the annual review of the written procedure.
Where most procedures actually fail
Most procedural failures concentrate on three deadlines: 7 days from intake to acknowledgement, 3 months from acknowledgement to substantive feedback, and the national retention period at closure. Missing any of the three is the single most cited deficiency in 2025 and 2026 supervisor inspections in Germany, Italy, and Spain. A channel can have an attractive intake form, accurate triage, and a careful investigator and still fail on the deadlines alone. The failure modes are operational, not architectural.
Acknowledgement is manual. The owner gets pulled into a project, the case sits in a queue, the 7 days run out. Fix: system-generated acknowledgement on intake, layered with a human follow-up after triage.
Conflict-of-interest checks are skipped. The designated handler knows everyone in a small compliance team and the check is treated as a formality. Fix: a documented checkbox in the triage view, named alternates with their own intake to the system, and an escalation rule for senior-management cases.
Substantive feedback turns into status updates. The 3-month deadline is hit with a generic “the matter is under review” line. Fix: standardise the feedback template to require an actual finding or a documented extension before the deadline closes.
The written procedure and the procedure operated drift apart. A polished PDF sits on the intranet; the actual case workflow has not been updated since launch. Fix: review the written procedure annually against the audit log of the last twelve months of cases.
Confidly’s intake form, triage view, audit log, and retention scheduler are designed around these failure modes. The country-specific templates for HinSchG, Loi Sapin II, D.lgs 24/2023, Ley 2/2023, Wbk, and the generic EU profile encode the local extensions of material scope and the local retention period automatically. To estimate the fine exposure if the procedure is operated below this standard, see the fines calculator.
FAQ
Does the procedure have to be written down?
Yes. Article 9(1) requires the procedure to be operated. Articles 7(2) and 13 require employers to provide clear and easily accessible information about the procedure to potential reporters and to the public. Most national transpositions are explicit: the written procedure must exist, be published on internal channels, be available in the working languages, and be reviewable on request by the national authority. A channel without a written procedure document is treated as not having a procedure at all.
Who owns the procedure inside the company?
The directive requires the designation of an impartial person or department to handle reports (Article 9(1)(c)). Most employers place this with the compliance or legal function, sometimes with HR co-ownership where reports may touch employment law. The owner is named, the role is described, and an alternate is named for conflict-of-interest cases. The audit committee or supervisory board is the escalation route for cases that touch senior management.
Is the procedure the same across the EU?
The Article 9 minimums are the same. The local extensions vary: material scope (the German HinSchG, Italian D.lgs 24/2023, Spanish Ley 2/2023, and Irish Protected Disclosures Acts all extend beyond the EU floor), retention periods (3 years in Germany, up to 10 in Spain for criminal matters), thresholds (the directive’s 50-employee threshold applies, with some national variation in how it is counted in groups), and the named external competent authority. A multinational typically operates one core procedure with annexed national overlays. See the relevant country page for the local position.
Can the procedure outsource the case handling to a third party?
Article 8(5) allows third-party providers to operate the channel and to receive reports on the employer’s behalf, provided they offer appropriate guarantees of independence, confidentiality, data protection, and secrecy. Outsourcing the technology and intake is common. Outsourcing the substantive case handling is less common and triggers heavier vendor due diligence. The employer remains responsible for the procedural compliance.
What does an inspector actually look at?
In 2025 and 2026 inspections by Bundesamt für Justiz, ANAC, and the Autoridad Independiente de Protección al Informante focused on five documents: the written procedure and date of last review, the public-facing notice to reporters, a sample case file (acknowledgement timestamp, triage record, investigation plan, findings memorandum, feedback record), the retention rule with evidence of deletion at the end of the period, and the conflict-of-interest log for designated case handlers. A channel that can produce all five cleanly passes the procedural review.
What is the relationship between the procedure and the policy?
The policy is the high-level statement (purpose, scope, protections, channels, anti-retaliation). The procedure is the operational workflow (intake, triage, investigation, feedback, closure, retention). Most employers publish them as two documents linked together. See our guides to what a whistleblowing policy must include and the anatomy of a whistleblower policy for the policy side.
See also
- How to run a whistleblower investigation: 12-step playbook
- What a whistleblowing policy must include in 2026
- The 5 conditions of whistleblowing: when a disclosure is actually protected
- EU Directive 2019/1937: complete guide
- Country guide: Ireland (Protected Disclosures Act)
- Fines calculator: estimate exposure under your transposition