Activation of the official AIPD form: two-month deadline to notify the head of the complaints channel

On 1 September 2025, the Independent Authority for Whistleblower Protection (AINPI) officially began its activities. Since then, there has been a legal obligation to notify this authority who is responsible for the Internal Information System in each organisation subject to the regulation.

However, on 8 October 2025, the AINPI issued an informative note clarifying that the two-month deadline for making this notification would not start until the official form was available on the electronic platform.

This moment has arrived and today, Monday 9 February 2026, the form is now operational and accessible via https://sede.proteccioninformante.gob.es, which means that the two-month notification deadline starts now.

Who is obliged to communicate this appointment?

First of all, all public sector entities without exception. In the private sector, the obligation falls on companies with fifty or more employees. Additionally, certain sectors considered strategic or regulated (such as finance, money laundering prevention, transportation, the environment, health, or data protection) must comply with this obligation regardless of the number of employees they have.

An important point to keep in mind is that those entities that previously communicated via email must now also do so using the official form, as the initial notification by email does not have full legal effect and must therefore be formalised through the available official channel.

The person responsible for the Internal Information System plays a central role in the entire whistleblower channel mechanism. Their main functions include receiving and properly recording communications, acknowledging receipt within a maximum of seven days, keeping the whistleblower informed about the status of their report within a maximum of three months, ensuring absolute confidentiality of the whistleblower's identity at all times, and of course, ensuring that there are no reprisals against the person who made the report.

Regarding deadlines, as we have indicated, there is an extraordinary two-month deadline from the activation of the form, which starts on 9 February 2026. This extraordinary deadline applies to all entities that had already appointed their responsible person before the form was available. Once this period has elapsed, the ordinary regime will come into force, which requires that any new appointment or cessation be communicated within ten working days from when it occurs.

The consequences of non-compliance are significant. Failing to notify the appointment or cessation of the responsible person constitutes a serious infringement, penalised for legal entities with fines ranging from £10,001 to £600,000. Even more serious is not having an Internal Information System when it is mandatory: in this case, we are facing a very serious infringement, with penalties that can reach one million euros.

But that’s not all. In addition to these economic sanctions, there may be additional penalties with considerable impact, such as public reprimands of the entity, prohibitions on obtaining public subsidies for up to four years, the inability to contract with the public sector for three years, and even the publication of the penalty in the Official State Bulletin.

Beyond the administrative realm, we cannot forget other indirect but equally serious consequences, such as obvious damage to reputation, potential civil liability arising from possible reprisals against whistleblowers, difficulties in demonstrating the exemption of criminal liability of the legal entity under Article 31 bis of the Penal Code, or the loss of compliance certifications.

It is for this reason that, if your organisation has not yet done so, you must first verify that the appointment of the responsible person has been properly formalised through a resolution of the competent body of the organisation.

Next, you must access the electronic headquarters (either with a digital certificate, an electronic identifier, or the Cl@ve system) and fill out the official form. Once done, it is essential to keep the electronic proof that shows that the form has been submitted. At the same time, it is advisable to inform all staff about the existence of the channel and the identity of the person responsible for its management.

Finally, it is highly recommended to take this opportunity to ensure that the system meets all additional requirements of the applicable regulations: web accessibility, confidentiality, the possibility of anonymous reports, compliance with the established deadlines, training of involved personnel, and the existence of a documented procedure.

In summary, the affected entities have two months to act and it is not advisable to delay this process. The appointment and communication of the responsible person for the whistleblower channel is not a mere bureaucratic formality, but a key part of the system to protect whistleblowers and prevent illegal conduct within organisations.

For this reason, at ECIJA we insist on the convenience of making this communication as soon as possible, thus avoiding both economic penalties and other negative consequences that could arise from non-compliance.

Informative note drafted by the Compliance Department of ECIJA Madrid.