Whistleblowing / EU law
Directive 2019/1937 makes every private employer with 50 or more workers run a confidential reporting route, acknowledge each report within seven days and feed back within three months. Each of the 27 member states wrote its own version. Confide is the system built to run a program that meets each of them.
“The global leaders in whistleblowing software”
As seen in:
Fulham F.C.
Article 9(1)(a) requires the route to be run so that the identity of the reporter, and of anyone mentioned in the report, stays confidential and out of reach of unauthorized staff. Confide takes reports by web form, voice, QR code, email and API, routes each one past line management to the people you name, and locks anyone named in a report out of it automatically.
Article 9(1)(b) gives you seven days to acknowledge receipt. Article 9(1)(f) gives you three months from that acknowledgment to feed back, or three months from the end of the seven days if no acknowledgment went out. Confide dates the arrival, the acknowledgment and the feedback on every case, so both clocks are visible before either runs out.
Article 9(1)(c) asks for a designated impartial person or department to follow up, and Article 18(1) for a record of every report received, kept no longer than necessary. Confide assigns each case to the handler your roles name, writes every access to an immutable record, and keeps a case under legal hold when it must not be removed.
| Requirement | What the law says |  |
|---|---|---|
| Who must have an internal route | Art. 8(3): private entities with 50 or more workers. Art. 8(4): no threshold for entities under the Union acts on financial services, anti-money laundering, and transport and offshore safety listed in the Annex | IncludedOne annual fee by headcount, unlimited users |
| Written and oral reporting | Art. 9(2): in writing or orally, by telephone or "other voice messaging systems", and a meeting on request | IncludedWeb form, voice report, QR code, email, API |
| Confidentiality of reporter and third parties | Art. 9(1)(a): identity protected, no access for unauthorized staff | IncludedAnyone named locked out automatically |
| Acknowledgment of receipt | Art. 9(1)(b), within seven days | IncludedAcknowledgment dated on the case |
| Impartial person or department | Art. 9(1)(c): designated and competent to follow up | IncludedRoles decide who handles a case |
| Feedback to the reporter | Art. 9(1)(f), within three months of the acknowledgment | IncludedThree-month clock on every case |
| Anonymous reports | Art. 6(2) leaves it to member states: Spain requires, Germany and Ireland do not | IncludedAnonymous web form, voice and QR code |
| Records and retention | Art. 18(1): every report recorded, kept no longer than necessary. Caps: 3 years Germany, 5 Italy, 10 Spain | IncludedImmutable access record, legal hold |
| Information on external routes | Art. 9(1)(g): how to report to the competent authority | IncludedWritten into the policy at kick-off |
| Retaliation prohibited, burden reversed | Art. 19 lists fifteen forms. Art. 21(5): detriment presumed to be retaliation | IncludedEvery access on an immutable record |
| Penalties | Art. 23: effective, proportionate and dissuasive. Germany up to EUR 50,000, or EUR 500,000 for a company. Spain up to EUR 1 million | IncludedSentinel answers across every case |
| GDPR and data minimization | Art. 17: processing under Regulation 2016/679, irrelevant data not collected, or removed without undue delay | IncludedGDPR, ISO 27001, SOC 2, hosted in Frankfurt |
A group with entities in several member states owes each workforce a route it can use. Confide takes reports in 30+ languages and adds a new language within a day, so the Polish plant, the Spanish sales office and the Dutch head office all report into one system, in their own words.
The duty for private employers with 50 to 249 workers has run since 17 December 2023, and in March 2025 the Court of Justice fined Germany EUR 34 million for transposing late. A standard Confide setup takes one day and an enterprise rollout three to six weeks, hosted in Frankfurt under ISO 27001, SOC 2 and GDPR.
One annual fee from USD 2,000 by headcount covers unlimited users and cases. An entity at the 50-worker threshold and a group with a designated handler in every member state both pay nothing per user or per report, and the AI is in the platform fee, off until you enable it.
From a Directive that sets the floor and 27 national laws that build on it, to one system, one record and one set of clocks in every entity.
Book a demoA Confide compliance expert works through which of your entities fall inside the duty: every private entity with 50 or more workers, every entity under the Annex's financial services, anti-money laundering, transport safety and offshore safety acts whatever its size, and which national law governs each one. Where reports arrive today, and who sees them, goes on the same map.
Three things differ by member state. Whether anonymous reports must be accepted: Spain yes, Germany and Ireland no. Whether entities can share one reporting office: German law lets a third party run it and lets employers with 50 to 249 workers share one, and French law lets the procedure be common to several companies of a group. How long records may be kept: three years after the case closes in Germany, five in Italy, ten in Spain.
Web form, voice report, QR code, email intake and API go live in the languages your people use, from 30+ with a new one within a day. Article 9(2) requires reporting in writing or orally, and a voice report inside the system is one of the "other voice messaging systems" the Article names, distorted and transcribed with the audio securely held. Article 9(2) also requires a physical meeting on request, and its minutes go on the case.
Each report is assigned to the impartial person or department Article 9(1)(c) requires, with the role to see it, and anyone named in it is locked out. The case shows the day it arrived, the day it was acknowledged, within seven days under Article 9(1)(b), and the day feedback went back, within three months under Article 9(1)(f). Echo asks its follow-up questions at intake, so 50% more reports arrive ready to investigate before the handler opens them.
Staff in every entity are told how the route works and what Article 19 protects them from, including threats and attempts at retaliation. The policy carries the information Article 9(1)(g) requires on reporting externally: the competent authority in each country, such as ANAC in Italy and the Autoridad Independiente de Protección del Informante in Spain, and the rule in Article 10 that a reporter may go to it directly.
Every report is recorded as Article 18(1) requires, with every access on an immutable record and legal hold where a case must outlast a retention cap. Data that is manifestly not relevant is not collected, as Article 17 requires. Sentinel answers questions across every case with citations, so the board sees what came in across every member state, what was done and how long it took.
