What Is the Deadline for Companies to Implement Whistleblowing Channels in Spain (50–249 Employees)?

Understanding what is the deadline for companies with 50 to 249 employees to implement a whistleblowing channel in Spain requires reconciling two overlapping timelines: the statutory deadline set by Law 2/2023 and the transitional notification windows established by Spain’s Independent Authority for Whistleblower Protection (Autoridad Independiente de Protección del Informante, or AAI). Law 2/2023, published in the Boletín Oficial del Estado (BOE) on 21 February 2023, set 1 December 2023 as the outer limit for companies in the 50–249 employee bracket to have an internal reporting system fully operational.

Separately, the AAI, which became operational on 1 September 2025, introduced its own procedural deadlines for organisations to formally notify their appointed system managers, with an initial window to 1 November 2025 and subsequent updates extending the notification deadline into 2026. This guide walks compliance officers, in-house counsel and SME owners through every obligation, process rule and penalty that applies right now.

Who Must Implement a Whistleblowing Channel? Thresholds and Practical Examples

Law 2/2023 Thresholds: What Is the Deadline for Companies of Different Sizes?

Law 2/2023 (Ley 2/2023, de 20 de febrero, reguladora de la protección de las personas que informen sobre infracciones normativas y de lucha contra la corrupción) creates a two-tier deadline structure based on workforce size. Companies with 250 or more employees were required to establish their internal reporting system (sistema interno de información) within three months of the Law’s entry into force, that is, by 13 June 2023 under the transitional provisions of the statute (BOE, Disposición transitoria segunda). Companies with 50 to 249 employees received an extended statutory deadline of 1 December 2023 to implement the same system (BOE, Law 2/2023, Disposición transitoria segunda).

Entities with fewer than 50 employees are not subject to a general obligation under Law 2/2023, though the Law recommends voluntary adoption and certain sector-specific regulations (such as those covering financial services or anti-money-laundering) may independently impose the requirement.

Which Entities Are Covered?

The whistleblowing channel requirements in Spain apply to a broad range of organisations beyond conventional employers. Key categories include:

• Private-sector companies meeting the employee threshold, including subsidiaries and group companies, each legal entity that independently meets the threshold must have its own system, although companies with 50–249 employees may share resources and infrastructure.
• Public-sector bodies, municipalities, public entities and state-owned enterprises, with certain transitional provisions for smaller municipalities.
• Subcontractors and concessionaires of the public administration when contractual or regulatory conditions so require.
• Political parties, trade unions and employer organisations receiving or managing public funds.

For group companies, the critical question is whether each entity individually crosses the 50-employee threshold. If a Spanish subsidiary has 80 employees, it must implement its own internal reporting system regardless of the parent company’s location. Two or more entities in the 50–249 bracket may share a single channel and a single RSII (Responsable del Sistema de Información Interna), provided each entity’s reporting requirements are independently met.

Legal Basis: Law 2/2023, Royal Decree and the EU Whistleblowing Directive

Law 2/2023 Spain transposes the EU Whistleblowing Directive (Directive (EU) 2019/1937) into Spanish domestic law. Spain’s transposition was notably late, the Directive’s deadline was 17 December 2021, and the European Commission had opened infringement proceedings before the Law was finally adopted in February 2023.

Core Obligations Under the Statute

The Law imposes three interconnected obligations on covered entities:

• Internal reporting channel. Every obligated entity must establish a secure, confidential channel through which employees, contractors, shareholders and other stakeholders can report regulatory and criminal infractions. The channel must permit written and oral submissions, including, where technically feasible, in-person meetings (Law 2/2023, Articles 5–8).
• External reporting channel. The AAI serves as Spain’s designated external channel, receiving reports that informants choose not to, or cannot, submit internally. The AAI was created by Title III of Law 2/2023 and its organisational and operational rules were further developed by Royal Decree 1101/2024.
• Protection from retaliation. The Law prohibits any form of retaliation against informants, including dismissal, demotion, harassment or discriminatory treatment. Protection extends to facilitators, connected third parties and legal entities associated with the informant (Law 2/2023, Articles 35–39).

Royal Decree 1101/2024 supplemented the Law by detailing the AAI’s internal structure, staffing, and, critically, the transitional notification obligations for entities that had already set up their internal reporting systems but still needed to formally register their RSII with the authority. Industry observers expect the AAI’s enforcement stance to harden progressively as its operational capacity matures throughout 2026.

AAI Registration and Notification Workflow: Timeline and Current Deadlines

One of the most practically important questions for compliance teams is not merely what is the deadline for companies to build their internal system, the statutory dates above answer that, but when they must formally notify the AAI whistleblower authority in Spain of their system manager’s appointment. This procedural step has been the source of significant confusion because the AAI itself was not operational until well after the Law’s statutory deadlines had passed.

