The concept of whistleblowing is harmonized at the EU level – but not entirely uniform in practice.

The foundation is in EU Directive (EU) 2019/1937, but member states have had the opportunity to go beyond the minimum requirements.

For companies operating in multiple countries, it is crucial to understand the difference between:

• EU minimum level

• National extensions

• The practical risk profile

Here is the structure.

Level 1 – EU's common minimum level

The directive protects the reporting of information concerning:

• Breaches of Union law

• In specially designated areas

• When reporting occurs in a work-related context

The areas covered include, among others:

• Public procurement

• Financial Services and Market Abuse

• Money laundering and terrorist financing

• Product safety

• Transport and nuclear safety

• Environmental protection

• Public health

• Consumer protection

• Data Protection

• Protection of the Union's financial interests

• Competition and State Aid Rules

The protection also applies to:

• Try to hide violations

• Actions that counteract the purpose of EU rules

It is not required that the violation be proven.

It is enough that the person had reasonable grounds to believe that the information was correct.

This is the common EU core.

Level 2 – National Variations

The directive is a minimum directive. Member States have been given the possibility to extend the protection.

Differences arise here.

Sweden

Sweden has introduced broader protection than the directive by also including:

Maladministration that is in the public interest to disclose.

This means that even serious national misconduct can be covered, even if it does not concern EU law.

🇫🇷 France

Even before the directive, France had a system (Sapin II) with broader protections. In practice, the implementation means that the protections cover more types of serious irregularities than only those that directly concern EU law.

Italy

Italy links whistleblower protection to its established compliance model (including the 231 regulations). This means that reporting certain national offenses and company-related irregularities may be covered even outside the directive's narrow EU scope.

Germany

Germany has essentially followed the directive's structure but has also opened up for national non-compliance to be covered within the framework of domestic law.

Summary of Level 2

In practice, there are three models in Europe:

1. Strict EU model – Protection only for EU territories.

2. Expanded national model – Protection even for serious national misconduct.

3. Hybrid Model EU Core + Certain National Crimes.

This means that the definition of ”whistleblowing” is not entirely identical in all member states.

Level 3 – What does this mean for your company?

For companies operating in multiple countries, an important question arises:

Should you build your whistleblower function according to the minimum level or the broadest model?

The practical reality is that:

• Your whistleblowing function, like your policy, must comply with the minimum protection in national legislation.

• However, employees do not conduct any legal EU analysis before they report.

• Suppliers don't care about the directive's technical scope.

• Stakeholders expect serious misconduct to be reported.

Conclusion

At the EU level, whistleblowing is linked to infringements in specifically defined areas of law.

But in several Member States, protection has been extended to cover broader categories of serious misconduct.

For international companies, it is therefore wise to:

• Understand the common EU core

• Identify national variations

• Build a function that can withstand the broadest application

It creates legal robustness – and trust.