---
title: "Whistleblowing reports: where the text may end up, and who pays if the channel is non-compliant"
description: "Legislative Decree 24/2023 and ANAC Guidelines No. 1/2025: the use ceiling on reports, the seven-day and three-month deadlines, and the fine the governing body pays."
url: https://csidia.com/en/notes/whistleblowing-testo-segnalazione-fuori-perimetro/
lang: en
date: 2026-09-08
label: "Regulation"
publisher: CSIDIA S.r.l. (https://csidia.com/)
italiano: https://csidia.com/note-operative/whistleblowing-testo-segnalazione-fuori-perimetro/
---

# Whistleblowing reports: where the text may end up, and who pays if the channel is non-compliant

Anyone sitting on the governing body of a company that has handed its reporting channel to a supplier has taken a decision they did not hand over: if that channel is non-compliant, the fine of between 10,000 and 50,000 euro stays theirs. ANAC Guidelines No. 1/2025 say so without qualification — the governing body “is jointly and severally liable for the penalty together with its individual members”.

## What you are holding from day zero

A report contains three things at once: the name of the accuser, the name of the accused, and facts nobody has verified. It is the most confidential material an organisation handles, and Legislative Decree No. 24 of 10 March 2023 requires it to be handled anyway, with the clock running: Article 5(1) requires an “acknowledgement of receipt of the report within seven days of the date of receipt” and a “response to the report within three months of the date of the acknowledgement of receipt”. Article 12(7) extends protection to the accused “until the conclusion of the proceedings initiated by reason of the report”, while the facts are still merely alleged.

## The use ceiling no standard contract respects

Article 12(1) is a single line and settles everything: “Reports may not be used beyond what is necessary to follow them up properly.” It is not a confidentiality rule, it is a purpose rule: any use that does not serve to follow up that specific report is out — internal statistics, service improvement, model training, trying a new assistant on real cases.

Guidelines No. 1/2025, approved by ANAC decision No. 478 of 26 November 2025, add a requirement that is technical before it is legal: the case handler may access the identity only where strictly necessary for the investigation, and “the management system must record the handler’s access to the identity and the reasons the handler gave”. An access log with a stated reason, inside the system: not [a list of authorised people in the legal department’s binder](https://csidia.com/en/notes/whistleblowing-riservatezza-segnalante-sei-luoghi), and not [a log nobody has decided who may read](https://csidia.com/en/notes/log-assistente-ai-segreti-e-controllo-a-distanza).

## The exact point where the material leaves

Oral reports are the most exposed step. Article 14(2) provides that, on a recorded telephone line or recorded voice-messaging system, the report is documented “subject to the reporting person’s consent [...] by recording on a device suitable for storage and listening, or by a full transcript”; paragraph 4 extends the rule to a face-to-face meeting. Somebody has to transcribe that voice: if the transcription goes through a cloud service, the reporting person’s voice has left the perimeter before the case handler has even listened to it.

ANAC further requires that the handler, when involving third parties in the checks, does not pass on the report but “only the outcome of any checks carried out and, where appropriate, carefully anonymised extracts of the report”. Careful anonymisation is precisely the task that would be handed to a general-purpose assistant today: and to do it, the full text, names included, has to go into it.

ANAC already treats the use of email as “in itself inadequate to guarantee the confidentiality of the reporting person’s identity”, because mail systems “generate, collect and store, pre-emptively and across the board, the logs of message sending and receipt”. The next step is ours: an outside service that records every request with the text inside it is in no better position.

## The supplier does not carry the liability away

ANAC accepts that the infrastructure be provided by a third party, “with a cloud or an on-premise solution”, with an appointment as processor under Article 28 of Regulation (EU) 2016/679. The liability, though, does not move: the contracting entity answers if it picked an unsuitable party, and “the same reasoning applies where the third party is established abroad: in that case ANAC can supervise the conduct of the contracting entity established in Italy”. Article 21(1) sets 10,000 to 50,000 euro for retaliation, obstruction of a report or breach of confidentiality, the same range where channels have not been set up or procedures do not comply with Articles 4 and 5, and 500 to 2,500 euro in the case of Article 16(3). Anyone who has already reconstructed [the subcontracting chain under a supplier](https://csidia.com/en/notes/dora-registro-informazioni-catena-subappalto) knows where the question of who touches the data ends up.