Key Milestones in the AAI’s Operationalisation

Action Steps for Compliance Teams

Regardless of which precise final deadline applies, the required actions are clear:

• Step 1, Appoint the RSII. Identify the individual (or, for 50–249 employee entities, optionally an outsourced provider) who will serve as the Responsable del Sistema de Información Interna. Record their full name, professional contact details and the scope of their mandate.
• Step 2, Complete the Comunicación del Responsable form. Access the AAI’s electronic portal and complete the official notification form. The form requires the RSII’s identity, the entity’s details, and a description of the internal reporting system in place.
• Step 3, Submit within the current deadline. The initial deadline of 1 November 2025 has been subject to adjustment, with practitioner sources referencing 10 April 2026 as the updated cut-off date. Compliance teams should check the AAI’s portal directly to confirm the operative deadline before submission.

Navigating Conflicting Published Dates

The discrepancy between the 1 November 2025 and 10 April 2026 deadlines reflects the practical reality that the AAI’s digital infrastructure and notification procedures required additional development time after its formal operationalisation. Early indications suggest the AAI has adopted a pragmatic approach, prioritising system readiness over strict enforcement of the initial two-month window. Nonetheless, entities that have not yet submitted their notification face increasing regulatory risk as the AAI’s enforcement capacity scales up throughout 2026.

Process Rules: 7-Day Acknowledgement, Three-Month Resolution and Anonymity

Once the internal reporting system is operational, Law 2/2023 imposes strict procedural timelines that every covered entity must follow. Failure to meet these timelines can itself constitute an administrative infraction.

The 7-Day Acknowledgement Rule

Upon receiving a report through the internal channel, the RSII or their delegate must send a formal acknowledgement of receipt to the informant within seven calendar days (Law 2/2023, Article 9). This 7-day acknowledgement requirement in Spain applies regardless of whether the report was submitted in writing, orally or through an in-person meeting. The acknowledgement should confirm:

• The date the report was received.
• That the report has been registered in the system and will be reviewed.
• The informant’s rights, including protection from retaliation and the right to submit the same report to the AAI’s external channel.

The Three-Month Resolution Timeline

The three-month resolution window for whistleblowing in Spain requires that the internal investigation reach a substantive conclusion, or that the informant receive a reasoned update, within three months from the date of the acknowledgement of receipt (Law 2/2023, Article 9). If the investigation is complex, the deadline may be extended with documented justification, but the informant must be notified of the extension and the reasons for it. At the three-month mark, the entity must communicate:

• The status of the investigation.
• Any actions taken or proposed.
• The expected timeline for final resolution, if ongoing.

Anonymous Reporting and Data Protection

The anonymous reporting requirements in Spain under Law 2/2023 are clear: organisations must accept anonymous reports and must diligently investigate them even when the informant’s identity is unknown (Article 7.3). The system should be designed to allow anonymous submissions and, where possible, permit follow-up communications with the anonymous reporter through a secure, non-identifying mechanism.

Data protection obligations run in parallel. The internal reporting system must comply with Spain’s data-protection framework (the GDPR and Spain’s Organic Law 3/2018). Personal data collected through the channel may be retained only for the duration necessary to decide whether to initiate an investigation and, in any event, for no longer than ten years. Access to the identity of the informant must be strictly limited to the RSII and, where necessary, to individuals directly involved in the investigation.

What Are the Three Main Whistleblowing Channels?

Law 2/2023 establishes a three-tier reporting architecture:

• Internal channel, managed by the entity itself (or outsourced to a qualified provider), with the RSII serving as gatekeeper.
• External channel, the AAI, Spain’s independent authority, which accepts reports directly from informants who choose not to use the internal channel or who believe it would be ineffective.
• Public disclosure, as a last resort, informants may make information public (e.g., to the press) and still receive legal protection, provided certain conditions are met, such as a reasonable belief that the infraction constitutes an imminent or manifest danger to the public interest.

Practical Implementation Checklist for Your Internal Reporting System in Spain

Building a compliant internal reporting system in Spain requires more than installing a software platform. The following step-by-step checklist maps the operational, policy and training requirements that Law 2/2023 demands.

• Governance decision. Determine whether the RSII will be an in-house appointee (e.g., compliance officer, legal counsel) or an outsourced specialist. For entities with 50–249 employees, outsourcing is explicitly permitted.
• Channel design. Implement a system that supports written, oral and, where feasible, in-person reporting. Ensure the technology guarantees confidentiality and data security.
• Policy drafting. Prepare an internal whistleblowing policy covering scope, eligible reporters, reportable matters, investigation procedures, timelines (7-day acknowledgement, 3-month resolution), non-retaliation guarantees and data-protection safeguards.
• Training. Train the RSII, HR personnel, line managers and the compliance committee on the operation of the channel, the handling of reports and the prohibition on retaliation.
• Communication. Publish the policy on the company intranet, include it in employee onboarding materials and display the channel’s access details in accessible locations.
• Record-keeping. Establish a secure log for all reports received, the status of investigations and outcomes. Retain records for the legally required period (maximum ten years) and restrict access to authorised individuals.
• AAI notification. Complete the Comunicación del Responsable on the AAI portal within the applicable deadline. Retain proof of submission.
• Periodic review. Schedule annual reviews of the channel’s effectiveness, including anonymous feedback surveys and process audits. Update procedures as the AAI publishes guidance or enforcement decisions.

