What the 27 EU whistleblower laws ask of an employer in 2026
The 27 EU whistleblower laws ask an employer for the same six things: a channel, a reply, feedback, secrecy about who reported, a ban on payback and a record of what was done. Above those six the laws part company. They differ on who may run the channel, who may be paid to run it, whether a group may share one and who checks any of it. The WeMoral 2026 Report on Whistleblower Directive Transposition Across the EU compares all 27 across 33 points. This is the employer's half of what it found.
Which companies must have a whistleblowing channel in the EU
The companies that must have a whistleblowing channel in the EU are those with 50 workers or more, and public bodies are in scope too. Directive (EU) 2019/1937 set that line. Employers with 50 to 249 workers had until 17 December 2023 to comply, and bigger employers were in scope two years earlier.
Headcount is not the only trigger. A few sectors carry the duty at any size, banking and finance among them. Several states then widened the net in their own law. So the duty a firm owes comes from the country where it employs people. The directive is only the baseline.
What is the WeMoral 2026 report on the whistleblower directive
The WeMoral 2026 report on the whistleblower directive is a comparison of 33 points across the 27 national laws. Those points cover scope, process, protection and enforcement. WeMoral read the statutes themselves, not summaries. Then it checked the reading a second time. Every law used is listed with its official title.
Where a national rule just matches the directive, the directive's own rule was recorded. A law that says nothing on a point is logged as silent, which records a gap in the text and leaves the question open. A law that amended an older act is dated from the amendment. Every figure reflects the law in force in July 2026. The report is free to download.
What do all EU whistleblower laws have in common
All EU whistleblower laws have four things in common, and only four. Plan around them, then check everything else country by country.
- Payback is banned in all 27 states. Dismissal, demotion, a lost promotion and a punitive transfer are covered everywhere.
- Cover reaches past the person who reported. Helpers and linked people, such as colleagues and relatives, are protected in every state.
- Every state offers an outside route and a public one. A reporter always has somewhere to go beyond the employer.
- Cover turns on whether the reporter had reasonable grounds when they spoke. All 27 states apply that test, so a report that later proves wrong is still covered.
Those four are the floor. Most of the 33 points measure the space above it, and that is where your own setup work lives.
How do EU whistleblower laws differ by country
EU whistleblower laws differ by country on three practical duties: who may run the channel, whether it may be outsourced, and whether one group channel counts locally. You settle all three while designing the channel.
| Design choice | What the 27 laws do |
|---|---|
| Who may run the channel | Six states set a test on the person handling reports. Czechia asks for a criminal-record extract, Germany for proven professional competence, Greece for a named officer with a minimum one-year term. Six other states set no test at all. |
| Whether it may be outsourced | About half the states take the directive's third-party option in full. Five cut it back to intake only, so France, Poland, Portugal, Slovenia and Bulgaria keep the follow-up in house. Greece bars outsourcing in the public sector outright. |
| Whether one group channel counts locally | Eight states settle it expressly for the group, among them France, Poland, Spain, Denmark, Estonia and Finland. Ireland frames it as a duty of access for a parent, its subsidiaries and its affiliates. The other nineteen say nothing. |
So a group working in twelve states cannot assume one channel satisfies twelve laws. Most group teams run one central platform and name a local recipient in each country, which needs software built to hold one system and many named handlers.
Who enforces the EU whistleblower directive
Who enforces the EU whistleblower directive is a purpose-built body in five states, an existing regulator in ten, the courts alone in six, and nobody at all in six more. So in twelve of the 27, no official body checks that a channel exists.
| Who supervises | States | Examples |
|---|---|---|
| A body built for the job | 5 | Italy, Spain, Slovakia, Portugal, Luxembourg |
| A regulator that already existed | 10 | A data protection commission, a labour inspectorate |
| The courts only | 6 | France, Ireland, Malta, Denmark, Cyprus, Poland |
| Nobody named | 6 | Austria, Croatia, Estonia, Finland, Lithuania, the Netherlands |
Penalties vary just as widely. Spain sets the top fine on a firm at €1,000,000, while six states have no company fine on the books. Nineteen created no crime around whistleblowing, and eight threaten prison for the worst conduct.
Light supervision leaves the duty in place and only moves where the risk shows up. Where no regulator inspects, the first test of a channel is usually a claim from a reporter who says they were punished. In that claim the burden of proof falls on the employer.
What must an employer do to comply with EU whistleblower law
To comply with EU whistleblower law an employer must fix four settings per country and keep the evidence: who handles reports, whether a provider may touch them, whether the group channel counts locally, and how long a closed case is kept. Write down the answer for each country.
WeMoral is compliant whistleblowing software, a subscription service run from Frankfurt, Germany, where the case data is kept. Every report is encrypted on the way in, and the stored copy stays encrypted. Retention is a setting, and it moves to whatever span the local law fixes. The form takes reports in 103 languages, and the panel runs in 25 languages. So a group in twelve countries runs one channel and names its local handlers inside it.
Proof is the other half of the job, and it is what a regulator or a tribunal asks about. The audit log keeps a dated line for every read and every change, naming the account behind it. Dashboards show case counts and a status split, and submissions plot by week, month, year or all time. A compliance lead filters by subsidiary, then exports the result for a board pack. After switching to WeMoral, one media group saw its average reply time fall about 99%, from 11 days to 2 hours. WeMoral PRO costs €79 a month, net, and the whole record comes inside that.