Whistleblowing reports: where the text may end up, and who pays if the channel is non-compliant
7 min read
Anyone sitting on the governing body of a company that has handed its reporting channel to a supplier has taken a decision they did not hand over: if that channel is non-compliant, the fine of between 10,000 and 50,000 euro stays theirs. ANAC Guidelines No. 1/2025 say so without qualification — the governing body “is jointly and severally liable for the penalty together with its individual members”.
What you are holding from day zero
A report contains three things at once: the name of the accuser, the name of the accused, and facts nobody has verified. It is the most confidential material an organisation handles, and Legislative Decree No. 24 of 10 March 2023 requires it to be handled anyway, with the clock running: Article 5(1) requires an “acknowledgement of receipt of the report within seven days of the date of receipt” and a “response to the report within three months of the date of the acknowledgement of receipt”. Article 12(7) extends protection to the accused “until the conclusion of the proceedings initiated by reason of the report”, while the facts are still merely alleged.
The use ceiling no standard contract respects
Article 12(1) is a single line and settles everything: “Reports may not be used beyond what is necessary to follow them up properly.” It is not a confidentiality rule, it is a purpose rule: any use that does not serve to follow up that specific report is out — internal statistics, service improvement, model training, trying a new assistant on real cases.
Guidelines No. 1/2025, approved by ANAC decision No. 478 of 26 November 2025, add a requirement that is technical before it is legal: the case handler may access the identity only where strictly necessary for the investigation, and “the management system must record the handler’s access to the identity and the reasons the handler gave”. An access log with a stated reason, inside the system: not a list of authorised people in the legal department’s binder, and not a log nobody has decided who may read.
The exact point where the material leaves
Oral reports are the most exposed step. Article 14(2) provides that, on a recorded telephone line or recorded voice-messaging system, the report is documented “subject to the reporting person’s consent […] by recording on a device suitable for storage and listening, or by a full transcript”; paragraph 4 extends the rule to a face-to-face meeting. Somebody has to transcribe that voice: if the transcription goes through a cloud service, the reporting person’s voice has left the perimeter before the case handler has even listened to it.
ANAC further requires that the handler, when involving third parties in the checks, does not pass on the report but “only the outcome of any checks carried out and, where appropriate, carefully anonymised extracts of the report”. Careful anonymisation is precisely the task that would be handed to a general-purpose assistant today: and to do it, the full text, names included, has to go into it.
ANAC already treats the use of email as “in itself inadequate to guarantee the confidentiality of the reporting person’s identity”, because mail systems “generate, collect and store, pre-emptively and across the board, the logs of message sending and receipt”. The next step is ours: an outside service that records every request with the text inside it is in no better position.
The supplier does not carry the liability away
ANAC accepts that the infrastructure be provided by a third party, “with a cloud or an on-premise solution”, with an appointment as processor under Article 28 of Regulation (EU) 2016/679. The liability, though, does not move: the contracting entity answers if it picked an unsuitable party, and “the same reasoning applies where the third party is established abroad: in that case ANAC can supervise the conduct of the contracting entity established in Italy”. Article 21(1) sets 10,000 to 50,000 euro for retaliation, obstruction of a report or breach of confidentiality, the same range where channels have not been set up or procedures do not comply with Articles 4 and 5, and 500 to 2,500 euro in the case of Article 16(3). Anyone who has already reconstructed the subcontracting chain under a supplier knows where the question of who touches the data ends up.
From January 2026 that channel also receives this
The decree was amended recently. Legislative Decree No. 211 of 30 December 2025 — transposing Directive (EU) 2024/1226 on breaches of Union restrictive measures, in Official Gazette No. 6 of 9 January 2026 — added, through Article 7(1), a sentence to Article 1(1) of Decree 24/2023: “This decree also governs the protection of persons who report breaches of the European Union restrictive measures referred to in Chapter I-bis of Title I of Book II of the criminal code, and of Article 12(1-bis) of Legislative Decree No. 286 of 25 July 1998.” Article 1 has been in force in this version since 24 January 2026.
For anyone working in dual-use goods, defence, shipments and payments towards sanctioned destinations, the nature of the traffic on that channel changes: a report about a shipment routed through an intermediary now falls under the whistleblowing regime, on the same clock. If that text gets out it does not produce a disciplinary charge: it produces criminal proceedings across an entire supply chain.
Why a closed system is not a preference here
The four constraints come from this case, not from a principle. The material includes the name of an accused person nobody has verified. The law requires it to be worked through within seven days and three months: somebody will read it in a hurry and look for a tool to help. Article 12(1) bans any further use, and a general-purpose service cannot demonstrate there was none. The system has to record who saw the identity, and why.
A model running inside the perimeter — open weights, on machines you govern — holds all four together: the text crosses no border, the access log is yours, and further use is not forbidden by a clause, it is impossible, because downstream there is no second purpose. The two delivery modes are the usual ones: on-premises, on autonomous machines that need no deep integration into your network, or dedicated cloud with a dedicated VPN and a data centre in Italy staffed by us, always with shared management — whoever runs a reporting channel should not also have to keep AI model administrators in house.
What we do not know
We do not give legal advice. We read the consolidated text of Decree 24/2023 on Normattiva and Guidelines No. 1/2025 in the PDF adopted with decision No. 478: alongside that text ANAC also publishes the draft put out for consultation on 7 November 2024, which we did not use. We did not read in full decision No. 311 of 12 July 2023 or No. 479 of 26 November 2025 amending it. A footnote in the guidelines points to standard ISO 37008 on internal investigations: the ISO catalogue returned 403 to us and we could not verify its title, edition and status. We did not examine the cross-reference to Article 12(1-bis) of Decree 286/1998, nor look for penalties already imposed.
The two axes, applied to this case
Complying. The duties in the decree become controls running on your systems: the seven days and the three months against real dates, the identity access log with the reason ANAC demands, the date of the final outcome from which the five years of Article 14 run. Not an opinion filed away: a dated trail to put in front of an inspection.
Deciding. The same system holds the organisation’s scattered data together — business applications, document archives, access control, logs — in a single operating model, on which AI agents execute decisions with a human operator in command, for large companies, defence, public administration and healthcare. Compliance is the way in; the system you decide with is what remains.
From the first session, at no cost, you get a dated list of what actually holds for your reporting channel: who runs it, where the data sits, which system records access to the identity and with what stated reason — empty boxes included. It stays yours even if we do not go on. Talk it over with one of our engineers.