A Warsaw-based logistics company with 52 employees received a labour inspection notice in January 2026. The inspector's first question: "Where is your internal reporting channel?" The company had no answer. The channel was legally required from the moment headcount crossed 50. The result was an immediate compliance gap – and a risk of criminal liability for the management board.
Polish law implementing the EU Whistleblowing Directive requires every employer with 50 or more employees to establish an internal reporting channel for whistleblowers. The obligation arises under the Act on the Protection of Whistleblowers (ustawa o ochronie sygnalistów), which entered into force in September 2024. Employers who fail to establish the channel within the statutory period face criminal liability carrying a fine or restriction of liberty.
This guide walks through the full setup process: who must act, what the channel must contain, how to draft the required internal procedure, and where companies most commonly fail. Three business scenarios – a manufacturing plant, an IT company, and a foreign investor's subsidiary – illustrate how the rules apply in practice. A checklist and FAQ close the guide.
Who must establish a whistleblower channel under Polish law?
The threshold is 50 employees. Any employer that reaches this headcount must establish and maintain an internal reporting channel. The count covers all persons performing work, not only those employed under a contract of employment – contractors and civil-law agreement workers count toward the total. The National Labour Inspectorate (Państwowa Inspekcja Pracy, PIP) monitors compliance and may initiate proceedings without prior warning.
Certain sectors face the obligation regardless of headcount. Financial services firms, entities subject to anti-money-laundering rules, and public procurement entities must maintain a channel irrespective of size. The Polish Financial Supervision Authority (Komisja Nadzoru Finansowego, KNF) oversees compliance in the financial sector. Employers in these categories should not wait for the 50-employee threshold.
The employing entity in a capital group is responsible for its own channel. A parent company's channel does not cover subsidiaries automatically. Each legal entity counts separately against the threshold. For groups with subsidiaries between 50 and 249 employees, a shared channel is permitted – but only if each entity within the group formally adopts the shared procedure. The National Court Register (Krajowy Rejestr Sądowy, KRS) records make it straightforward for inspectors to identify covered entities.
Employers who hover near the 50-employee line should track headcount monthly. Crossing the threshold triggers a 3-month implementation period. Missing that window forfeits the employer's ability to claim good-faith compliance – and personal liability of board members follows.
What must the internal reporting channel actually contain?
The channel is not merely a suggestion box. Polish whistleblower law sets out minimum technical and procedural requirements. The channel must allow reports to be submitted in writing or verbally. Written reports may be submitted electronically or on paper. Verbal reports require either a dedicated telephone line or a face-to-face meeting within a reasonable timeframe – in practice, no more than 14 days from request.
We secured a compliant channel rollout for a manufacturing client in the Silesia region (autumn 2025), including a dedicated encrypted submission platform and trained internal compliance officers. The project took six weeks from instruction to go-live.
The channel must guarantee confidentiality of the reporting person's identity. The system – whether software or a designated email address – must restrict access to authorised personnel only. Encryption is not legally mandated by name, but regulators treat unencrypted channels as inadequate. The authorised person or unit handling reports must be independent of the subject of any report.
Every report must receive an acknowledgement within 7 days of receipt. The employer must provide feedback to the reporting person within 3 months of acknowledgement. Both deadlines are hard statutory limits. Missing either deadline is itself a breach, separate from any failure to act on the report's substance.
- Written or verbal submission option (employer's choice of both)
- Confidentiality protection for the whistleblower's identity
- Acknowledgement within 7 days of receiving a report
- Follow-up feedback within 3 months of acknowledgement
- Prohibition on retaliation, documented in the internal procedure
Employers often underestimate the verbal reporting obligation. A telephone hotline or meeting room protocol must be documented. Ad-hoc arrangements do not satisfy the requirement. The internal procedure must describe the verbal reporting process explicitly.
How do you draft the internal reporting procedure?
The internal reporting procedure is the document that operationalises the channel. It must be adopted in writing and – where a trade union or employee representative body exists – consulted with that body for at least 5 days before adoption. Employers without employee representatives may adopt the procedure unilaterally, but must allow employees 7 days to review the draft before it takes effect.
The procedure must identify: the entity or persons authorised to receive reports, the process for acknowledging receipt, the steps for investigating a report, the timeframes for feedback, and the measures protecting the whistleblower from retaliation. It must also specify which violations of law may be reported through the channel. The list is not open-ended – the Act defines covered subject matter, which includes labour law, environmental law, financial services, public health, and several other categories.
Employers may extend the channel's scope to cover internal company policies as well. This is optional. Many employers choose to include violations of internal codes of conduct, anti-corruption policies, and data protection rules. Extending scope is commercially sensible – it captures risks before they escalate to external regulators. However, the procedure must distinguish clearly between statutory minimum scope and any voluntary extension.
The procedure must be made available to all employees and to persons who will perform work for the employer before commencing that work. Posting it on the intranet satisfies the requirement for existing staff. New joiners must receive it as part of onboarding. For employers navigating posted workers from the United Kingdom to Poland, the procedure must also cover posted personnel working at the Polish establishment.
What are the most common compliance mistakes?
Three scenarios illustrate where employers go wrong. Each reflects a pattern seen repeatedly in 2025 practice.
A manufacturing plant in Małopolska with 80 employees adopted a whistleblower procedure in October 2024 – but used a template that omitted the verbal reporting option. The procedure described only an email address. During a PIP inspection in early 2025, the inspector found the channel non-compliant. The employer had to re-consult with employee representatives and re-adopt the procedure, adding 6 weeks to the timeline and exposing management to personal liability during the gap.
