Whistleblowing software with the deadlines built in
The EU Whistleblower Directive requires employers with 50 or more workers to run an internal reporting channel. The reporting side of CultureMonkey's anonymous reporting software gives your people a written channel in their own language, and puts every report on a clock.
Book a free, no-obligation product demo call with our experts.
What does the EU Whistleblower Directive require of a reporting channel?
Directive 2019/1937 requires every private employer with 50 or more workers, and most public bodies, to run an internal reporting channel. These are the requirements a channel itself has to meet, with the article each one comes from.
| The Directive asks for | In Speak Up |
|---|---|
| A secure channel that protects the reporter's identity (Art. 9 and 16) | No login and anonymous by default. A Super Admin sees nothing until added, and each handler sees only their categories, enforced where the data is stored |
| Reports in writing, orally, or both (Art. 9(2)) | In writing, by link or QR poster, in 100+ languages. There is no phone line |
| Acknowledgement within 7 days (Art. 9(1)(b)) | A 7-day acknowledgement window on every case, flagged if it slips |
| An impartial person or team to follow up (Art. 9(1)(c)) | Cases go by category to the people you name, including an outside ombudsperson |
| Diligent follow-up, including of anonymous reports (Art. 9(1)(d) and (e)) | Five stages, each one dated, and two-way messaging with reporters who stay anonymous |
| Feedback within 3 months (Art. 9(1)(f)) | A 3-month due date on every case, flagged if it slips |
| A record of every report (Art. 18) | Every report, message and stage change kept on the case |
How fast must a whistleblowing report be acknowledged?
Within seven days, with feedback due within three months, under the EU Whistleblower Directive. When a whistleblower hears nothing back, they assume nothing happened. The next concern goes to a regulator, or nowhere at all.
So Speak Up sets both deadlines on every case the moment it arrives. Nobody has to add them, and when either slips it is flagged on the case, in the queue and in analytics.
Acknowledge the reporter
The owner confirms the report has been received and is being looked at.
Acknowledged on day 3Give the reporter feedback
What has been done about it, and what happens next, told to the reporter.
OverdueFlagged on the case, in the queue and in analyticsIllustration. Both clocks start the moment a report arrives.
A whistleblowing channel people will actually use
A channel that only works in one language, or only from a desk, is a channel most of your workforce never uses.
In their own language
The portal runs in 100+ languages, whichever ones you enable, with category questions translated for you.Read in English
Every report and message reaches the case team in English beside the original, so nothing waits on a translator.No desk needed
A link for the intranet and a printed QR poster for sites where nobody has a work email.Anonymous or named
Anonymous by default. Where you allow it, reporters can give their name and confirm their email with a code.
How is anonymous whistleblowing kept confidential?
By limiting who can read a report at all, whether or not the reporter gave a name. Reports are anonymous by default. When someone does give their name, the Directive expects it to go no further than the people authorised to handle the report. Speak Up has its own membership, separate from CultureMonkey administration, and each member sees only the categories they cover.
An external ombudsperson or law firm can take reports as a Speak Up-only member, with no way into anything else. Cases sit inside the same SOC 2 and ISO 27001 scope as the rest of CultureMonkey.
| Who | Sees |
|---|---|
| Case handler | Reports in their categories |
| External ombudsperson | The reports they are given |
| Engagement survey admins | No reports |
| Super Admin, not added | Nothing in Speak Up |
What compliance teams ask about the Directive
Software that gives people a confidential way to report wrongdoing and gives the organisation a controlled way to handle it: a reporting channel, a case for every report, a record of what was done, and access limited to the people authorised to see it. Speak Up adds the EU Directive's two deadlines to every case: 7 days to acknowledge and 3 months to give feedback.
No software can do that on its own, and you should be wary of any that says it does. Speak Up gives you the channel and the process the Directive describes: confidential written reporting, a 7-day acknowledgement and 3-month feedback deadline on every case, impartial handling by the people you name, and a record of every step. Compliance also depends on your policy, your communication to staff and your national law.
Under the Directive, private employers with 50 or more workers, and public sector bodies. Organisations with 250 or more workers had to comply from December 2021, and those with 50 to 249 from December 2023. Each member state wrote the Directive into its own law, and some go further, so check the rules in every country where you employ people.
The Directive lets a channel take reports in writing, orally, or both. Speak Up is a written channel, by link or QR code, and does not include a phone line. Some national laws or internal policies expect an oral option as well, so check yours before deciding.
In Speak Up, yes, and anonymous is the default. The Directive leaves it to each member state to decide whether anonymous reports must be accepted and followed up. Anonymous reporters keep a report number and a password, so your team can still ask them questions and they can answer without giving a name.
Yes. Add them as a Speak Up-only member with the categories they cover. They get their own sign-in to the case portal and no access to surveys, engagement results or anything else in CultureMonkey.
Any of the 100+ languages CultureMonkey supports, including the EU languages. You choose which to offer, reporters pick theirs on the portal, and the case team reads every report and message in English beside the original.
In anonymous mode no name or email is collected. A notification email, if the reporter adds one, is hidden from the case team. Access is granted per person and per category, a CultureMonkey Super Admin sees nothing until added to the case team, and every action on a case is logged.
See how a report moves through its two deadlines
Walk through the channel, the clocks and who can read a case with our team.