WeMoral Publishes Free Report Comparing Whistleblower Laws Across All 27 EU States

The WeMoral 2026 report compares the whistleblower laws of all 27 EU member states on 33 data points across 46 pages.

Maximum fine on an organization without a working whistleblowing channel, from 1,000,000 EUR in Spain to no fine at all in six member states.

Twelve member states named no supervisor at all, so no authority checks whether internal reporting channels exist. Seven created a dedicated body that can fine.

The 46-page comparison covers all 27 member states on 33 data points, including fines, retention periods, anonymous reporting and penalties for false reports.

ŁóDź, POLAND, August 11, 2026 /EINPresswire.com/ -- Maximum fines for failing to run a whistleblowing channel range from 1,000,000 EUR in Spain to nothing at all in six member states, according to a comparison of all 27 EU transpositions of Directive 2019/1937 published today by WeMoral, a whistleblowing software company. Download the WeMoral 2026 Report. It is free and requires no registration.

Directive 2019/1937 set a common floor for whistleblower protection and gave member states until 17 December 2021 to put it into national law. The study records what each country enacted above that floor and where the national rules differ from one another.

Findings recorded in the report include:

- Denmark and Sweden brought their laws into force on the 17 December 2021 deadline. The average member state did so 380 days after it.
- Poland's law took effect 1,013 days after the deadline, the longest interval in the EU.
- Greece sets the second-highest maximum fine at 500,000 EUR. Portugal and Ireland cap theirs at 250,000 EUR, and Luxembourg's 250,000 EUR doubles on a repeat offence within five years.
- Nineteen of the 27 member states created no criminal offense connected to whistleblowing. Eight provide for prison sentences.
- Twenty member states passed a new dedicated act. Six amended legislation that predated the directive, and Belgium used a package of eight separate instruments.
- Twelve member states named no compliance supervisor, so no authority checks whether internal reporting channels exist. Seven created a dedicated body with the power to issue fines.

"A reporting channel that satisfies one member state does not automatically satisfy the next one," said Marta Giemza, corporate ethics expert at WeMoral. "An employer with offices in five countries ends up running five compliance regimes, and most of the differences only show up once you read the national statute."

Fifteen member states fix a period for keeping report records and twelve set none. Spain allows up to ten years. Cyprus requires deletion three months after a case closes. Germany, Estonia, Poland and Slovakia all settle on three years, though each starts the clock at a different moment: case closure, feedback, the year-end of follow-up, and delivery.

Member states also split on anonymous reports. Twelve permit them without obliging an employer to accept them. Spain and Portugal require intake, as does Belgium for employers above 250 workers. Bulgaria, Latvia and Malta bar them or leave them unprotected. Denmark, Estonia and Sweden do not mention them in their acts at all, and France addresses them only in the financial sector.

Sanctions for a knowingly false report follow three different routes. Twelve member states impose an administrative fine, nine handle it through criminal law, and six impose no sanction beyond the loss of protection. The highest exposure is in Spain, where the ceiling reaches 300,000 EUR.

Feedback deadlines are more consistent. Twenty-two member states kept the directive's three-month limit for feedback on an internal report. Lithuania allows 10 working days with no way to extend it.

"Every figure in the report points at the article it came from," Giemza said. "A compliance team can check us against the statute instead of taking our word for it."

WeMoral compiled the comparison from the primary legislation of each member state. The report runs to 46 pages and holds 33 data points for each member state, presented in 7 charts and 18 tables. Editions are published in English, Polish, Spanish, French and German, and a video walkthrough of the findings accompanies the English edition. The report is a comparative analysis of published legislation and is not legal advice.

About WeMoral

WeMoral is whistleblowing software with anonymous reporting, encryption at rest and in transit, and data that never leaves the EU. It helps organizations receive, investigate and resolve reports of misconduct through one secure channel, in line with the EU Whistleblower Directive and GDPR.

Marta Giemza
WeMoral sp. z o.o.
+48 574 139 632
press@wemoral.com
Visit us on social media:
LinkedIn
Bluesky
YouTube
X

WeMoral 2026 Report on Whistleblower Directive Transposition Across the EU