What you can actually report under the Directive

Not "any workplace complaint"

A common assumption is that the Directive protects reporting almost anything that feels wrong at work. It doesn't — Article 2 defines a specific material scope: breaches of Union law in named areas. A report that falls outside those areas isn't automatically unprotected in practice (more on that below), but it's worth knowing the actual boundary rather than assuming the Directive covers everything a company might reasonably want reported.

The ten named areas

Article 2(1)(a) lists ten specific areas of Union law:

• Public procurement
• Financial services, products and markets, and prevention of money laundering and terrorist financing
• Product safety and compliance
• Transport safety
• Protection of the environment
• Radiation protection and nuclear safety
• Food and feed safety, animal health and welfare
• Public health
• Consumer protection
• Protection of privacy and personal data, and security of network and information systems

Two more routes in

Article 2(1) adds two further categories beyond that list:

• Breaches affecting the EU's financial interests (Art. 2(1)(b)) — fraud or corruption involving the EU budget, under Article 325 TFEU.
• Internal-market breaches (Art. 2(1)(c)) — including competition law, state aid rules, and corporate tax arrangements structured to defeat the purpose of tax law.

What's carved out, deliberately

Article 3 excludes several areas the Directive doesn't touch, regardless of the list above: national security, the protection of classified information, legal and medical professional privilege, the secrecy of judicial deliberations, and rules on criminal procedure. Where another EU law already sets its own specific reporting requirement for a sector, that sector-specific rule takes precedence over the Directive for the part it already covers.

Where this leaves a garden-variety HR complaint

A report that isn't about one of the areas above — a personal grievance, a management style complaint, an interpersonal conflict — isn't automatically covered by the Directive's own floor. Two things soften that in practice, though:

• Most member states extended the floor when they transposed the Directive. Germany's HinSchG, for instance, reaches breaches of general criminal law and administrative-fine provisions protecting employee rights more broadly than this list alone — see Germany's HinSchG, explained. Check the country's own guide rather than assuming the Directive's own list is the final word for a given jurisdiction.
• A company's own channel policy can accept more than the legal minimum requires. Most companies do, since a channel that turns away anything outside Art. 2's list stops being the simple "raise a concern here" channel it's meant to be. What the Directive's scope actually controls is which reports carry the Directive's own legal protections (the acknowledgement and feedback clocks, the retaliation protection) — not which reports a company is willing to receive in the first place.

Legal basis

• Art. 2(1)(a), Directive (EU) 2019/1937 — the ten named areas of Union law.
• Art. 2(1)(b) — breaches affecting the EU's financial interests.
• Art. 2(1)(c) — internal-market breaches, including competition, state aid, and corporate tax.
• Art. 2(2) — member states' freedom to extend protection beyond this floor in their own transposing law.
• Art. 3 — the exclusions: national security, classified information, legal and medical privilege, judicial secrecy, criminal procedure, and sector-specific EU acts with their own reporting regime.