How to comply with article 3 of Whistleblowing?

Question

I need to bring my Luxembourg organisation into compliance with article 3 of Whistleblowing (UE 2019/1937). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapArticle 3 creates a layered articulation that most organisations overlook: sector-specific Union rules (financial services, anti-money laundering, product safety, public health) take precedence, and the Directive only applies as a complement. In practice, a CSSF-regulated fintech, a law firm or a healthcare provider must reconcile several reporting channels without omitting any or stacking them in contradiction. The OFRS, the cross-cutting external authority in Luxembourg, like the CSSF, the CNPD or the ITM depending on the field, sanctions the lack of a compliant internal channel and the mishandling of exclusions (lawyers' professional privilege, medical privilege, classified information): either you protect a report that should have been filtered out, or you wrongly reject a protected whistleblower.The mapping of regimes to articulate before deploying your channelThe trap is not the channel itself, it is the priority matrix between regimes. Before publishing your scheme, you must decide for each type of report:Does the report fall under a sector-specific act in Annex Part II (market abuse, AML, product safety) imposing its own prioritised rules?Does the report touch an absolute exclusion: classified information, lawyers' professional privilege, medical privilege, secrecy of deliberations, criminal procedure?Is it a public procurement matter with defence or security aspects, out of scope unless a specific Union act applies?Does the report concern consultation of staff representatives or trade unions, governed by social law and not replaced by the Directive?Is the sectoral protection level at least equivalent to the Directive, failing which the Directive baseline still applies?A wrong qualification of any of these cases strips your compliance of its evidential value during an inspection.How Luxgap automates this riskOur Luxgap Whistleblowing Channel Router makes it impossible to misroute a report by turning the legal matrix of Article 3 into an enforceable routing engine. The tool hosts your internal channel, connects your M365 functional mailboxes and your web forms, and qualifies each incoming alert through an LLM agent trained on Annex Part II and the exclusions of paragraphs 2 to 4, without requiring your officer to know the hierarchy of regimes by heart.Automatically classifies each incoming report by its applicable regime: Directive baseline, prioritised sector-specific act (AML, market abuse, product safety) or absolute exclusion.Detects reports involving lawyers' professional privilege, medical privilege or classified information and places them in a restricted encrypted circuit before any processing.Routes to the correct external channel (OFRS, CSSF, CNPD, ITM, CAA, ILR) by subject matter, with acknowledgement and feedback deadlines computed automatically.Generates the map of regimes applicable to your organisation, updated as soon as a sector-specific Annex act evolves.Produces a timestamped, cryptographically sealed ...

Relationship with other Union acts and national provisions

They trust us

Before we chat