---
title: "Run a whistleblowing channel once you have · Agent Wranglers"
url: https://agentwranglers.se/playbook/compliance/breaches-and-reporting/whistleblowing-channel
updated: 2026-10-21
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Run a whistleblowing channel once you have 50 workers

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Breaches and reporting](https://agentwranglers.se/playbook/compliance/breaches-and-reporting.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers). Updated 2026-10-21.

- ID: CMP-69
- Level: Required
- Chapter: [Breaches and reporting](https://agentwranglers.se/playbook/compliance/breaches-and-reporting)
- Rule: From 50 workers in an EU country, run an internal channel to report breaches of EU law. Confirm each report within 7 days and give feedback within 3 months.
- Risk: A law broken
- Applies when: The project has users in the EU.
- How: Directive (EU) 2019/1937 sets the duty, and each country's law adds details. Financial services firms need a channel at any size. Accept reports in writing, by voice or both. Only the named handlers may see who reported. Name one impartial person or team to follow up and stay in touch with the reporter. Without a receipt, the 3 months run from the end of the 7 days. Keep a record of every report, and delete it after the period your national law sets. Also publish how to report to the authorities. Companies with 50 to 249 workers may share a channel within a group. Count workers in the [facts file](https://agentwranglers.se/playbook/compliance/scope-and-ownership/scope-from-facts). Compute the dates the way the [reporting clocks](https://agentwranglers.se/playbook/compliance/breaches-and-reporting/reporting-clocks) do.
- Check: With 50 or more workers in one EU country, the register check needs a `whistleblowing` entry with a channel and a handler. A unit test opens a report on 1 March 2027. The receipt is due 8 March 2027, and feedback is due 8 June 2027. A daily job fails on any report past either date.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JavaScript example

```js
const RECEIPT_DAYS = 7;
const FEEDBACK_MONTHS = 3;

const addDays = (date, days) => new Date(Date.UTC(date.getUTCFullYear(), date.getUTCMonth(), date.getUTCDate() + days));
const addMonths = (date, months) => new Date(Date.UTC(date.getUTCFullYear(), date.getUTCMonth() + months, date.getUTCDate()));

export function reportDeadlines(receivedAt, receiptSentAt = null) {
  const receiptDue = addDays(receivedAt, RECEIPT_DAYS);
  return { receiptDue, feedbackDue: addMonths(receiptSentAt ?? receiptDue, FEEDBACK_MONTHS) };
}
```

### Python example

```python
from datetime import date, timedelta
from dateutil.relativedelta import relativedelta

RECEIPT_DAYS = 7
FEEDBACK_MONTHS = 3

def report_deadlines(received: date, receipt_sent: date | None = None) -> dict[str, date]:
    receipt_due = received + timedelta(days=RECEIPT_DAYS)
    return {"receipt_due": receipt_due,
            "feedback_due": (receipt_sent or receipt_due) + relativedelta(months=FEEDBACK_MONTHS)}
```

## Sources

- [Whistleblower Directive (EU) 2019/1937, Articles 8, 9 and 18](https://eur-lex.europa.eu/eli/dir/2019/1937/oj)

## Related rules

- [Derive scope from recorded facts](https://agentwranglers.se/playbook/compliance/scope-and-ownership/scope-from-facts) in Compliance
- [Start every reporting clock from one moment](https://agentwranglers.se/playbook/compliance/breaches-and-reporting/reporting-clocks) in Compliance

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/compliance/breaches-and-reporting/whistleblowing-channel">Agent Wranglers compliance playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Tell your customers when you are their processor](https://agentwranglers.se/playbook/compliance/breaches-and-reporting/processor-breach-notice)
- [Breaches and reporting](https://agentwranglers.se/playbook/compliance/breaches-and-reporting)