Penalties for non-compliance

What actually gets penalised isn't what people assume

The common assumption is that the Directive fines a company simply for not having a channel past 50 employees. That's not quite what Article 23 does. It requires member states to set "effective, proportionate and dissuasive" penalties for specific conduct — not for the bare absence of a channel, but for what happens around reports once the obligation exists:

• Obstructing a report — hindering or attempting to hinder someone from reporting.
• Retaliation — against a person who made a report or is covered by the Directive's protection.
• Vexatious proceedings — bringing bad-faith legal action against a reporter.
• Breaching confidentiality — exposing a reporter's identity in violation of the duty to keep it confidential.
• Knowingly false reports — penalties also apply to a reporter who knowingly reports or publicly discloses false information.

Enforcement of the underlying obligation to actually have a channel in place (Art. 8) isn't itself addressed by Article 23 — it's left to how each member state chose to transpose and enforce it. Practically, that means the real risk isn't "we forgot to set one up and got fined for that" — it's what happens the first time a report comes in and gets handled badly, or not confidentially, or with retaliation against the person who raised it.

Why there's no single number to quote

The Directive sets the requirement that penalties be dissuasive; it does not set the amounts itself. Each member state fixed its own penalty regime — its own competent authority, its own figures, sometimes its own additional categories of penalised conduct — when it transposed the Directive into national law. That means a real figure is only meaningful per country, and citing one country's number as if it were an EU-wide figure would be actively misleading. The country-specific figures live in each country's own guide in the EU Whistleblowing Directive, explained — check the guide for the country you're actually asking about rather than assuming another country's number applies to you.

The UK side: no equivalent penalty regime, but real exposure

The UK has no Article 23 equivalent — no statute sets penalties tied to a whistleblowing channel, because (as covered in UK vs EU: what's actually required where) there's no channel obligation to enforce in the first place. The exposure there runs through employment tribunal claims instead: a dismissal linked to a protected disclosure carries an uncapped compensatory award, with no minimum qualifying period. It isn't a "penalty" in the EU sense — no authority issues a fine — but the financial exposure from getting this wrong is real either way.

Why this favours having a real audit trail, not just a channel

Because what actually gets penalised is what happens around a report — confidentiality breaches, retaliation, mishandling — the strongest protection isn't just having a channel, it's being able to show exactly what happened and when. Provoxis logs every hold, every retaliation flag, and every erasure in the same database transaction as the action itself, so there's always a record of who did what and why, not just a system that exists. See the setup guide for what to have ready before you're relying on that record for the first time.

Legal basis

• Art. 23, Directive (EU) 2019/1937 — the penalty regime: obstruction, retaliation, vexatious proceedings, confidentiality breaches, and knowingly false reports, with member states left to set the actual amounts.
• s.103A, Employment Rights Act 1996 — the UK's uncapped compensatory award for a whistleblowing-linked dismissal, in place of an Art. 23-style penalty regime.