I need to bring my Luxembourg organisation into compliance with recital 22 of Whistleblowing (UE 2019/1937). What are the concrete requirements, the sanctions, and how can Luxgap support me?

The classic trapRecital 22 opens a dangerous loophole: the organisation mistakenly treats a harassment, discrimination or toxic management report as a mere interpersonal grievance and routes it through the standard HR procedure, outside the whistleblower channel. The result: no reinforced confidentiality, no protection against retaliation, and both the OFRS and the ITM reclassify the episode as a clear breach of the Luxembourg law of 16 May 2023. The line between personal grievance and protected disclosure is razor-thin: a conflict with a superior that also reveals fraud, systemic harassment or a labour law violation falls entirely within the protected scope.The qualification grid to apply to every incoming reportDoes the reported fact concern only the relationship between two persons, without impact on the organisation, third parties or the public interest? If not, the whistleblower channel is mandatory.Does the fact reveal a breach of EU or national law listed in Article 2 of the Directive (GDPR, anti-money laundering, public health, product safety, collective labour law)? If yes, automatic protection applies.Is the complainant also a witness to a practice that goes beyond their personal case? The protected scope extends even if the triggering episode is interpersonal.When in doubt, treat by default as a protected disclosure: this is the option that avoids the criminal sanction of 1,250 to 25,000 EUR provided by Luxembourg law.Document in writing the qualification chosen and its justification, time-stamped, to demonstrate good faith in case of an OFRS audit.How Luxgap automates this riskOur Luxgap Whistleblowing Triage Agent eliminates the grey zone between HR grievance and protected disclosure by qualifying every incoming alert in under 60 seconds, with an audit trail opposable to the OFRS and the ITM. The tool relies on a specialised LLM agent trained on Directive 2019/1937, the Luxembourg law of 16 May 2023, OFRS guidelines and ECHR case law (Halet v. Luxembourg) to produce a reasoned qualification rather than simple keyword filtering.Automatically classifies each incoming report into three categories (pure interpersonal grievance, protected disclosure, mixed zone requiring dual handling) with confidence score and written reasoning.Detects weak signals of systemic harassment, discrimination or collective violation hidden behind an apparently bilateral conflict, through semantic analysis of the narrative.Automatically generates the acknowledgement letter compliant with the 7-day deadline imposed by Luxembourg law, including the qualification retained and the reporter's avenues of recourse.Switches with one click to the standard HR channel if the pure interpersonal grievance qualification is confirmed by the DPO or ethics officer, while preserving the decision trail.Produces a cryptographically sealed time-stamped PDF report, opposable during an OFRS audit, demonstrating that every report received a documented qualification.Natively integra...

Recital 22 Whistleblowing — Recital 22

EU frameworkGDPR NIS 2 DORA AI ActWhistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 22

Directive on the protection of persons who report breaches of Union law · UE 2019/1937

(22)	Member States could decide to provide that reports concerning interpersonal grievances exclusively affecting the reporting person, namely grievances about interpersonal conflicts between the reporting person and another worker, can be channelled to other procedures.

Luxembourg specificity

loi luxembourgeoise du 16 mai 2023 relative a la protection des lanceurs d'alerte

In Luxembourg, the law of 16 May 2023 on the protection of whistleblowers did not explicitly carve out interpersonal grievances from the protected scope: qualification is case by case and the OFRS adopts a broad reading as soon as a collective interest or a listed breach is involved. Mis-qualification exposes the employer to criminal sanctions of 1,250 to 25,000 EUR (doubled in case of recidivism), plus civil damages if the reporter suffers retaliation.

Luxgap practice: never route a file to the HR procedure without a written reasoned qualification kept for 5 years, and at the slightest doubt apply the protected channel with acknowledgement within 7 days.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 22 opens a dangerous loophole: the organisation mistakenly treats a harassment, discrimination or toxic management report as a mere interpersonal grievance and routes it through the standard HR procedure, outside the whistleblower channel. The result: no reinforced confidentiality, no protection against retaliation, and both the OFRS and the ITM reclassify the episode as a clear breach of the Luxembourg law of 16 May 2023. The line between personal grievance and protected disclosure is razor-thin: a conflict with a superior that also reveals fraud, systemic harassment or a labour law violation falls entirely within the protected scope.

The qualification grid to apply to every incoming report

Does the reported fact concern only the relationship between two persons, without impact on the organisation, third parties or the public interest? If not, the whistleblower channel is mandatory.
Does the fact reveal a breach of EU or national law listed in Article 2 of the Directive (GDPR, anti-money laundering, public health, product safety, collective labour law)? If yes, automatic protection applies.
Is the complainant also a witness to a practice that goes beyond their personal case? The protected scope extends even if the triggering episode is interpersonal.
When in doubt, treat by default as a protected disclosure: this is the option that avoids the criminal sanction of 1,250 to 25,000 EUR provided by Luxembourg law.
Document in writing the qualification chosen and its justification, time-stamped, to demonstrate good faith in case of an OFRS audit.

How Luxgap automates this risk

Our Luxgap Whistleblowing Triage Agent eliminates the grey zone between HR grievance and protected disclosure by qualifying every incoming alert in under 60 seconds, with an audit trail opposable to the OFRS and the ITM. The tool relies on a specialised LLM agent trained on Directive 2019/1937, the Luxembourg law of 16 May 2023, OFRS guidelines and ECHR case law (Halet v. Luxembourg) to produce a reasoned qualification rather than simple keyword filtering.

Automatically classifies each incoming report into three categories (pure interpersonal grievance, protected disclosure, mixed zone requiring dual handling) with confidence score and written reasoning.
Detects weak signals of systemic harassment, discrimination or collective violation hidden behind an apparently bilateral conflict, through semantic analysis of the narrative.
Automatically generates the acknowledgement letter compliant with the 7-day deadline imposed by Luxembourg law, including the qualification retained and the reporter's avenues of recourse.
Switches with one click to the standard HR channel if the pure interpersonal grievance qualification is confirmed by the DPO or ethics officer, while preserving the decision trail.
Produces a cryptographically sealed time-stamped PDF report, opposable during an OFRS audit, demonstrating that every report received a documented qualification.
Natively integrates the typical entry channels in Luxembourg: dedicated mailbox, web form, hotline, M365, and HR platforms (Sopra Steria HR Suite, Workday LU).

Available as a complement to a Luxgap DPO or ethics officer mandate or as a dedicated SaaS module depending on your scope. Request a demonstration and our teams will prepare a free 48h blank audit on your historical reports to measure your mis-qualification rate before any engagement.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 22

They trust us

Before we chat