---
title: "Run a whistleblowing channel once you have · Agent Wranglers"
url: https://agentwranglers.se/playbook/compliance/scope-and-ownership/whistleblowing-channel
id: CMP-69
level: Required
applies: eu-users
region: EU
risk: law
updated: 2026-10-27
build: a2a6bdfed830
tokens: 1220
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Run a whistleblowing channel once you have 50 workers

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Scope and ownership](https://agentwranglers.se/playbook/compliance/scope-and-ownership.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: CMP-69
- Level: Required
- Chapter: [Scope and ownership](https://agentwranglers.se/playbook/compliance/scope-and-ownership.md)
- Rule: From 50 workers in an EU country, run an internal channel to report breaches of EU law. Confirm each report within 7 days and give feedback within 3 months.
- Check: With 50 or more workers in one EU country, the register check needs a `whistleblowing` entry with a channel and a handler. A unit test opens a report on 1 March 2027. The receipt is due 8 March 2027, and feedback is due 8 June 2027. A daily job fails on any report past either date.
- Risk: A law broken
- Applies when: The project has users in the EU.
- Region: European Union (EU). The duty comes from the law there. The rule applies only when the project serves people there, and its Applies when also holds.
- How: Directive (EU) 2019/1937 sets the duty, and each country's law adds details. Financial services firms need a channel at any size. Accept reports in writing, by voice or both. Only the named handlers may see who reported. Name one impartial person or team to follow up and stay in touch with the reporter. Without a receipt, the 3 months run from the end of the 7 days. Keep a record of every report, and delete it after the period your national law sets. Also publish how to report to the authorities. Companies with 50 to 249 workers may share resources to receive and investigate reports. In Sweden the law is lag (2021:890), and chapter 5 section 2 counts the workers at the start of each calendar year. Count workers in the [facts file](https://agentwranglers.se/playbook/compliance/scope-and-ownership/scope-from-facts.md). Compute the dates the way the [reporting clocks](https://agentwranglers.se/playbook/compliance/breaches-and-reporting/reporting-clocks.md) do.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JavaScript example

```js
const RECEIPT_DAYS = 7;
const FEEDBACK_MONTHS = 3;

const addDays = (date, days) => new Date(Date.UTC(date.getUTCFullYear(), date.getUTCMonth(), date.getUTCDate() + days));
const addMonths = (date, months) => new Date(Date.UTC(date.getUTCFullYear(), date.getUTCMonth() + months, date.getUTCDate()));

export function reportDeadlines(receivedAt, receiptSentAt = null) {
  const receiptDue = addDays(receivedAt, RECEIPT_DAYS);
  return { receiptDue, feedbackDue: addMonths(receiptSentAt ?? receiptDue, FEEDBACK_MONTHS) };
}
```

### Python example

```python
from datetime import date, timedelta
from dateutil.relativedelta import relativedelta

RECEIPT_DAYS = 7
FEEDBACK_MONTHS = 3

def report_deadlines(received: date, receipt_sent: date | None = None) -> dict[str, date]:
    receipt_due = received + timedelta(days=RECEIPT_DAYS)
    return {"receipt_due": receipt_due,
            "feedback_due": (receipt_sent or receipt_due) + relativedelta(months=FEEDBACK_MONTHS)}
```

## Sources

- [Whistleblower Directive (EU) 2019/1937, Articles 8, 9 and 18](https://eur-lex.europa.eu/eli/dir/2019/1937/oj)
- [Lag (2021:890) om skydd för personer som rapporterar om missförhållanden](https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/lag-2021890-om-skydd-for-personer-som_sfs-2021-890/)

## Related rules

- CMP-2 [Derive scope from recorded facts](https://agentwranglers.se/playbook/compliance/scope-and-ownership/scope-from-facts.md) in Compliance and governance
- CMP-21 [Start every reporting clock from one moment](https://agentwranglers.se/playbook/compliance/breaches-and-reporting/reporting-clocks.md) in Compliance and governance

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/compliance/scope-and-ownership/whistleblowing-channel">Agent Wranglers compliance and governance playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Screen customers and payouts against sanctions lists](https://agentwranglers.se/playbook/compliance/scope-and-ownership/sanctions-screening.md)
- Next: [Decide whether UK data protection law covers you](https://agentwranglers.se/playbook/compliance/scope-and-ownership/uk-data-protection.md)
- [Scope and ownership](https://agentwranglers.se/playbook/compliance/scope-and-ownership.md)