What’s next for the EU Whistleblower Protection Directive?
Whistleblowing is increasingly recognized as an important source of information about organizational risk. More employees and third parties are using internal reporting channels to raise concerns, giving organizations greater visibility into potential misconduct and creating new demands on the teams responsible for managing those reports.
This is borne out in the data NAVEX analyzes from 2.37 million internal reports. Once again, we saw a record report volume globally, with the median reports per 100 employees reaching 1.65 – up from 1.57 in 2024, which was also a record high. In Europe, we’ve also seen growing reporting activity, reaching 0.77 reports per 100 employees in 2025, up from 0.53 in 2022.
Although reporting activity in Europe is increasing, the median reporting rate remains less than half the global benchmark. Differences in reporting behavior can reflect many factors, including organizational culture, awareness of reporting channels and confidence in the protections of those who speak up. This raises an important question as the EU evaluates its whistleblower protection framework: are people sufficiently confident they can report concerns without facing negative consequences?
Against this backdrop of record internal reporting levels, the European Union is taking a closer look at its framework for protecting whistleblowers.
The European Commission is evaluating Directive (EU) 2019/1937, commonly known as the EU Whistleblower Protection Directive, and has invited stakeholders to assess how effectively it is working and what improvements may be necessary. This review raises important questions about the effectiveness of existing protections, whether the scope of the Directive should expand and how its requirements can be enforced consistently across Member States.
There are differing views about what should happen next. While some stakeholders see opportunities to strengthen or expand the framework, Transparency International has urged EU policymakers to prioritize closing gaps in national legislation and enforcing existing protections rather than reopening the Directive itself.
As reporting volumes continue to grow and the regulatory landscape evolves, this is an important opportunity to consider whether Europe’s whistleblower protection framework remains fit for purpose.
Regional differences in internal reporting
In 2025, we saw record levels of reporting globally.
- 2.37 million
Internal reports analyzed
- 1.65
Global Median Reports per 100 Employees
- 0.77
Europe Median Reports per 100 Employees
Why is the EU reviewing whistleblower protection?
Adopted in 2019, the EU Whistleblower Protection Directive established common minimum standards for protecting individuals who report breaches of EU law. These include requirements for confidential reporting channels, appropriate follow-up and safeguards against retaliation.
Member States were required to transpose the Directive into national law by December 2021. However, implementation has been uneven, with some countries introducing legislation later than required and others adopting provisions that do not fully reflect the Directive’s requirements. In its July 2024 implementation report, the European Commission itself identified shortcomings in several important areas, including the scope of protection, conditions for obtaining protection and measures to prevent retaliation.
The EU has also demonstrated its willingness to enforce these requirements. Following delays in national implementation, the European Commission opened infringement proceedings against 24 Member States in January 2022 and subsequently referred six cases to the Court of Justice of the European Union. The enforcement action reinforces the importance the EU places on the implementation of whistleblower protections.
The European Commission began gathering evidence for its evaluation in August 2025, followed by a public consultation from January 28 to April 22, 2026. Alongside the public questionnaire, the evaluation draws on additional stakeholder engagement and research.
The Commission is assessing the Directive against five criteria: effectiveness, efficiency, relevance, coherence with other EU policies and the added value of having a common EU framework. The evaluation is scheduled for completion in the fourth quarter of 2026.
What happens next will depend on the Commission’s findings. The evaluation could conclude that improvements should focus on enforcing existing requirements or that further policy measures are warranted. If legislative amendments are considered necessary, these could be subject to additional assessment before a proposal is developed and, ultimately, considered by the European Parliament and Council. No changes to the Directive have been agreed through the evaluation process itself.
The scope of whistleblower protection is already expanding
The scope of EU whistleblower protection is growing before the European Commission finishes its review. Instead of waiting for amendments to the Directive, newer EU laws are bringing their own violations within its protections.
