How to comply with article 25 of Whistleblowing?

Question

I need to bring my Luxembourg organisation into compliance with article 25 of Whistleblowing (UE 2019/1937). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapArticle 25 is a trap of underestimation. Many organisations align their scheme with the bare minimum of the EU directive, without checking that Luxembourg national law or their collective agreement already offers a higher level of protection. Yet the OFRS (Office des rapports de signalement) and the ITM assess compliance against the most favourable standard that applies: if your internal policy downgrades an already acquired protection (shorter response deadline, broader scope, guaranteed anonymity under a company agreement), it is unenforceable and exposes you to civil indemnity and criminal penalties.The practical traps of the non-regression clauseAdopting a generic EU policy template as-is, ignoring the more protective specificities of the Luxembourg law of 16 May 2023.Narrowing a reporting scope already broadened by a collective agreement or prior internal practice, which is a regression prohibited by Article 25(2).Overlooking the transversal role of the OFRS and wrongly directing a report to a single sectoral authority (CSSF, CNPD, ITM, CAA, ILR) when a more favourable channel existed.Imposing a contractual waiver of whistleblower rights, void by operation of law under Article 24 read with Article 25.Failing to track successive versions of the internal policy, making it impossible to prove the absence of regression during an inspection.How Luxgap automates this riskOur Luxgap Whistleblower Floor Guard makes any silent regression of your reporting scheme impossible by continuously comparing your internal policy with the most favourable legal floor that applies. The tool ingests your policy versions stored in M365 SharePoint, your collective agreements and your HR charters (Sopra Steria HR Suite, Workday LU), then cross-checks each clause against the grid of the Luxembourg law of 16 May 2023 and Directive EU 2019/1937 using a specialised AI agent.Automatically detects any clause in your internal policy that is less favourable than the legal or contractual floor, and alerts before publication.Compares each new version to the previous one and blocks any regression of response deadlines, scope or anonymity guarantees.Classifies each type of report and routes it to the most favourable channel (transversal OFRS, CSSF, CNPD, ITM, CAA, ILR).Generates an internal policy template aligned with the most protective standard, broken down by organisation size and sector.Produces a time-stamped PDF report, enforceable before the OFRS and the ITM during an inspection, demonstrating the absence of regression under Article 25(2).Available as a complement to a Luxgap DPO or CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real scope, with a free blind audit within 48h to measure your exposure before any commitment.

More favourable treatment and non-regression clause

They trust us

Before we chat