The 50-employee threshold, explained

The line is 50 workers, for almost every private company

Directive (EU) 2019/1937 requires private-sector legal entities with 50 or more workers to run an internal reporting channel (Art. 8(3)). For the overwhelming majority of companies, that's a bright line with no discretion built in — an EU company either has 50 or more workers and is obligated, or it doesn't and it isn't. That's deliberate: unlike the UK's position (covered in UK vs EU: what's actually required where), the Directive gives most EU companies a bright line to check themselves against rather than a general expectation to interpret. A narrow set of regulated sectors are the exception — see below.

What "50 workers" is measured against

The threshold is assessed per legal entity, not across a corporate group — a subsidiary with 60 workers is obligated even if its parent company has none, and a 30-worker subsidiary isn't pulled over the line by a large parent. What the Directive doesn't specify is exactly how to count part-time staff towards that number; it leaves that detail to each member state's own transposing law, which is exactly the kind of thing worth checking against the specific country you're asking about, not assuming from the Directive text alone.

Both deadlines for this have already passed

The Directive set two transposition deadlines, and by the time you're reading this, both are behind us:

• 17 December 2021 — the general deadline (Art. 26(1)), covering private-sector entities with 250 or more workers.
• 17 December 2023 — an extended deadline that applied specifically to entities with 50 to 249 workers (Art. 26(2), a derogation from Art. 26(1)).

In other words, there's no longer a future date to plan around. If your company has 50 or more workers in the EU today, the obligation to have a channel in place isn't approaching — it already applies now.

The one break smaller companies get

Article 8(6) lets legal entities with 50 to 249 workers share resources for receiving and investigating reports — with other group entities, for instance, rather than building a dedicated function from scratch. It's the Directive's own acknowledgement that a 60-person company shouldn't need the same internal machinery as a 6,000-person one. It doesn't reduce what the channel has to achieve (confidentiality, the acknowledgement and feedback clocks, protection against retaliation all still apply in full) — it just means you're not expected to build a standalone compliance department to get there. That's the gap whistleblowing software built for a company this size is built to close: live in under 5 minutes, with the acknowledgement and feedback clocks and a ready-made policy already built in, no legal team required.

The exception: some companies are obligated below 50 workers

The 50-worker line isn't universal. Article 8(4) removes the threshold entirely for entities within the scope of the Directive's own Annex Parts I.B and II — broadly, financial-services and anti-money-laundering entities already subject to EU regulatory frameworks, plus civil aviation safety, maritime safety, and offshore oil-and-gas safety. A 20-person investment firm in one of those categories is obligated the same as a 200-person one; headcount doesn't enter into it there. Separately, Article 8(7) lets a member state choose to extend the obligation below 50 workers more broadly, based on its own national risk assessment tied to environmental or public-health impact — whether that applies to you is a country-specific question the Directive itself doesn't answer uniformly. See what a compliant channel actually requires for the rest of what Article 8 covers beyond the headcount question.

If your company isn't in one of the regulated sectors above, the 50-worker line is still the right one to check yourself against — this is a real exception, but it's the exception, not the norm, for most companies reading this.

If you're not sure which side of the line you're on

Two things are worth checking rather than assuming. First, some member states set stricter rules on top of the Directive's floor when they transposed it — see the relevant country guide once it's published for your jurisdiction. Second, if you're close to 50 either way, it's worth treating the channel as something to have ready rather than something to wait on: see the setup guide for what to have in place before you cross the line, not after.

Legal basis

• Art. 8(3) — the 50-worker threshold for private-sector internal reporting channels.
• Art. 8(4) — the exemption from that threshold for entities within Annex Parts I.B and II (financial services/AML, aviation, maritime, and offshore oil-and-gas safety).
• Art. 8(6) — the shared-resources allowance for entities with 50 to 249 workers.
• Art. 8(7) — the member-state option to extend the obligation below 50 workers on environmental or public-health grounds.
• Art. 26(1) — the general 17 December 2021 transposition deadline.
• Art. 26(2) — the extended 17 December 2023 deadline for entities with 50 to 249 workers.

All from Directive (EU) 2019/1937 (consolidated text, EUR-Lex). The per-legal-entity (not group-wide) reading of Art. 8(3) isn't spelled out in the Directive's own text — see Osborne Clarke's analysis for corporate groups for the fuller reasoning.