The EU AI Act is one example: Article 87 applies the Whistleblower Protection Directive to reports of AI Act violations. People who report receive the same anti-retaliation protections as those who report financial misconduct.
The EU’s Anti-Corruption Directive (EU) 2026/1021, which took effect May 31, 2026, does the same for corruption. Its Article 25 applies the Whistleblower Protection Directive to reports of all corruption offenses it defines, including bribery in both the public and private sectors. Member States have 24 months to adopt most of its provisions into national law.
These additions build on the Directive’s original coverage, which includes public procurement, financial services, product safety, environmental protection, public health, consumer protection and data privacy. The Airective’s annex lists the legislation within that scope.
The Commission’s review could widen protection further. Article 27(3) of the Directive requires the Commission to assess whether additional measures are needed, including amendments that extend protection to more EU laws or areas. It specifically names the working environment, including worker health and safety and working conditions, as an area to consider.
Not all stakeholders want broader requirements, however. The European Tax Adviser Federation has proposed raising the threshold for mandatory internal reporting channels from 50 employees to at least 100, citing the administrative burden on midsize companies. Some entities, such as those in financial services, already must maintain reporting channels regardless of size. The commission has not adopted the federation’s proposal.
The Commission must weigh these competing priorities. Some stakeholders want broader protection and stronger enforcement, while others want simpler compliance obligations. The outcome could affect both what counts as protected reporting and what organizations must do.
For compliance leaders, the practical message is that they do not need to wait for the review to act. Organizations should check that their reporting channels accept every concern that now qualifies for protection, including reports about AI and corruption. They should also confirm that new categories of reports reach investigators with the right expertise, and that employee communications accurately explain which concerns are protected and how to raise them.
A wider scope also requires closer coordination among compliance, legal, human resources, information security and other functions responsible for different categories of risk. Organizations that adapt now will be better positioned as the legal framework continues to evolve, rather than having to react once new requirements take effect.
Why effective whistleblower protection matters
An important question for the Commission’s evaluation is whether the Directive is achieving its intended purpose: enabling individuals to report wrongdoing safely while ensuring their concerns receive appropriate attention.
The existence of legal protections is an important starting point, but their effectiveness ultimately depends on what happens when someone raises a concern. This includes how reports are received, whether appropriate follow-up occurs, how retaliation is addressed and whether individuals have access to meaningful remedies when protections fail.
Even where national laws establish reporting rights, whistleblowers may struggle to obtain independent advice, access effective remedies or challenge retaliatory actions. And inconsistent enforcement can create further uncertainty, particularly for individuals working across borders or within multinational organizations.
These shortcomings have consequences for employers as well as whistleblowers. Employees who believe reporting misconduct could expose them to retaliation are more reluctant to raise concerns internally. When people do not trust the reporting process, organizations risk losing valuable opportunities to identify and address problems before they escalate.
For organizations, effective protection depends on clear procedures, appropriately trained investigators and consistent processes for evaluating allegations. It also requires meaningful oversight of how reports are handled and whether appropriate corrective action follows.
Strengthening whistleblower protections across Europe requires attention to both the legal framework and the practical conditions that encourage people to speak up.
10 Best Practices for Effective Investigations
Discover 10 best practices for conducting consistent, fair and defensible investigations that build employee trust and strengthen your ethics and compliance program.
What rising whistleblowing reports mean for EU compliance
The broader trend toward increased internal reporting adds another dimension to the Directive’s evaluation.
Globally, median case closure time increased from 21 days in 2024 to 28 days in 2025 – a 33% increase year-over-year. And the regional picture is even more nuanced: regional benchmark data shows that organizations headquartered in Europe reduced their median case closure time by 18 days in 2025 – however, their median of 51 days remains substantially longer than the global median.
Longer investigation timelines can have consequences for both organizations and the people raising concerns. While investigations require sufficient time to establish the facts, prolonged delays can create uncertainty for reporters and other individuals involved. They may also slow corrective action and weaken confidence in the reporting process if concerns are not addressed appropriately.
