Implementation of the Independent Authority for Whistleblower Protection

On 1 September 2025, the Independent Authority for Whistleblower Protection (“AIPI”) became operational, serving as the key body in the fight against corruption and protecting individuals who report irregular conduct in the business and public sectors. Its creation was established in Law 2/2023, dated 20 February, regulating the protection of individuals who report regulatory violations and combatting corruption, through which Directive (EU) 2019/1937 or the Whistleblowing Directive was implemented into our legislation. By Royal Decree 1101/2024, dated 24 October, the Council of Ministers approved the Statute of the AIPI. However, the sole transitional provision of this Statute left the determination of the date of its commencement in the hands of the head of the Ministry of the Presidency, Justice and Relations with the Cortes. It was on 12 August 2025 when the aforementioned order was published in the Official State Gazette, determining that the AIPI would commence operations on 1 September 2025. 

What does this imply for companies?

1. Obligation to communicate system managers. The commencement of the AIPI has a direct impact on companies regarding compliance matters. All companies required by Law 2/2023 to have internal reporting systems - those with 50 or more employees or operating in strategic sectors - must notify the AIPI of the appointment of the managers of these systems.

• Deadlines. Before 1 November 2025, companies must inform the AIPI about the appointment or termination of their internal system managers. From that date onwards, any changes must be reported within 10 working days.
• Method.The AIPI has established a series of requirements to fulfill the communication obligation of the system manager: either a specific form will be provided once the final website is approved (15-20 days), or a series of documents must accompany this form, namely: 
  • the minutes of the appointment of the system manager 
  • the minutes of the appointment of the administrators listed in the minutes of the appointment of the system manager, in order to verify that they are indeed competent to appoint them, in accordance with Article 8.1 of Law 2/2023.
    • this communication must be made, even if a report has already been made to an autonomous authority. 
    • in the case of corporate groups with a single manager, only one communication will be necessary. 

2. Penalties for non-compliance.

Non-compliance with this obligation may result in financial penalties of up to €100,000. 

3. Strengthening whistleblower guarantees. 

The AIPI will begin to exercise its key functions assigned with autonomy and independence, which include: 

• Management of the external reporting channel with full confidentiality guarantees and whistleblower protection. 
• Adoption of protection and support measures for whistleblowers, including advice, support, and protection against potential reprisals.
• Instruction of sanctioning procedures when appropriate, with the capacity to impose fines and other measures.
• Advising and promoting a culture of integrity, fostering good practices in public and private organizations.
• Preparation of circulars and recommendations establishing the criteria and practices necessary for the proper functioning of the AIPI, as well as models for crime prevention in the public sector.