An IT company in Warsaw (around 60 employees) set up an encrypted web form but assigned report handling to the HR director – who also managed the employee relations function. Reports about HR conduct were therefore channelled to the very person who might be their subject. The Act requires the authorised person to be independent of the report's subject. The company had to restructure its internal compliance function before the channel was considered valid.
A foreign investor's subsidiary in Lower Silesia assumed its German parent's group-wide whistleblowing platform satisfied Polish requirements. It did not. The parent's platform lacked a Polish-language interface, did not provide acknowledgements within 7 days, and the group procedure had never been formally adopted by the Polish entity. For employers also managing digital compliance obligations – such as the KSeF electronic invoicing system – this pattern of assuming cross-border tools satisfy Polish-specific requirements is a recurring source of non-compliance.
The common thread: treating the channel as a technical checkbox rather than a legal procedure with its own lifecycle. A channel that exists on paper but fails in operation does not protect the employer.
What is the step-by-step implementation timeline?
Implementation takes between 4 and 8 weeks for most employers. The timeline depends on whether employee consultation is required and whether a technology platform must be procured or configured.
We helped a technology client in the Mazowieckie region establish a compliant channel from scratch in five weeks (spring 2025), including employee consultation, platform configuration, and staff training sessions for 65 employees.
- Week 1–2: Scope decision (statutory minimum or extended), authorised person or unit identified, technology solution selected
- Week 2–3: Draft internal procedure prepared, reviewed against statutory requirements
- Week 3–4: Consultation with trade union or employee representatives (minimum 5 days); or 7-day employee review period where no representatives exist
- Week 4–5: Procedure adopted, channel activated, employees notified
- Week 5–8: Staff training, onboarding process updated, first operational test of acknowledgement workflow
Employers with collective bargaining agreements should check whether the whistleblower procedure triggers any additional consultation obligations under those agreements. Some agreements require broader consultation on workplace policies. Missing that step can invalidate the adoption process.
For employers also managing employment of foreign nationals – including those holding a work permit in Poland or an EU Blue Card – the procedure must cover those workers from day one of their assignment. An employment lawyer in Warsaw familiar with both the whistleblower framework and work authorisation rules can coordinate both workstreams. Foreign nationals working under temporary residence permits are covered by the same anti-retaliation protections as Polish employees. For employers with cross-border workforce arrangements, the guidance on posted workers from Cyprus to Poland illustrates how multi-jurisdictional employment structures interact with Polish compliance requirements.
Once the channel is live, it requires ongoing maintenance. The authorised person must be available to receive reports. Acknowledgement and feedback deadlines must be tracked. The procedure must be reviewed whenever the employer's structure or scope of activities changes materially. An annual review is good practice.
Frequently asked questions
Q: Does the whistleblower channel obligation apply to employers just below 50 employees who expect to grow?
A: The obligation arises at the moment the 50-employee threshold is crossed, not in anticipation of crossing it. However, employers approaching that threshold should prepare documentation and select a technology solution in advance. Implementation takes at least 4 weeks. Starting preparation at 45 employees gives sufficient runway. Waiting until after the threshold is crossed and the 3-month period has begun is the most common cause of non-compliance.
Q: Can the employer use a third-party platform for the whistleblower channel?
A: Yes. Third-party platforms are widely used and are legally permissible. The employer remains responsible for compliance regardless of which platform is used. The platform must satisfy all statutory requirements: confidentiality, 7-day acknowledgement capability, and support for verbal reporting (or the employer must supplement the platform with a separate verbal reporting protocol). The data processing agreement with the platform provider must comply with the General Data Protection Regulation (GDPR) and Polish data protection law. The platform must also be available in Polish.
Q: What happens if an employee submits a false report through the channel?
A: The Act protects whistleblowers who report in good faith, even if the report proves unfounded. A person who knowingly submits false information is not protected and may face civil or criminal liability. The employer may take disciplinary action against an employee who made a deliberately false report. However, the employer must be careful not to treat a good-faith report that turns out to be incorrect as a false report. The distinction between good-faith error and deliberate falsehood is a question of fact. Disciplinary action should not be initiated without legal advice.
What to prepare before launching your whistleblower channel
Before activating the channel, confirm the following items are in place:
- Authorised person or unit identified and independent of potential report subjects
- Internal reporting procedure drafted and consulted with employee representatives
- Technology solution configured with confidentiality protections and Polish-language interface
- Verbal reporting protocol documented (telephone line or meeting procedure)
- Acknowledgement and feedback tracking system in place
Specific circumstances in your organisation – group structure, foreign workforce, sector-specific regulation – may require additional steps. A gap between the channel as documented and the channel as operated is the most common source of liability. Closing that gap before an inspection is always less costly than closing it after.
To receive an expert assessment of your whistleblower channel setup, contact info@kordeckipartners.com.
KORDECKI & Partners is a law firm based in Warsaw and Krakow, advising business clients across 30 jurisdictions. Our team combines expertise in Polish and international law with a practical approach to employment compliance, whistleblower channel implementation, and workforce regulation. We work with Polish entrepreneurs, foreign investors, and in-house legal teams. To discuss your situation, contact info@kordeckipartners.com.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. KORDECKI & Partners assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@kordeckipartners.com.