RSII Responsibilities: Appointment, Conflicts and Escalation

The Responsable del Sistema de Información Interna (RSII) is the linchpin of the entire system. Under Law 2/2023, the RSII must:

• Act independently and without instructions from the entity’s management when handling reports.
• Maintain strict confidentiality over the identity of informants and the content of reports.
• Manage or supervise the acknowledgement, triage, investigation and resolution of every report.
• Escalate matters to the compliance committee, the board or external authorities when warranted.
• Avoid conflicts of interest, the RSII should not be the subject of a report they are required to investigate.

For entities choosing to outsource, the vendor appointment should be documented in a service-level agreement covering minimum response times (ideally 48 hours for initial triage), multilingual capability if the workforce includes non-Spanish speakers, data-hosting location (EU-only), and escalation protocols to the entity’s board or compliance committee.

When to Outsource: Key Vendor Selection Criteria

Outsourcing is common among companies in the 50–249 bracket, where dedicating a full-time in-house RSII may be disproportionate. When evaluating providers, compliance teams should verify:

• Regulatory alignment. Does the vendor’s platform and process explicitly comply with Law 2/2023 and GDPR?
• Response-time commitments. Is the 7-day acknowledgement SLA contractually guaranteed?
• Secure communication. Does the platform allow two-way anonymous dialogue with informants?
• Audit trail. Does the system generate tamper-proof logs suitable for regulatory inspections?
• Scalability. Can the service accommodate future growth beyond 249 employees without system replacement?

Penalties for Not Implementing a Whistleblowing Channel in Spain

Law 2/2023 establishes a graduated sanctions regime that distinguishes between minor, serious and very serious infractions (Articles 62–65). The penalties for not implementing a whistleblowing channel in Spain are substantial and apply both to the entity and, in certain cases, to responsible individuals.

Sanction Ranges

• Very serious infractions, including failure to implement an internal reporting system, active obstruction of reporting, or retaliation against an informant, carry fines of up to €1,000,000 for legal persons (Law 2/2023, Article 65). Natural persons responsible for such infractions face fines of up to €300,000.
• Serious infractions, such as failure to respond within the three-month timeline or inadequate safeguards for informant confidentiality, may result in fines of up to €600,000 for legal persons.
• Minor infractions, including late notification to the AAI or failure to maintain proper records, carry fines of up to €100,000 for legal persons.

Aggravating factors that can push penalties toward the upper range include repeat offences within a five-year period, the number of persons affected, the economic benefit obtained from the infraction, and evidence of intentional obstruction or concealment.

How Penalties Can Arise: Practical Scenarios

Consider a technology company with 70 employees that never established an internal reporting channel. An employee discovers a procurement fraud and, with no internal avenue available, reports directly to the AAI. The AAI opens a file on the underlying fraud and, separately, may initiate an administrative procedure against the company for its failure to implement the legally required system. In a worst-case scenario involving retaliation, the employee is dismissed after the report becomes known, the company faces both the penalty for system failure and a further very serious infraction for retaliation, potentially reaching the €1,000,000 ceiling.

A second scenario involves a multinational subsidiary with 120 employees that implemented a channel but never appointed an RSII or notified the AAI. Even though the channel exists, the absence of a formally designated and notified manager constitutes a compliance gap that the AAI can sanction as a serious or very serious infraction, depending on whether reports were mishandled as a consequence.

Conclusion: What Is the Deadline for Companies and What Should You Do Now?

The statutory deadline for companies with 50–249 employees under Law 2/2023 has already passed. Any entity in this bracket that has not yet implemented its internal reporting system is already in potential breach and exposed to administrative sanctions of up to €1,000,000. The immediate priority is threefold: ensure the channel is operational, appoint an RSII, and submit the formal notification to the AAI before the current procedural deadline closes. Compliance is not only a legal obligation, it is a defence against the compounding risk of unreported infractions and unprotected informants.

For a tailored compliance review or assistance with RSII appointment and AAI notification, find a specialist compliance lawyer through the Global Law Experts directory.

Sources

1. Boletín Oficial del Estado (BOE), Ley 2/2023
2. EU Whistleblowing Directive (2019/1937)
3. Pérez-Llorca, Legal Briefing: Entry into Force of the Independent Whistleblower Protection Authority
4. Lexology, AAI Notification Deadline and Procedural Updates
5. Cuatrecasas, Whistleblowing: Aprobada la Ley 2/2023