Law 2/2023 requires companies with 50 or more employees to have an operational Internal Reporting System, with a formally designated officer and statutory response deadlines. Summum Consultoria guides you through the complete implementation: analysis, technology, procedures and training.
Law 2/2023, of 20 February, transposed the European Whistleblowing Directive (2019/1937) and requires every private company with 50 or more employees to implement a whistleblowing channel — legally termed an Internal Reporting System. The deadline was 13 June 2023 for companies with 250 or more employees, and 1 December 2023 for those with between 50 and 249. Financial sector entities and parties subject to anti-money-laundering obligations must comply regardless of their headcount. The Independent Authority for the Protection of Whistleblowers (AIPI), operational since September 2025, now exercises full sanctioning powers: failing to implement the channel, or failing to guarantee anonymity and confidentiality, constitutes a serious infringement subject to fines of up to €1,000,000 for legal entities.
The channel is not merely a mailbox or a web form. The law requires the system to protect the reporter's identity (or guarantee anonymity if requested), to issue an acknowledgement of receipt within a maximum of seven calendar days, to complete the investigation within a maximum of three months (extendable), and to have a formally designated system officer. In addition, the organisation must have a documented non-retaliation policy communicated to all staff. A poorly configured channel — lacking these elements — is equally non-compliant even if the technology is in place.
At Summum Consultoria we have been guiding SMEs and mid-size companies through regulatory compliance projects since 2007. We know that most organisations need a solution that is functional without creating extra bureaucracy: a system implemented correctly from day one, integrated with existing internal processes, and with the documentation needed to demonstrate compliance to the AIPI or in an audit.
We analyse the organisational structure, headcount, applicable regulated sectors and any existing compliance systems. We determine whether the channel must be individual or shared (corporate groups), which groups are entitled to report, and which subject matters must be covered beyond the legal minimum.
We define the reporting management workflow: intake channels (web, phone, in-person), system officer, investigation procedure and deadlines. We advise on the most suitable technology platform based on the organisation's size and budget, ensuring it meets the encryption, pseudonymisation and restricted-access requirements set by the AIPI.
We draft the Internal Reporting System Policy, the reporting management procedure, the formal officer designation, and acknowledgement-of-receipt templates. We review the data protection clause linked to the channel to ensure alignment with the GDPR and Law 2/2023.
We activate the channel, train the designated officer and communicate the system to all staff. We deliver the implementation record that evidences compliance to the AIPI. From that point, we offer an annual review to keep the system up to date with regulatory or organisational changes.
The operational detail: what we deliver as part of the work and what we keep alive afterwards.
Mandatory applicability analysis
Determination of the applicable legal threshold (headcount, regulated sector, corporate group) and the exact scope of the internal system to be implemented.
Technology selection and configuration
Platform recommendation for the whistleblowing channel, meeting encryption, access-control and investigation-traceability requirements. Initial configuration included.
Internal policy and procedures
Drafting of the Internal Reporting System Policy, investigation protocol, acknowledgement-of-receipt and closure templates, and formal designation of the system officer.
Data protection integration
Review of the information notice and the Record of Processing Activities (RPA) linked to the channel, coordinated with the DPO or the organisation's privacy officer.
Training for the officer and all staff
Training session for the system officer on managing investigations, deadlines and non-retaliation obligations. Tailored internal communication for all employees required to be aware of the channel.
Accreditation and annual review
Delivery of the implementation dossier with all documentation required to evidence compliance to the AIPI. Annual review to adapt to regulatory updates or organisational changes.
The whistleblowing channel forms part of a broader compliance ecosystem: it connects with criminal compliance, data protection and corporate governance policies that we address in an integrated way at Summum Consultoria and Summum Calidad.
The whistleblowing channel is one of the key elements of a robust criminal compliance programme: documenting its existence and effective use helps demonstrate due diligence before the courts.
View service → consultoríaProcessing personal data through the whistleblowing channel requires a specific legal basis, a tailored information notice and an updated RPA: we coordinate this with the GDPR compliance project.
View service → calidadISO 37301 (Compliance Management System) integrates the whistleblowing channel as an essential control; if your company is moving towards this standard, the system already in place will accelerate certification.
View service →All private companies with 50 or more employees are required to comply: those with 250 or more since 13 June 2023, and those with between 50 and 249 since 1 December 2023. Financial sector entities and parties subject to anti-money-laundering obligations are also required, regardless of their size. Companies with between 50 and 249 employees may share a channel with other entities in the same group; municipalities with fewer than 10,000 inhabitants may share one with other public administrations in their autonomous community.
The Independent Authority for the Protection of Whistleblowers (AIPI), operational since September 2025, may sanction the absence of a channel as a serious infringement with fines of up to €1,000,000 for legal entities. In addition, the company may be barred from public procurement and from receiving grants. The first effective sanctions were issued in 2025.
No. The law requires the channel to guarantee the reporter's confidentiality or anonymity, to issue an acknowledgement of receipt within a maximum of seven days, to conclude the investigation within a maximum of three months, and to have a formally designated officer. A simple email inbox or generic contact form does not meet these requirements and exposes the company to sanctions all the same.
No. Law 2/2023 covers a wide range of matters: infringements of European Union law, domestic law, conduct contrary to the organisation's ethical principles, accounting and financial irregularities, and any violation of fundamental rights in the workplace. Organisations may voluntarily extend the scope of the channel beyond the legal minimum.
With Summum Consultoria's guidance, a mid-size company can have the system operational and documented within three to six weeks, depending on organisational complexity and whether some compliance elements are already in place. The process covers diagnosis, design, technology, documentation and training.