The WeMoral 2026 report compares all 27 EU whistleblower laws on 33 points

The WeMoral 2026 report compares all 27 EU whistleblower laws on 33 points of scope, process, protection and enforcement. Directive (EU) 2019/1937 set one floor for the whole bloc. Above that floor every country wrote its own rules, and the report measures the gap. Two member states met the transposition deadline, and the average state was more than a year late. A company running a reporting channel in more than one country ends up subject to every one of those national versions at once.

What is the WeMoral 2026 report on whistleblower directive transposition?

The WeMoral 2026 report on whistleblower directive transposition lines up all 27 national acts against 33 points, grouped in four parts. Scope settles who must run a channel and from when. The process part covers the forms of report a channel has to take, and the deadlines that follow one in. Protection covers what may be reported and what a dismissed reporter can recover. Enforcement holds the fines, the prison terms and the supervisors. WeMoral built it in house and gives it away free. It comes from a company that sells whistleblowing software, and these 27 acts set every rule such a channel has to follow.

How were the 27 national whistleblower laws read for the report?

The 27 national whistleblower laws were read one at a time for the report, straight from the statutes. A source list at the back carries each official title with a link to the text. A second pass then checked the entries again. Where an act says nothing on a point, the report records that silence instead of filling it with the directive's default. A national rule that simply matches the directive is recorded in the directive's own wording. July 2026 is the cut off date for every entry. Three currencies appear at fixed reference rates, and the binding amount is always the one in the national text.

Which rules are the same in every EU member state?

Four rules are the same in every EU member state, and the list stops there.

1. Retaliation. Every one of the 27 laws bans punishing a person for making a report.
2. Who is covered. Protection reaches past the reporter to the people who help them, and to connected persons and firms.
3. A way out of the company. Every state offers at least one route to an outside authority and one route to going public.
4. Being wrong is allowed. No state ties protection to the report turning out to be correct. The test everywhere is what the reporter reasonably believed at the time.

Several rules widely assumed to be uniform are not. The 50 worker line is displaced in Slovakia, Slovenia and Lithuania. The seven day acknowledgement is not universal either. Even the reversed burden of proof, the rule that makes a retaliation claim winnable, is missing in Bulgaria and Czechia.

Which companies must run an internal reporting channel in the EU?

Companies with 50 or more workers must run an internal reporting channel in the EU. Twenty six of the 27 laws build on that number. Lithuania states no headcount in its Law at all. The counting rules then move the line. France wants 50 reached at the close of two financial years in a row. One good year alone does not catch you. Poland counts twice a year. Luxembourg wants the number held over 12 consecutive months. Greece measures it at a single moment and leaves trainees out. Twelve states write down no counting rule whatsoever. Smaller employers are caught as well, in named sectors. Finance and money laundering are the near universal additions. Italy pulls in every organisation with a 231 compliance model, at any size. Slovenia sets 10 workers for health, water and waste services. Spain reaches political parties and unions that take public money. Each trigger in the report was taken from the statute itself.

What deadlines apply after a whistleblower report arrives?

The deadlines that apply after a whistleblower report arrives are seven days to acknowledge it and three months to give feedback. Acknowledgement is the one rule the EU almost agrees on. Twenty six states use seven days. Lithuania is quicker at two working days. Greece and France count working days rather than calendar days, which stretches the real date. Feedback is where the states part company. Croatia sets 30 days with a ceiling of 90. Czechia starts at 30 and allows two extensions to 90. Hungary sets 30 and never goes past three months. Slovakia keeps 90 but counts from acknowledgement, which buys it another week. Latvia counts two months from a formal recognition decision. Lithuania sits at 10 working days with no outer limit at all. The report logs the event that starts each clock, because the start moves the real date as much as the number does.

How long must a company keep a whistleblower report?

A company must keep a whistleblower report for three months in Cyprus and for as long as ten years in Spain. The directive fixed no period at all. Eleven states left it there and name no number. That hands the whole decision back to the employer. Sixteen picked a figure. Five years is the most common choice, taken by eight states, and four picked three years. Sweden runs the shortest fixed term at two years from closure. The starting event decides the true length just as much as the number of years does. Czechia and Finland count from arrival, before anyone has looked at the case. Austria starts at the last processing step, so the date can move again. Portugal and Lithuania write their periods as a floor, while Spain writes its ten years as a cap. An employer with staff in Lisbon and in Madrid therefore needs two different retention settings.

What does a missing reporting channel cost a company?

A missing reporting channel costs a company up to €1,000,000 in Spain, and nothing at all in six member states. Greece comes next at €500,000. Ireland, Portugal and Luxembourg sit at €250,000, and Croatia, Estonia and Slovakia share €100,000. Below that the amounts drop away fast. Hungary bars a fine outright. Austria and Lithuania can reach a person but not the firm. Eight states went further and created a criminal offence, so prison lands on a named manager rather than on the balance sheet. Twelve member states name no compliance supervisor at all. Half of those hand the job to a judge. The rest name nobody. In nearly half the EU, then, no regulator will ever ask whether your channel exists. The question turns up later, with a report to an authority or with a claim. The report counts the fines, the prison terms and the supervisors together for that reason. A blank in one column usually means the risk moved to another.

Can one reporting channel serve a whole corporate group?

One reporting channel can serve a whole corporate group in eight EU countries. The directive says nothing about groups, so the answer had to come from national law. Bulgaria, Denmark, Estonia, Finland, France, Poland and Spain allow it in plain words, and Spain runs it as a group policy under a single officer. Ireland arrives at much the same place through a duty to give access to the staff of subsidiaries and affiliates. The other nineteen states say nothing either way. There the only written relief is sharing between firms of 50 to 249 workers, or handing intake to a provider. Neither helps a parent with a 900 worker subsidiary. Slovenia tightens it again by asking that the confidant be the firm's own employee. So most group compliance teams run one platform and name a local recipient country by country. That arrangement needs a system that can hold several company accounts under one login, keep a separate case pool for each legal entity, and still export group level analytics into a board pack.

Which whistleblowing software fits a company under several national laws?

The whistleblowing software that fits a company under several national laws is the one built to the strictest rule in the group. Find your countries in the report. Take the tightest deadline, the widest intake duty and the longest retention floor. Write those three into one procedure. Chasing the softest country is the wrong instinct, because the hardest one still binds you. WeMoral hosts, secures and updates every instance itself, so the channel is working the day you sign up. All case data is stored in Frankfurt, Germany, and never leaves the EU. Encryption covers the report in transit and at rest, and the two way thread with the reporter too. Nothing on the form logs an IP address, and every upload has its hidden data stripped out. The reporter follows the case with a one time code instead of an account. WeMoral PRO costs €79 a month, net, with 20% off when paid annually. The audit log records every read and every change, which is the record an authority asks for.

What to do with the report once you have it

Once you have the report, the first job is to read it against your own countries. The WeMoral 2026 Report on Whistleblower Directive Transposition Across the EU is free to download. Inside are the 33 columns, the country tables, the charts and the full source list. It exists because customers kept asking what their national law demands on top of the directive, and no single source answered that. A group running one channel in several member states is the reader it was built for. One compliance officer can run that channel end to end. An established team can share it through role based permissions, with personal data fields kept to the handlers who need them. Five people share the panel on PRO, and Enterprise lifts the cap. The reporting page and the panel each run in 25 languages, chosen separately. A site in Warsaw and a site in Athens work the same way on day one. Then build the one channel that satisfies the hardest law you are under, and keep the evidence that it worked.