How to comply with article 28 of Whistleblowing?

Question

I need to bring my Luxembourg organisation into compliance with article 28 of Whistleblowing (UE 2019/1937). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapArticle 28 sets the directive's entry into force, but the real trap lies in the national transposition date. Many Luxembourg organisations assumed they had breathing room after publication in the Official Journal, while the law of 16 May 2023 was already applicable. The Office des rapports de signalement (OFRS) and, depending on the field, the CSSF, the CNPD or the ITM, sanction the absence of an operational internal reporting channel at the effective date, not the theoretical knowledge of the directive. The gap between the directive's entry into force and the actual obligation under Luxembourg law is exactly what pushes latecomers past the deadline.The trap of overlapping datesThe directive's entry into force (twentieth day after publication in the OJEU) binds no one directly: it starts the transposition countdown for Member States.The real obligation for your organisation arises from the Luxembourg law of 16 May 2023, not from the directive itself.The trigger threshold in Luxembourg is 50 employees for both public and private organisations, with no threshold for public bodies.An internal channel formally created but not operational (no acknowledgement within 7 days, no feedback within 3 months) equals an absent channel during an inspection.Each new crossing of the 50-employee threshold reactivates the obligation: a growing SME shifts into scope without automatic alert.How Luxgap automates this riskOur Luxgap Whistleblowing Deadline Tracker turns the puzzle of entry-into-force dates and headcount thresholds into a living dashboard that tells you, to the day, whether you are in scope. The tool cross-references your real headcount from your HRIS (Sopra Steria HR Suite, Workday LU, Sage BOB 50, Cegid Quadra payroll) with the Luxembourg legal calendar to trigger an alert as soon as your organisation crosses the 50-employee threshold or a channel reaches its review deadline.Continuously computes your consolidated headcount from payroll and HRIS, and alerts as soon as the 50-employee threshold is crossed.Detects the absence or inactivity of an internal reporting channel by verifying the reality of acknowledgements within 7 days and feedback within 3 months.Generates a timestamped compliance timeline linking directive EU 2019/1937, the Luxembourg law of 16 May 2023 and your effective obligations.Publishes an anonymised and encrypted register of reports, traceable to the OFRS, CSSF, CNPD or ITM depending on the field concerned.Produces a timestamped PDF report, usable during an inspection, demonstrating that the channel was in place by the legal effective date.Available as a complement to a Luxgap DPO or CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real scope, with a free blind audit within 48h to measure your exposure before any commitment.

Entry into force

They trust us

Before we chat