How to comply with article 26 of Whistleblowing?

Question

I need to bring my Luxembourg organisation into compliance with article 26 of Whistleblowing (UE 2019/1937). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapArticle 26 sets the transposition deadlines, but the real trap lies with companies: many still believe they enjoy a grace period. That is false. In Luxembourg, the law of 16 May 2023 is in force, and the transitional period for private entities with 50 to 249 employees ended on 17 December 2023. The Office des rapports de signalement (OFRS) and the ITM now verify the actual existence of compliant internal reporting channels, with no tolerance for the original transposition delay.Why the timeline is a false comfortThe trap is not the deadline itself but the false sense of security it created. Three mistakes are systematically sanctioned:Assuming a simple HR mailbox is enough as an internal channel, while the law requires confidentiality, acknowledgement within 7 days and feedback within 3 months.Miscounting the 50-employee threshold in full-time equivalents and wrongly concluding you are out of scope.Overlooking that Luxembourg public bodies are subject with no threshold, from the very first agent.Forgetting that the absence of a channel exposes you to criminal fines from 1,250 to 25,000 EUR, doubled in case of recidivism, plus civil compensation of any whistleblower targeted by retaliation.In short, the transitional period is over: all that remains is the liability of the defaulting employer.How Luxgap automates this riskOur Luxgap Whistleblowing Channel Auditor makes compliance delay impossible: it continuously calculates your actual scope and materialises the state of your internal channel, rather than letting you assume you are compliant. The tool connects to your HR systems (Sopra Steria HR Suite, Workday LU, Sage BOB 50, Odoo) to track headcount and cross-references it with the real technical state of your reporting channels.Automatically calculates your applicability threshold from actual headcount extracted from your HRIS, and alerts you as soon as you cross 50 employees.Scans the existence and configuration of your internal channel (confidentiality, logging, access segregation) and detects non-compliant HR mailboxes used by default.Tracks legal deadlines per report (7-day acknowledgement, 3-month feedback) and alerts in real time on Teams before any breach.Generates governance procedures and documentation compliant with the law of 16 May 2023, pre-filled by entity type (private entity, public body).Produces a timestamped PDF report, enforceable before the OFRS and the ITM during an inspection, demonstrating the existence and effectiveness of your scheme.Available as a complement to a Luxgap DPO or CISO mandate or as a dedicated SaaS module depending on your scope. Request a personalised quote and our teams will prepare a demonstration on your real perimeter, with a free blank audit within 48h to measure your exposure before any commitment.

Transposition and transitional period

They trust us

Before we chat