Whistleblower reports: 7-day acknowledgement and 3-month feedback

Under the EU Whistleblower Directive you confirm receipt of an internal report within seven days, and give feedback within three months of that acknowledgement. Count the three months from the day you actually acknowledged.

The two deadlines in the Directive

Article 9 of Directive (EU) 2019/1937 lists what an internal reporting procedure must include. Two items set dates [1]:

Acknowledgement: confirm receipt of the report to the reporting person within seven days of that receipt.
Feedback: give feedback within a reasonable timeframe, not exceeding three months from the acknowledgement of receipt. If no acknowledgement was sent to the reporter, the three months run from the end of the seven-day period after the report was made.

That is all the Directive itself says about timing for internal channels. Your country's transposition law may phrase it differently, so check it. The EU text simply says "seven days" [1].

Calculating the dates, step by step

Record the receipt date. Write down the day the report reached the channel: the time stamp of the form or email, the date of the call or the meeting.
For a letter, use the day it arrived, not the date printed on it.
Acknowledgement deadline = receipt + 7 days. Received on Tuesday 3 November 2026, the latest date is Tuesday 10 November 2026.
Send the acknowledgement and record the real send date. This date matters more than the deadline, because feedback is counted from it [1].
Feedback deadline = acknowledgement date + 3 months. Acknowledged on 5 November 2026, feedback is due by 5 February 2027.
Set a reminder well before. A reminder four weeks before the feedback date leaves time to finish the assessment or to write an interim answer.

Worked example with three cases

Case	Received	Ack. due	Ack. sent	Feedback due
WB-01	3 Nov 2026	10 Nov 2026	5 Nov 2026	5 Feb 2027
WB-02	20 Nov 2026	27 Nov 2026	27 Nov 2026	27 Feb 2027
WB-03	30 Nov 2026	7 Dec 2026	not sent	7 Mar 2027

WB-01 shows the effect of acting fast: the earlier acknowledgement also pulls the feedback date forward. WB-03 shows the fallback rule: no acknowledgement went out, so the three months run from the end of the seven-day period [1]. Missing the acknowledgement is still a failure of the procedure; the fallback only fixes the feedback date.

Watch month ends. Three months after 30 November lands on a date that does not exist in February. Spreadsheets handle this in different ways, so check by hand and pick the earlier date when in doubt.

What counts as "feedback"

The Directive defines feedback as giving the reporting person information on the action envisaged or taken as follow-up and on the grounds for that follow-up [2]. Follow-up means any action by the recipient to assess whether the allegations are accurate and, where relevant, to address the breach [2]. So feedback is more than "we are working on it". It tells the reporter what you have done or plan to do, and why.

It does not mean the case has to be closed within three months. If the investigation is still running, you can explain what has happened so far and what comes next. You still have to respect the confidentiality of others involved, so the feedback may stay general on some points [3].

Templates you can copy

Acknowledgement of receipt

Subject: Your report, reference [CASE NUMBER]

Dear [name, or "reporter" if anonymous],

We received your report on [DATE RECEIVED]. Your reference is
[CASE NUMBER]. Please use it in any further contact.

Your report will be handled by [ROLE OF HANDLER]. Your identity
is shared only with the staff who are authorised to receive and
follow up on reports.

We will give you feedback on what we have done or plan to do
no later than [FEEDBACK DUE DATE].

If you want to add information, you can reach us via
[CONTACT ROUTE].

Kind regards,
[ROLE OF HANDLER]

Feedback

Subject: Feedback on your report [CASE NUMBER]

Dear [name, or "reporter"],

On [ACK DATE] we confirmed receipt of your report about
[TOPIC CATEGORY]. This letter tells you what we have done.

Action taken: [e.g. we reviewed the inspection records for
the period you mentioned and interviewed the people involved].

Result so far: [e.g. the assessment confirmed / did not confirm
the issue; measures taken].

Next steps: [e.g. the investigation continues; we expect to
complete it by DATE / the case is closed].

Reason: [short explanation of why this follow-up was chosen].

Kind regards,
[ROLE OF HANDLER]

For an anonymous reporter, send both letters through the route the reporter can still reach, such as a reply box in the reporting platform or a case-code mailbox.

Common questions

Can we acknowledge receipt by phone?

The Directive requires an acknowledgement but does not prescribe the form [1]. A written acknowledgement gives you proof of the date, which you will want because the feedback clock depends on it.

What if the reporter cannot be reached?

Log every attempt with its date in the case file. That shows you tried, and the register keeps a record of the case [4].

Do these deadlines apply to authorities too?

External channels run by authorities have their own rules in Article 11, which also allow six months for feedback in duly justified cases [2]. This guide covers internal channels only.

Keeping the dates under control

With one case a year, a calendar entry is enough. With several open cases, put both dates in the case register and review it every week. If you do not have a channel yet, read the guide for companies with 50 or more employees first, and the comparison page if you are choosing how to run it.

Related guides

Sources

This guide explains the rules in plain language. It is not legal advice. Check your own country's law and, when in doubt, ask a qualified adviser.