The A.A.I. strengthens its ICT infrastructure: what changes for companies obligated by the Whistleblower Law

Key data

The body that monitors compliance with the Law 2/2023 on whistleblower protection has just gained technological muscle. As of May 6, 2026, the Ministry of Presidency, Justice and Relations with Parliament provides information and communications technology services to the Independent Authority for the Protection of Whistleblowers (A.A.I.), according to the Under-Secretariat Resolution published in the BOE on May 12, 2026.

For companies required to have an internal reporting channel, this move is not a minor administrative procedure: it consolidates the supervisor's operability and accelerates its capacity to act.

What does this regulation establish?

The resolution publishes the management assignment agreement between the Ministry of Presidency and the A.A.I. A management assignment is a figure in administrative law that allows one body to delegate material or technical tasks to another, without transferring the ownership of the competence. That is: the A.A.I. remains the independent supervisory body with all its competencies intact, but now has the technological support of the Ministry to operate.

The specific purpose of the agreement is the provision of information and communications technology (ICT) services by the Ministry in favor of the A.A.I. This includes, in general terms, the technological infrastructure necessary for the body to function: management systems, reporting reception platforms, information security and technical support.

The resolution is signed by the Under-Secretariat and published in the BOE as a requirement of transparency and administrative effectiveness, as required by administrative procedure regulations for this type of inter-administrative agreements.

Economic and operational impact

This agreement does not generate direct costs for private companies. However, it has a very relevant indirect operational impact: the A.A.I. now has more robust and stable technological infrastructure, which translates into greater capacity to:

• Receive and manage reports efficiently.
• Process disciplinary proceedings against non-compliant companies.
• Coordinate with other public bodies in investigations.
• Operate with continuity and without dependence on limited own resources.

For companies that have not yet implemented their internal reporting channel or that have it in a deficient manner, this represents a real increase in the risk of detection and sanctions. The A.A.I. is no longer a body in its early stages: it is a supervisor with consolidated infrastructure and ministerial backing.

The sanctions provided for by Law 2/2023 for non-compliance with the obligations to implement and manage internal channels can be significant. While the specific amounts of sanctions are not part of the data from this specific resolution, the operational strengthening of the supervisor makes it more urgent to review the state of compliance.

Who does it affect?

This agreement directly affects all subjects obligated by the Law 2/2023 on whistleblower protection, which includes:

• Private companies with 50 or more employees: obligated to implement and manage an internal reporting channel.
• Companies in regulated sectors (financial services, transport security, environmental protection, among others) regardless of their size.
• Political parties, unions and business organizations that receive public funding.
• Foundations and non-profit entities with public funding.
• Public sector entities: administrations, autonomous bodies, public companies.
• Compliance advisors and consultants who manage reporting channels for their clients.
• CFOs and HR directors responsible for internal regulatory compliance.

Practical example

A distribution company with 120 employees implemented its internal reporting channel in 2023 using a generic email mailbox, without a documented management protocol, without confidentiality guarantees and without a designated responsible person. At that time, the A.A.I. was still in its startup phase and with limited technological resources.

As of May 2026, with the ICT infrastructure of the Ministry of Presidency supporting the A.A.I., the body has greater capacity to receive reports from employees of that company, process the proceedings and require the company to prove that its channel is functioning correctly. If the company cannot demonstrate that its channel complies with the requirements of Law 2/2023, it is exposed to the initiation of a disciplinary procedure.

The practical conclusion: having a nominal or deficient reporting channel is no longer a low-risk area. The supervisor now has the means to act.

What should companies do now?

1. Verify if your company is obligated: If you have 50 or more employees or belong to a regulated sector, Law 2/2023 applies to you. Confirm your situation before any other action.
2. Audit the status of your internal reporting channel: Check that it meets legal requirements: confidentiality, acknowledgment of receipt deadline (7 days), response deadline (3 months), designated responsible person and protection of the whistleblower against retaliation.
3. Document the functioning of the channel: The A.A.I. may require evidence. Have the documentation ready that proves the implementation, procedures and cases managed.
4. Review internal procedures for managing reports: A technically implemented channel but without real operational procedure is as vulnerable as not having one.
5. Train internal responsible parties: The channel manager must know their obligations, deadlines and how to protect the whistleblower.