## From January 2026 that channel also receives this

The decree was amended recently. Legislative Decree No. 211 of 30 December 2025 — transposing Directive (EU) 2024/1226 on breaches of Union restrictive measures, in Official Gazette No. 6 of 9 January 2026 — added, through Article 7(1), a sentence to Article 1(1) of Decree 24/2023: “This decree also governs the protection of persons who report breaches of the European Union restrictive measures referred to in Chapter I-bis of Title I of Book II of the criminal code, and of Article 12(1-bis) of Legislative Decree No. 286 of 25 July 1998.” Article 1 has been in force in this version since 24 January 2026.

For anyone working in dual-use goods, defence, shipments and payments towards sanctioned destinations, the nature of the traffic on that channel changes: a report about a shipment routed through an intermediary now falls under the whistleblowing regime, on the same clock. If that text gets out it does not produce a disciplinary charge: it produces criminal proceedings across an entire supply chain.

## What we do not know

We do not give legal advice. We read the consolidated text of Decree 24/2023 on Normattiva and Guidelines No. 1/2025 in the PDF adopted with decision No. 478: alongside that text ANAC also publishes the draft put out for consultation on 7 November 2024, which we did not use. We did not read in full decision No. 311 of 12 July 2023 or No. 479 of 26 November 2025 amending it. A footnote in the guidelines points to standard ISO 37008 on internal investigations: the ISO catalogue returned 403 to us and we could not verify its title, edition and status. We did not examine the cross-reference to Article 12(1-bis) of Decree 286/1998, nor look for penalties already imposed.

## The two axes, applied to this case

**Complying.** The duties in the decree become controls running on your systems: the seven days and the three months against real dates, the identity access log with the reason ANAC demands, the date of the final outcome from which the five years of Article 14 run. Not an opinion filed away: a dated trail to put in front of an inspection.

**Deciding.** The same system holds the organisation’s scattered data together — business applications, document archives, access control, logs — in a **single operating model**, on which **AI agents execute decisions with a human operator in command**, for large companies, defence, public administration and healthcare. Compliance is the way in; [the system you decide with](https://csidia.com/en/platform) is what remains.

*From the first session, at no cost, you get a dated list of what actually holds for your reporting channel: who runs it, where the data sits, which system records access to the identity and with what stated reason — empty boxes included. It stays yours even if we do not go on. [Talk it over with one of our engineers](https://csidia.com/en/contact).*

## Sources

- [Normattiva — Legislative Decree No. 24 of 10 March 2023, consolidated text](https://www.normattiva.it/atto/caricaDettaglioAtto?atto.dataPubblicazioneGazzetta=2023-03-15&atto.codiceRedazionale=23G00032&tipoDettaglio=vigente&qId=&classica=true)
- [ANAC — Guidelines No. 1/2025, decision No. 478 of 26 November 2025](https://www.anticorruzione.it/-/del.n.478-26.11.2025.llgg.wb)
- [Italian DPA — opinion No. 581 of 9 October 2025](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10184673)
- [Normattiva — Legislative Decree No. 211 of 30 December 2025](https://www.normattiva.it/atto/caricaDettaglioAtto?atto.dataPubblicazioneGazzetta=2026-01-09&atto.codiceRedazionale=26G00003&tipoDettaglio=originario&qId=&classica=true)

Note by CSIDIA S.r.l. (Vignola, MO, Italy): https://csidia.com/en/notes/whistleblowing-testo-segnalazione-fuori-perimetro/ · Who we are and what we do: https://csidia.com/en/at-a-glance/ · engagement@csidia.com