The short answer
For an internal report covered by the EU Whistleblowing Directive, the Article 9 baseline is:
- acknowledge receipt to the reporting person within seven days of receiving the report; and
- provide feedback within a reasonable time, no later than three months after the acknowledgement.
If no acknowledgement was sent, the three-month period runs from the end of the seven-day acknowledgement period instead.
That sounds like a two-reminder problem. It is not. A defensible process also needs to preserve when the report arrived, whether the reporting person could be contacted, who handled it, what follow-up occurred, what feedback was given, and which national law applied.
This briefing covers an organisation’s internal reporting procedure. External reports to public authorities follow a related but different procedure under Articles 11–13.
What the seven-day rule requires
Article 9(1)(b) requires acknowledgement of receipt within seven days. An acknowledgement is not the investigation result. Its immediate purpose is to tell the reporting person that the report reached the internal channel.
A useful acknowledgement record should identify:
- the stable reference assigned to the report;
- the receipt date;
- the acknowledgement date;
- the secure method used to send it; and
- whether it was sent within seven days.
Do not use the date on which a manager first opened an email if the report entered the designated channel earlier. The receipt event is the starting point.
The Directive’s internal-report wording does not itself list a general exception to the acknowledgement requirement. National implementing laws can contain more detailed rules, including how uncontactable or anonymous reporters are handled. If no acknowledgement was possible or sent, preserve the reason instead of silently leaving the record blank.
When the three-month period starts
Article 9(1)(f) gives the process two possible starting points:
- Acknowledgement sent: no more than three months from the acknowledgement.
- No acknowledgement sent: no more than three months from the expiry of the seven-day period after the report was made.
For example, suppose an internal report arrives on 4 August and is acknowledged on 8 August. The feedback period runs from the 8 August acknowledgement. If no acknowledgement is sent, the alternative calculation starts after the seven-day acknowledgement period expires.
The exact calendar calculation should follow the applicable national transposition and local rules for computing periods. Record the resulting deadline rather than expecting a case handler to reconstruct it months later.
The three-month point is a feedback deadline, not necessarily a deadline to finish every investigation. Recital 58 says that when the appropriate follow-up is still being determined, the reporting person should be told that and informed about any further feedback to expect.
What counts as feedback
Article 5(13) defines feedback by its substance: information for the reporting person about the action envisaged or taken as follow-up, together with the grounds for that follow-up.
Depending on the case, that can include:
- an internal enquiry has started;
- more information has been requested;
- the report was referred to another procedure or authority;
- the matter was closed because there was insufficient evidence;
- remedial measures were taken; or
- the investigation remains open and a further update is expected.
“We are looking into it” may be too thin if it says nothing about the action or its basis. At the other extreme, the response should not expose information that would prejudice an investigation or the rights of people mentioned in the report. The Directive’s recitals expressly recognise that limit.
A workflow should therefore ask for both the follow-up action and the grounds, while allowing an ongoing investigation to be described without forcing premature findings.
What the process needs besides deadlines
The timers sit inside a wider procedure. Article 9 also requires:
- secure reporting channels that protect the confidentiality of the reporting person and third parties mentioned;
- protection against access by unauthorised staff;
- an impartial person or department responsible for follow-up;
- diligent follow-up;
- follow-up on anonymous reports where national law provides for it;
- clear, accessible information about external reporting procedures; and
- written or oral reporting, including a physical meeting on request within a reasonable time.
Those requirements explain why an ordinary shared inbox plus two calendar reminders is a weak implementation. The process needs controlled access, clear ownership, and a record of what happened after intake.
Article 18 adds a retention boundary. Reports must be recorded in line with the confidentiality requirements and kept no longer than necessary and proportionate under the Directive or other applicable EU or national law. “Keep everything forever” is not a safe default for whistleblowing data.
It also sets specific documentation safeguards for oral reports. A recording requires the reporting person’s consent. Where a transcript or minutes are used, the reporting person must be offered an opportunity to check, correct, and agree the record. Article 17 separately says manifestly irrelevant personal data should not be collected and, if collected accidentally, must be deleted without undue delay.
What to record
A practical internal-report record can be divided into six parts.
Applicable law
- Member State;
- national implementing law and provision;
- procedure or policy version used; and
- any national rule affecting anonymous reports, acknowledgement, feedback, or retention.
Receipt
- non-identifying case reference;
- date and channel of receipt;
- documentation method and consent or review evidence for an oral report;
- whether a secure return channel is available; and
- whether confidentiality and access controls were confirmed.
Acknowledgement
- whether it was sent;
- date and secure delivery method;
- whether it was within seven days; and
- if it was not sent, the documented reason.
Ownership and follow-up
- assigned impartial person or department;
- conflict-of-interest check;
- follow-up status;
- action taken or envisaged; and
- requests for further information.
Feedback
- deadline and the basis used to calculate it;
- date sent;
- action communicated;
- grounds communicated;
- whether the deadline was met; and
- next update plan if the investigation remains open.
External reporting information
- whether the organisation makes the relevant external channels easy to find; and
- where that information is available.
Avoid putting the reporting person’s identity or the underlying allegation into a general-purpose deadline tracker unless the system is designed and authorised to handle that sensitive material. A case reference is usually enough to connect the procedural record to a separately protected case file.
Can this be automated?
Some parts can be made consistent without pretending that software conducts the investigation.
A reusable compliance Flow can:
- require the receipt event and applicable national law;
- reveal acknowledgement details only when an acknowledgement was sent;
- flag a missed seven-day deadline;
- switch the feedback calculation basis when no acknowledgement was sent;
- require an assigned impartial handler;
- require the action and grounds included in feedback;
- flag feedback that is overdue or late; and
- produce a versioned record of the answers and resulting notices.
The system should not decide whether an allegation is true, what investigative step is proportionate, or what information can safely be disclosed to the reporting person. Those remain human decisions. The purpose of the executable layer is to make the procedure repeatable and the record inspectable.
This is the kind of obligation that fits a compliance schema: a clear trigger, two linked deadlines, conditional evidence, and a final record that can be reviewed later.
National law still controls
The Directive establishes EU minimum standards, but Member States implement them through national law. Scope, anonymous reporting, sanctions, retention, deadline calculation, and permitted feedback detail can differ.
Article 8 uses 50 workers as the ordinary private-sector threshold, but that is not a universal scope test. The threshold does not apply to entities covered by certain sector-specific EU acts, Member States may bring smaller entities into scope, and public-sector coverage follows separate rules. Private entities with 50 to 249 workers also had a later 17 December 2023 transposition deadline for the internal-channel obligation. The national law and the organisation’s actual facts must therefore be checked before the procedural deadlines are applied.
Before using an EU-level template:
- identify the Member State and controlling national provision;
- compare the template with the national implementation;
- add stricter or more specific requirements;
- set a retention rule for the case material; and
- have the resulting interpretation reviewed for the organisation’s actual context.
The European Commission’s implementation assessment found shortcomings in Member State transposition, including around acknowledgement, feedback, and follow-up. That is another reason not to treat a generic “EU compliant” badge as a substitute for checking the law that applies.
The useful outcome is narrower and more honest: one source-linked baseline that a qualified publisher can adapt into a maintained national version, and one operational record for every report handled through it.
You can try ProseID with a live compliance Flow to see how conditional questions, deadline notices, and a versioned completion record behave before adding this whistleblowing schema to your own workspace.