What a compliant channel actually requires

Before the clock, there's a design requirement

Most of what gets discussed about the Directive's procedural side is the 7-day/3-month clock — see the 7-day/3-month feedback clock, explained. That's Article 9(1)(b) and (f). But Article 9(1) opens with a requirement that comes before any of that: the channel itself has to be built a specific way. A channel that hits every deadline perfectly but was never designed securely in the first place hasn't actually met Article 9 — it's just been lucky so far.

The channel has to be secure by design, not secure by accident

Article 9(1)(a) requires reporting channels to be "designed, established and operated in a secure manner that ensures that the confidentiality of the identity of the reporting person and any third party mentioned in the report is protected." That's a requirement about the channel's construction, not just its outcomes — a company can't point to the fact that no leak has happened yet as proof this requirement is satisfied. It has to be true of how the channel was built, before any report ever comes in.

In practice, this is exactly where a shared inbox or a generic ticketing system tends to fail — there's no enumerable access list at all. Anyone with the shared credentials, or on a forwarding rule nobody remembers setting up, can read every case; six months in, it's often genuinely unclear who actually has access. A purpose-built channel's access is a defined set of named, authenticated staff accounts inside your own company's account — not an email alias that's accumulated forwards for years. See is an email inbox a compliant whistleblowing channel? for what that gap actually looks like once a report is live.

Written, oral, or both — and national law may decide for you

Article 9(2) lets the channel accept reports "in writing or orally, or both". Where it takes oral reports, they have to be possible "by telephone or through other voice messaging systems" and, if the reporter asks, at a physical meeting within a reasonable timeframe. So the Directive on its own doesn't make a text-only channel non-compliant.

National law often goes further. The Netherlands' Wbk requires written and oral routes and a meeting on request. Italy's regulator, ANAC, says companies must guarantee both written and oral reporting. Germany goes the other way: the explanatory memorandum to the HinSchG says either oral or text-form reporting is enough, but the law still requires a meeting in person if the reporter asks for one. Check your own country's rules before settling on a written-only channel. And even where it's optional, an oral route matters in practice: some people won't put a concern in writing. See voice reports and anonymisation, explained simply for how Provoxis's own voice channel works.

Setting the channel up is itself a consultation step, not a unilateral one

Article 8(1) requires member states to ensure that internal channels are established "following consultation with, and in agreement with, social partners where provided for by national law" — in plain terms, an employer generally can't just decide unilaterally how the channel will work and roll it out. Exactly which body has to be consulted, and how much say it actually has, is left to each member state's own transposition — see, for instance, Germany's works-council co-determination or France's CSE consultation requirement for what that looks like concretely in each country. The requirement to consult someone isn't a national quirk, though — it's the Directive's own baseline; only the mechanism varies by country.

Running it yourself or handing it to a third party — both are allowed

Article 8(5) explicitly permits operating the channel either internally, through a person or department designated for the purpose, or externally, through a third-party provider — provided the same Article 9 safeguards apply either way. Outsourcing the channel doesn't lower the bar; it just moves who's responsible for clearing it.

The public sector is covered too

Article 8(9) extends the same obligation to public-sector legal entities, not just private companies — with one option built in for member states: they may exempt municipalities with fewer than 10,000 inhabitants, or fewer than 50 workers, from the requirement, and may let several municipalities share a channel. Where a country's guide mentions a public-sector threshold or carve-out — France's, for instance — that's this provision being exercised nationally, not an unrelated national rule.

Legal basis

• Art. 9(1)(a), Directive (EU) 2019/1937 — the secure-design requirement protecting the confidentiality of a reporter's identity.
• Art. 9(2) — reporting in writing, orally, or both; oral reporting by phone or voice messaging, and a physical meeting on request.
• Art. 8(1) — establishing the channel following consultation with social partners, where provided for by national law.
• Art. 8(5) — the choice between operating the channel internally or through a third-party provider.
• Art. 8(9) — the public-sector obligation, and the member-state option to exempt small municipalities.