3.2.3 Regulatory Frameworks within the European Union

Within the European Union, Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law establishes a uniform legal framework defining minimum requirements for internal and external reporting channels, procedural rules, confidentiality, and protection against reprisals. In Germany, the Hinweisgeberschutzgesetz (HinSchG) implements these provisions. Employers with at least 50 employees are required to establish internal reporting channels and to process incoming reports promptly. Failure to act or reprisals against whistleblowers may result in legal consequences.

In addition, supply chain regulations, such as the Lieferkettensorgfaltspflichtengesetz or the Directive (EU) 2024/1760 on corporate sustainability due diligence (CSDDD), oblige companies to implement grievance mechanisms accessible also to whistleblowers. Whistleblowing is thus firmly embedded in modern compliance management systems. Standards such as ISO 37002:2021 support organizations in implementing, documenting, and monitoring the required structures. However, this does not mean that companies based in the European Union naturally have effective whistleblowing systems. In the first of two case studies, a German company is involved in a dam failure linked to shortcomings in whistleblowing systems.