The 7-day/3-month feedback clock, explained

Two clocks, both starting the moment a report lands

Article 9 of Directive (EU) 2019/1937 sets two deadlines that apply to every internal report, and they measure different things:

• Acknowledgement, within 7 days of receipt. A simple confirmation that the report arrived.
• Feedback, within a reasonable time not exceeding 3 months from the acknowledgement — or, if no acknowledgement was sent, 3 months from the end of that 7-day window instead. Either way, the 3-month clock is anchored to the acknowledgement point, not to some later, looser "we'll get to it" moment.

The reason both exist is that they answer different questions for the reporter: "did this land somewhere real" (acknowledgement) and "did anything actually happen as a result" (feedback). A channel that's fast on the first and silent on the second hasn't met the obligation — it's met half of it.

What "feedback" actually means

This is where the Directive is more specific than most people assume. Art. 5(13) defines feedback as "the provision to the reporting person of information on the action envisaged or taken as follow-up and on the grounds for such follow-up." That's a deliberate outcome — telling the reporter what's being done and why — not just staying in touch with them. A handler who replies to a reporter's question, or sends a status update that doesn't actually say what action is being taken and why, hasn't given feedback in the Art. 5(13) sense, however responsive it feels in the moment. "Follow-up" itself (Art. 5(12)) is defined separately as the actual investigative action taken to assess and address what was reported — feedback is the communication of that action back to the reporter, not the action itself.

Where this can quietly go wrong

The failure mode isn't usually "we forgot to acknowledge" — automated acknowledgement is easy to get right. It's closing a case, or letting it go quiet, without ever having given feedback in the Art. 5(13) sense. Ordinary back-and-forth messages with a reporter don't discharge the obligation on their own; neither does resolving the underlying issue if nobody ever tells the reporter what was done about it. The obligation is specifically about that communication happening, not just about the underlying problem getting fixed.

This is exactly why Provoxis treats "feedback given" as its own explicit step rather than inferring it from other activity. Every report gets its acknowledgement automatically, the instant it's submitted — there's nothing for a handler to remember to do for that part. The 3-month clock then runs from that same moment, with reminders, and a case only counts as having met the feedback obligation when a handler makes the deliberate decision that feedback has actually been given — not just because the case was closed, and not just because messages went back and forth.

Legal basis

• Art. 9, Directive (EU) 2019/1937 — the 7-day acknowledgement and 3-month feedback deadlines.
• Art. 5(12) — the definition of "follow-up."
• Art. 5(13) — the definition of "feedback."