Internal reporting channel for companies with 50 or more employees

Private companies with 50 or more workers must run an internal channel for reports of breaches of EU law. You can run it yourself, outsource it, or, with 50 to 249 workers, share resources with others.

Who has to set up a channel

Article 8 of Directive (EU) 2019/1937 requires legal entities in the private sector with 50 or more workers to establish channels and procedures for internal reporting and follow-up [1]. For companies with 50 to 249 workers, Member States had until 17 December 2023 to bring the national rules into force [5]. The general transposition deadline was 17 December 2021 [5], so if you have 50 or more workers today, the duty applies to you in every Member State that has transposed the Directive.

Below 50 workers, Member States may exempt you, but they may also require a channel when a risk assessment shows that your activities pose a risk to the environment or public health [1]. Check your national law if you are close to the line or work in such a sector.

How to count to 50

The Directive speaks of "workers". How part-timers, temporary staff or group companies are counted depends on national law, so use your national authority's guidance. A practical rule: if you are near 50, set up the channel anyway. It costs little and removes the question.

What the channel must do

Article 9 lists the elements the procedure must contain [2]. In plain terms:

A secure, confidential channel that keeps the reporter's identity protected and keeps unauthorised staff out [2][3].
Acknowledgement to the reporter within seven days [2].
An impartial handler: a person or department designated to follow up on reports, which may be the same one that receives them [2].
Diligent follow-up by that handler [2].
Feedback within a reasonable timeframe of at most three months from the acknowledgement [2].
Written, oral or both: oral reporting by phone or voice message and, on request, a physical meeting within a reasonable time [2].

On top of that, every report must be recorded, and kept no longer than necessary and proportionate [4].

Options for a company with 50 to 249 workers

Run it yourself

You appoint a handler, for example a compliance officer, the HR lead or a company lawyer, as long as they can act impartially. Reports come in through a dedicated mailbox, a phone line, a form, or a meeting on request.

Outsource it

Article 8 lets a third party operate the channel for you. The Article 9 safeguards then also apply to that third party [1]. Outsourcing receipt does not take the duty off your hands: you still follow up and answer the reporter.

Share resources

Companies with 50 to 249 workers may share resources for receiving reports and for any investigation, for example within a group or with other small firms. This does not change each company's own duty to keep reports confidential, give feedback and address the reported breach [1].

A ten-step setup plan

Check the national law. Find your country's transposition act and the authority that oversees it.
Appoint a handler and a deputy. Pick people without a conflict of interest for most likely topics. Write down who covers absences.
Choose the channels. At least one written route, plus a phone number or a way to request a meeting if you accept oral reports [2].
Restrict access. Make sure only the handler and deputy can read the mailbox, the voicemail and the case files [3].
Set up the register. One place for case numbers, dates and status. See the register template.
Prepare the letters. Draft acknowledgement and feedback letters now, so the 7-day and 3-month deadlines are easy to meet.
Write a short procedure. Who receives, who follows up, the timelines, how confidentiality works, and where to report externally.
Tell your staff. Put the information on the intranet and in the staff handbook, and include where staff can report to the competent national authority.
Test the channel. Send a test report through each route and check that it arrives, that the acknowledgement goes out on time, and that nobody else can see it.
Review once a year. Check that contact details still work, the handler is still in place and old files have been reviewed for deletion [4].

Worked example: a 70-person engineering firm

A firm with 70 workers and no compliance department makes these choices:

Decision	Choice
Handler	Office manager, with the finance director as deputy for reports about the office manager
Written channel	A dedicated mailbox only the handler and deputy can open
Oral channel	Meeting on request, minutes added to the case file
Register	Offline file on the handler's encrypted laptop, backed up to an encrypted drive
Information to staff	One intranet page and a paragraph in the handbook, with the national authority's contact details
Review	Every January

Setup takes the firm a few days of work spread over two weeks. If reports later turn out to need forensic or legal work, the handler brings in an outside adviser for that case only.

Copyable staff notice

Reporting concerns about breaches

You can report concerns about breaches of law at [COMPANY]
in confidence.

How:   email [MAILBOX] / call [NUMBER] / ask for a meeting
Who:   [HANDLER ROLE] receives and follows up on reports.
       Deputy: [DEPUTY ROLE].
When:  you will receive confirmation within 7 days and
       feedback within 3 months of that confirmation.
Confidentiality: your identity is only shared with the
       staff authorised to handle reports, unless you agree
       otherwise or the law requires it.
External reporting: you can also report to [AUTHORITY],
       [WEBSITE].

Not sure whether to build this yourself or hire help? The comparison of spreadsheet, tool and consultant lays out the trade-offs.

Related guides

Sources

This guide explains the rules in plain language. It is not legal advice. Check your own country's law and, when in doubt, ask a qualified adviser.