Although the benchmark data does not establish why case closure times increased, the trend invites consideration if there are sufficient investigative resources, clear processes and appropriate oversight at your organization given the increase in reporting activity.
At the same time, digital reporting is more prominent, and web-based reporting continues to grow in importance. In Europe, 63% of reports are submitted via the web in 2025 (frequency by report origination region); as a contrast, globally the average of web-based reports was 33.8% in 2025. What’s more, the percentage of web intake reporting in Europe has grown tremendously in just a few short years – moving from 45% web reporting in 2022.
This data is particularly relevant for European organizations, where companies often operate across multiple jurisdictions with different national requirements. Even when an organization uses a common reporting platform, the rules governing protected disclosures, investigation responsibilities and reporter safeguards may differ depending on the country mix.
Future changes to the Directive could introduce additional considerations for companies managing cross-border whistleblowing programs. For compliance leaders, this underscores the importance of maintaining reporting and investigation processes that can adapt to changing requirements while continuing to provide a consistent experience for people who raise concerns.
Report intake method frequency by report origination region – Europe vs. Global
Web-based reporting accounts for a greater share of reports originating in Europe than globally.
- 63%
Web intake in Europe
- 33.8%
Web intake globally
What should compliance leaders watch in the EU Directive review?
The Directive’s evaluation itself does not introduce new obligations, and it remains uncertain whether the Commission will recommend legislative amendments. However, the review raises questions compliance leaders are well placed to consider, drawing on their experience managing reporting channels and responding to concerns.
Are existing protections working as intended?
The effectiveness of whistleblower protection depends on whether individuals feel able to safely report misconduct and whether organizations can respond appropriately. Compliance leaders can assess whether existing reporting processes provide sufficient confidentiality, meaningful protection against retaliation and appropriate follow-up.
Would changes to the Directive improve reporting and investigations?
Expanding the scope of protected reporting could provide additional safeguards, but it may also introduce new operational considerations and potential challenges. Similarly, proposals to simplify certain obligations raise questions about how to balance administrative requirements with access to effective reporting channels.
What can reporting data tell us about the effectiveness of current arrangements?
Reporting volumes, investigation timelines, case outcomes and retaliation allegations provide useful information about how whistleblowing programs function in practice. Although these measures do not establish whether a legal framework is effective on their own, they can be used to help identify potential weaknesses and inform discussions about future improvements.
These questions are relevant regardless of whether the evaluation ultimately leads to legislative amendments. They also reinforce the importance of drawing on practical experience when considering how Europe’s whistleblower protection framework should evolve.
An opportunity to strengthen Europe’s speak-up framework
The EU Whistleblower Protection Directive established an important foundation for protecting individuals who report wrongdoing. Its evaluation offers an opportunity to examine where that foundation is working, where implementation remains inconsistent and how the framework might need to evolve.
Transparency International’s findings make clear that significant gaps remain, particularly in protecting whistleblowers from retaliation and ensuring that legal rights are supported by effective enforcement.
At the same time, NAVEX data shows that people are increasingly using internal reporting channels to raise concerns. Organizations have more opportunities to identify potential misconduct, but they also face growing responsibility for managing reports effectively and maintaining reporter confidence.
For compliance leaders, the evaluation is an opportunity to consider what is working within Europe’s whistleblower protection framework, where improvements are needed and how future requirements could affect reporting programs. Whether the Commission prioritizes stronger enforcement, broader protections or changes to existing obligations, the decisions that follow could shape whistleblowing programs across Europe for years to come.
Whatever the outcome, the objective remains clear: people should be able to raise concerns safely, organizations should be equipped to respond appropriately and whistleblower protections should work as effectively in practice as they are intended to work in law.
The Regulatory Spotlight: October 2026
Join NAVEX’s Regulatory Spotlight on 20 October for a 30-minute briefing on third-party harassment, FCA conduct rules and the Crime and Policing Act 2026.
