With the passage of Directive (EU) 2019/1937 (“Whistleblowing Directive”) and transposition into national laws by Member States (“MS”) around the EU (“EU Whistleblower Directive”), the EU has made comprehensive harmonization of minimum whistleblower protections a reality.

Looking ahead towards 2025 and beyond, there are several upcoming legislative expansions, evaluations, and transpositions which will impact not only the material scope of the Directive, but also evolving best practices for whistleblower protections generally.

 

2025 EU Whistleblower Directive Evaluation and Possible Scope Expansion

By December 17th, 2025, the Commission must provide the European Parliament and the Council with a report evaluating:

• the effectiveness of the laws enacted by Member States to transpose the Directive; and
• the effectiveness of the whistleblower protection framework in the EU.

Specifically, under Article 27(3) of the Whistleblowing Directive:

[The Commission] shall submit a report to the European Parliament and to the Council by 17 December 2025 on the implementation and application of this Directive. That report shall in particular:

(a) assess the effectiveness of the measures taken by each Member State to transpose this Directive and their impact on the functioning of the whistleblower protection framework established in accordance with this Directive; and

(b) evaluate whether further measures, including expanding the scope of this Directive to cover other Union acts or policy areas, are required.

Potential expansion areas mentioned by the Commission include:

• occupational safety and health; and
• working conditions.

Business federations have noted they will likely push for changes to the scope of protection during this first review. One suggested change would be to increase the minimum employee count for internal reporting channels from 50 to 100 employees or more.

Such a change would aim to reduce the administrative burden on SMEs.

 

2026 – Expansion of EU Whistleblower Protections To Cover the EU AI Act

Effective August 2nd, 2026, the Whistleblowing Directive will apply to reporting violations of the EU AI Act.

 

What does this mean?

If you work for a provider of general-purpose AI (“GPAI”), you are protected if you report that the GPAI provider’s product – which you have been told is “systemically risky AI” under Article 2(11) of the AI Act – does not have proper cybersecurity measures in place, in violation of Article 55 of the AI Act.

Not all risks created by AI are currently captured by the examples above, but this change will materially broaden the scope of whistleblower protections as they apply to many types of AI risk.

 

2026 and Thereafter – Expansion of Scope Via CSDDD

The Whistleblowing Directive’s scope will also be expanded by the Corporate Sustainability Due Diligence Directive (CSDDD), which entered into force on July 25th, 2024.

This Directive amends the Whistleblowing Directive so that protections are also afforded to those reporting breaches of national legislation which implements EU sustainability due diligence requirements.

In other words, whistleblowers reporting violations of national law related to:

• labor rights
• human rights due diligence
• environmental damage

will be able to avail themselves of the EU Whistleblower Directive’s protections once the CSDDD is transposed into national law by Member States.

Taken together, employees may be protected when reporting activities which harm:

• the environment; or
• recognized labor standards, such as those set forth in International Labour Organization (“ILO”) agreements.

 

EU Focuses on Improvements to Whistleblower Directive Implementation

In addition to evaluating possible expansions to the scope of the EU Whistleblower Directive, the EU will increasingly scrutinize existing implementations by Member States.

In July 2024, the Commission released a report on the implementation and transposition of the Directive. The report found several gaps, including:

Issue 1: Scope of Protection

Failure to adequately protect disclosures submitted on reasonable suspicion or attempts to cover-up breaches.

Issue 2: Sanctions

Nine MS did not clearly provide that sanctions apply to retaliation against whistleblowers, obstruction of reporting channels, or failure to maintain confidentiality of whistleblower identity.

Issue 3: Derogations from liability

Some MS did not adequately transpose the Directive’s requirements that clarify when reporting persons cannot be held liable for the disclosure of information if the disclosure was made to reveal a breach.

The Commission stated these areas were the “main shortcomings” in implementing the Directive.

Shortly after, in early 2025, the Commission made good on threats to increase enforcement efforts by fining MS a collective €38 million for missing the July 17th, 2024 deadline to transpose the Directive.

We expect this trend to continue as the Commission expands its scrutiny beyond missed transposition deadlines to the quality of Member States implementations.

 

Shift Towards Prevention in Whistleblower Protection Standards

Beyond expansions to the material scope of the EU Whistleblower Directive, the standard for whistleblower protections in Europe is evolving.

Traditionally, whistleblowers were protected ex-post through lawsuits seeking monetary damages against employers.

The whistleblower would often have to endure retaliation before obtaining legal protection.

There is a growing consensus among policy makers and commentators that whistleblower protections should be established prior to or quickly after the disclosure is made.

One proposal would be to establish temporary relief for whistleblowers.

For example, temporary relief could take the form of:

• suspending a dismissal;
• staying disciplinary proceedings;
• otherwise preventing retaliation during the pending judicial process.

Granting interim relief would prevent the “temporal mismatch” between swift employer retaliation and protracted judicial processes.

Essentially, best practices are evolving to emphasize that blowing the whistle should not ruin someone’s career before they can be afforded legal protection.

 

Conclusion

The 2025 review of the Directive and set expansions in 2026 related to the AI Act and CSDDD suggest we are entering a new chapter for whistleblower regulations in Europe.

Expect significant developments to European whistleblowing compliance compared to the standards which were in place when many internal reporting frameworks were initially adopted.

We predict that future developments will continue to pressure organizations to foster cultures of integrity and compliance supported by preventive protections and stronger enforcement across Europe.

 

Written by Chara Nikolaou, MD Brainnovation