Mandatory whistleblowing channel: what companies with more than 50 employees must do in 2026

Key data

If your company has more than 50 employees, Orden PJC/299/2026 affects you indirectly but significantly. The body that supervises your regulatory compliance, the Autoridad Independiente de Protección del Informante (AIPI), has just received its third extension of administrative services from the Ministry of the Presidency, Justice and Relations with the Cortes. The signal is clear: the AIPI still does not function in a fully autonomous manner.

This does not mean you can relax. Ley 2/2023 remains in force and the obligation to have an operational internal reporting channel has not changed. What changes is the context of the supervisory body: slower in resolutions, but active in its oversight functions.

What does this regulation establish?

Orden PJC/299/2026 extends for the third time the administrative and support services that the Ministry of the Presidency, Justice and Relations with the Cortes provides to the AIPI. In practical terms, this means the AIPI continues to depend on the Ministry's human, technological and administrative resources to function.

The AIPI was created by Ley 2/2023 with the mandate to supervise compliance with regulations on internal reporting channels. Its function is twofold:

• Receiving and processing reports from persons who report regulatory infringements (the so-called whistleblowers).
• Supervising that obligated companies and entities have their internal channels operational in accordance with the law.

The fact that a third extension has been required indicates that the AIPI has not yet completed its institutional consolidation process. It does not yet have full operational and administrative autonomy.

Economic and operational impact

This extension does not generate direct costs for companies. However, it has operational consequences worth bearing in mind:

• Delays in the resolution of proceedings: If your company is involved in proceedings before the AIPI, whether as a reported party or as an entity that has received an internal report, resolution timelines may be affected by the organisational situation of the body.
• Accumulated non-compliance risk: The progressive consolidation of the AIPI means that, once it reaches full operability, its inspection and sanctioning capacity will increase. Companies that have not yet implemented their reporting channel are accumulating risk.
• Cost of implementing the channel: Although the regulation does not set specific amounts, companies that do not yet have a channel must bear the cost of implementing one. This cost varies depending on the provider and the size of the company, but it is a regulatory compliance expense that cannot be deferred indefinitely.

Who is affected?

• Private companies with more than 50 employees: Required to have an internal reporting channel in accordance with Ley 2/2023.
• Public sector entities: All public administrations and bodies, regardless of their size.
• Companies in any sector that exceed the threshold of 50 employees, without sectoral exception.
• Legal and compliance advisors who manage their clients' reporting channels and need to be aware of the AIPI's operational status.
• CFOs and HR directors responsible for ensuring compliance with Ley 2/2023 in their organisations.

Practical example

A distribution company with 80 employees implemented its internal reporting channel in 2024 in accordance with Ley 2/2023. In January 2026, an employee submits a report through the channel regarding an alleged accounting irregularity.

The company processes the report internally according to the established procedure. However, the employee also decides to report it to the AIPI. Given that the AIPI is still in its consolidation phase — as confirmed by this third extension — the resolution of the proceedings by the supervisory body may take longer than initially anticipated.

For the company, this means that the period of uncertainty regarding the proceedings is extended. The recommendation is to thoroughly document every step of the internal report management process, precisely to demonstrate compliance to the AIPI when it reaches a resolution, regardless of how long that takes.

What should companies do now?

1. Verify that the reporting channel is operational: Check that your internal channel meets the requirements of Ley 2/2023: confidentiality, accessibility, acknowledgement of receipt deadline (7 days) and response deadline (3 months).
2. Review the internal report management policy: Ensure that a documented procedure exists for processing received reports and that the responsible personnel are aware of their functions.
3. Document all reports and their management: In the face of potential future inspections by the AIPI, documentation of the process is your primary defence tool.
4. Do not assume that the AIPI's slow consolidation reduces risk: The supervisory authority is still being built, but its sanctioning powers are active. Once it reaches full operability, its capacity for action will increase.
5. If you have not yet implemented a channel, act immediately: Non-compliance with Ley 2/2023 is an active infringement. The AIPI's consolidation phase does not suspend legal obligations.

Official source

Disclaimer: This article is for informational purposes only and does not constitute legal advice. For specific decisions, please consult a qualified professional. Source: https://www.boe.es/diario_boe/txt.php?id=BOE-A-2026-7324