Practical guide
How to draft the whistleblowing procedure with AI
3 min read · Updated September 2026 · Editorial oversight: Avv. Federico Papa
The whistleblowing procedure consists of internal rules that public and private entities must adopt to manage reports of wrongdoing, ensuring whistleblower protection pursuant to D.Lgs. 24/2023. This document functions to prevent and combat corruption and criminal offenses within organizations by providing a safe and protected channel. It is mandatory for all companies that have employed an average of at least 50 workers in the last year, those operating in sensitive sectors such as financial services, or those that have adopted a 231 Model regardless of the number of employees.
In brief
D.Lgs. 24/2023 mandates whistleblowing procedures for entities with over 50 employees, regulated sectors, or a 231 Model. Agency workers under D.Lgs. 81/2015 are excluded from workforce thresholds. Internal channels must ensure confidentiality through encryption, providing written and oral options. Management is entrusted to autonomous internal offices or specialized external parties. Terms include acknowledgment within seven days and follow-up within three months. ANAC may impose administrative fines up to 50,000 euros for non-compliance. Adoption requires administrative body approval, GDPR compliance, and public disclosure on the corporate website to ensure accessibility.
The steps
- 1.
Identification of obligated entities
Verify whether the entity falls within the size or sector thresholds provided for by D.Lgs. 24/2023 regarding the mandatory nature of the procedure. It is necessary to analyze the average number of subordinate workers in the last calendar year, including fixed-term contracts but excluding agency workers pursuant to Art. 34 of D.Lgs. 81/2015. If the threshold of 50 employees is exceeded, the adoption of an internal reporting system becomes a mandatory regulatory requirement.
- 2.
Configuration of the internal channel
Establish reporting channels that guarantee the confidentiality of the whistleblower's identity, including through the use of encryption tools. The procedure must provide for written reporting methods, via IT platforms or registered mail, and oral methods, such as telephone lines or voice messaging systems. Pursuant to Art. 4 of D.Lgs. 24/2023, channel management must be entrusted to a dedicated, autonomous internal person or office, or to a specialized external party.
- 3.
Definition of scope and exclusions
Clearly delimit which violations of national or European Union regulatory provisions may be the subject of a report. It is essential to specify that personal grievances related to individual employment relationships or relations with hierarchical superiors are excluded. Clarity in this section prevents the channel from being misused for employment disputes that do not enjoy statutory protections.
- 4.
Management of flow and timelines
Outline the phases of the management procedure, establishing that an acknowledgment of receipt must be issued to the whistleblower within seven days of receipt. The manager must maintain communication with the whistleblower and provide diligent follow-up within three months from the date of the acknowledgment. Traceability of every investigative step is essential to demonstrate procedural compliance during potential ANAC inspections.
- 5.
Implementation of the confidentiality regime
Integrate security measures for the protection of personal data under the GDPR, limiting access to reports strictly to authorized parties. Pursuant to Art. 12 of D.Lgs. 24/2023, the identity of the whistleblower cannot be revealed to persons other than those competent to receive or follow up on the reports. This guarantee must also extend to the identity of persons mentioned in the report or otherwise involved in the facts.
- 6.
Approval and publication
Submit the draft procedure to the administrative body for formal approval and subsequent adoption via resolution. The procedure must be made easily accessible to potential whistleblowers through publication on the corporate website and posting in the workplace. It is advisable to provide an information session for employees to explain the operation of the system and the protections provided.
Legal basis: Art. 4 D.Lgs. 24/2023Art. 12 D.Lgs. 24/2023
The template structure
The standard sections that make up the document. The full template can be opened and completed directly on edit.legal.
Purpose and scope of application
Purpose of the procedure and the subjective and objective scope of protected reports.
Subject of reports
Reportable violations and scenarios excluded from the protection regime.
Reporting channels
Internal channel, external ANAC channel, and public disclosure; written and oral methods.
Management of reports
Managing party or office, response times, investigation, and traceability.
Whistleblower protections and confidentiality
Confidentiality of identity, prohibition of retaliation, and processing of personal data.
Adoption and updating
Adoption by the competent body and the updating clause.
Mistakes to avoid
- Failure to consult trade union representatives prior to establishing the internal reporting channel, in breach of the statutory obligation under Art. 4, paragraph 1, of D.Lgs. 24/2023.
- Omission of specific privacy information for whistleblowing, resulting in a violation of personal data protection regulations.
- Entrusting channel management to parties lacking autonomy and independence requirements, such as the direct superior of the potential whistleblower.
- Specifying response deadlines longer than the three months established by law, making the procedure non-compliant with D.Lgs. 24/2023.
Frequently asked questions
What are the penalties for failing to adopt the procedure?
ANAC can impose administrative fines up to 50,000 euros against entities that have not established reporting channels or have not adopted the prescribed procedures.
Can reports be made anonymously?
Yes, D.Lgs. 24/2023 allows anonymous reports; however, protections against retaliation apply only if the whistleblower is subsequently identified.
Is it mandatory to establish an oral channel?
Yes, the regulation stipulates that reports can be made in written or oral form and, upon the whistleblower's request, also through a direct meeting within a reasonable timeframe.
What edit.legal automates
- —Automatic generation of reporting channels based on the entity's workforce size and sector of activity.
- —Automated verification of compliance with confidentiality and data protection requirements under Art. 12 of D.Lgs. 24/2023.
- —Integration of pre-set clauses for managing response deadlines and communications with ANAC.
Put edit.legal to the test on actual cases
Try edit.legal for free on an active case. No credit card required.
Try edit.legal for freeThis guide is for informational purposes only and does not constitute legal advice for your specific case.