Zoe Verano
CRIMINAL LAW DIVISION
The implementation of internal reporting channels has become one of the pillars of Spain’s new compliance framework following the approval of Law 2/2023 of 20 February, on the protection of persons who report regulatory breaches and on the fight against corruption (Law 2/2023).
This law, which transposes Directive (EU) 2019/1937 into Spanish law, has introduced the obligation for numerous public and private sector entities to establish internal systems that allow irregularities to be reported in a secure, confidential and anonymous manner, with the aim of strengthening prevention and early detection of misconduct.
Beyond merely having a whistleblowing channel in place, Law 2/2023 establishes a comprehensive system of safeguards requiring organisations to adopt appropriate case-management procedures, ensure protection against retaliation for reporting persons, and implement effective internal control mechanisms.
In this context, the role of the Head of the Internal Information System (HIIS) is of particular importance. This individual is responsible for overseeing the functioning of the reporting channel, handling or coordinating the processing of communications received, and ensuring compliance with the principles of independence, confidentiality and diligence required by law.
Article 8.3 of Law 2/2023 expressly establishes the obligation to notify the Independent Whistleblower Protection Authority (AIPI) of both the appointment and dismissal of the HIIS, thereby reinforcing institutional oversight of the effective functioning of internal reporting systems.
The AIPI formally commenced its activities on 1 September 2025, marking the effective launch of the whistleblower protection system. However, it subsequently clarified that the two-month period provided for notifying the appointment or dismissal of the HIIS would not begin to run from that date, but rather from the moment the specific form for this purpose became available on its electronic headquarters.
In this regard, on 9 February 2026 the AIPI took a significant step in the practical implementation of its functions by publishing on its website the specific form for notifying the appointment and dismissal of the HIIS
(https://sede.proteccioninformante.gob.es/procedimientos/index/categoria/1).
As a result, the two-month period for complying with this obligation began on 10 February 2026. From that date onwards, obligated entities must submit the relevant information within the applicable timeframe.
The Authority has also clarified that this notification must in all cases be made to the AIPI, irrespective of any notifications that may also be required before regional authorities in territories that have established equivalent bodies.
Alongside the form, the AIPI has published a completion guide addressing practical issues of interest, such as access to the electronic headquarters, identification of the applicant, proof of representation, the procedure for registering and deregistering the responsible person, and examples of properly completed forms.
From a practical perspective, the activation of this procedure marks a new milestone in the effective implementation of the whistleblower protection system in Spain and raises the level of compliance requirements. Obligated entities must not only verify that they have an internal information system that complies with the requirements of Law 2/2023, but also ensure that the appointment of the HIIS has been properly formalised and communicated within the established deadline.
