On paper, the obligation looks simple: set up a reporting channel, adopt a procedure, protect the reporter. In practice, Polish employers have discovered that the ustawa o ochronie sygnalistów (Whistleblower Protection Act) carries precise thresholds, tight deadlines, and penalties that can reach PLN 60,000 for individuals and PLN 1,000,000 for organisations. Many companies still lack a compliant channel – and the clock is running.

The Whistleblower Protection Act obliges Polish employers who employ at least 50 workers to establish an internal reporting channel and adopt a written reporting procedure. Employers in certain regulated sectors – including financial services and public procurement – must comply regardless of headcount. Failure to implement a compliant channel exposes the employer to criminal and administrative liability, while retaliating against a whistleblower is a criminal offence carrying up to three years of imprisonment.

This guide covers three things: what the law changed, which employers are affected and from when, and what concrete steps you must take now. If you manage a Polish subsidiary, a branch, or a domestic entity above the relevant threshold, the compliance window is already open.

What did the Whistleblower Protection Act change for Polish employers?

Before the Act came into force, Poland had no unified legal framework protecting people who report workplace wrongdoing. Reporters relied on scattered provisions in labour law, criminal procedure, and sector-specific regulations. The Act replaced that patchwork with a single, enforceable regime. It implemented EU Directive 2019/1937 and introduced obligations that are now monitored by the Rzecznik Praw Obywatelskich (Commissioner for Human Rights, RPO) and, for financial-sector entities, by the Komisja Nadzoru Finansowego (Polish Financial Supervision Authority, KNF).

The core change is structural. Employers must create a dedicated channel – separate from ordinary HR or management lines – through which workers can report breaches of law. The channel must guarantee confidentiality. Reports must be acknowledged within seven days and followed up within three months. The employer must maintain a register of reports for a minimum of three years.

Retaliation is now explicitly criminalised. Dismissing, demoting, or otherwise harassing a whistleblower exposes the responsible manager to criminal prosecution. This is not a theoretical risk. The Prokuratura (Public Prosecution Service) has already received complaints under the Act. The irreversible consequence of inaction is a permanent criminal record for the individual who authorised the retaliation.

  • Acknowledgement deadline: 7 days from receipt of report
  • Follow-up deadline: 3 months from acknowledgement
  • Register retention: minimum 3 years
  • Maximum fine for non-compliant organisation: PLN 1,000,000

For employers with cross-border operations, the Act applies to all workers performing work in Poland – including posted workers and contractors. If you employ staff posted from Switzerland or other non-EU countries, your channel obligations extend to them as well. The rules on posted workers from Switzerland to Poland interact directly with your whistleblower compliance perimeter.

Who is affected and what are the thresholds?

The headcount threshold is the starting point. Employers with 50 or more workers were required to implement an internal channel by 25 September 2024. Employers in the 50–249 worker band had a slightly later deadline for the internal procedure – but that grace period has now expired. All employers above the threshold are currently in scope. Employers below 50 workers are exempt from the internal channel obligation but remain subject to the external reporting regime managed by the RPO.

Sector-specific rules override the headcount threshold entirely. Entities operating in financial services, anti-money-laundering, transport safety, environmental protection, food safety, and public procurement must maintain a compliant channel regardless of size. A two-person fintech registered with the KNF is fully in scope. An employment lawyer in Warsaw advising regulated entities should treat the sectoral rules as the primary test, not the headcount figure.

The worker count itself requires careful calculation. The Act counts not only employees under an employment contract but also contractors, civil-law contractors performing work personally, and – in some interpretations – seconded staff. We secured a review of a client's headcount calculation for a technology company in Mazowieckie (winter 2026) that revealed the company had been treating contractors as outside the count. That miscalculation had kept the company below the threshold on paper while it was actually above it.

Foreign investors entering Poland through a subsidiary should note that the threshold applies at the legal entity level, not at the group level. A Spanish parent with 5,000 employees globally does not automatically trigger the obligation for a Polish subsidiary with 30 workers – unless the subsidiary operates in a regulated sector. For more on compliance obligations for foreign-owned Polish entities, see employment law compliance for Spain companies in Poland.

What must you do now?

If your organisation is in scope and has not yet implemented a compliant channel, the priority is to act before an inspection or a whistleblower complaint triggers enforcement. The RPO can initiate proceedings on its own motion. A fine of up to PLN 60,000 for the responsible individual is not the worst outcome – a criminal prosecution for retaliation or obstruction is. Three months is the outer limit for completing a full implementation from a standing start.

The procedure document is the foundation. It must specify: who manages the channel, how reports are received, how confidentiality is protected, what the follow-up timeline is, and how the reporter is informed of the outcome. The procedure must be consulted with the company's trade union or, where none exists, with employee representatives. That consultation alone takes a minimum of five days and can extend to fifteen.

We assisted a manufacturing client in Lower Silesia (spring 2026) in completing a full channel implementation – including procedure drafting, employee consultation, and IT-channel configuration – within six weeks. The key bottleneck was not the technology but the internal governance decision about who would manage reports. Assigning that function to an external trusted third party is a legally permissible and often preferable option.

  • Draft the internal reporting procedure
  • Consult with trade union or employee representatives (5–15 days)
  • Configure a confidential reporting channel (digital or physical)
  • Train the designated report-handler
  • Publish the procedure and inform all workers

Employers managing staff on work permits or EU Blue Cards should also ensure that foreign workers understand how to use the channel. Language access is not explicitly mandated by the Act, but failing to provide it creates a practical gap that regulators may treat as a structural deficiency. If your workforce includes significant numbers of non-Polish speakers, a translated summary of the procedure is a low-cost safeguard. Dividend distribution decisions and ownership restructuring – covered separately in our guide on dividend distribution rules for Polish companies – do not affect the whistleblower obligation, but they can affect who bears personal liability if the channel is absent.

Your specific compliance gap – whether it is a missing procedure, an unconsulted workforce, or a miscounted headcount – determines the remediation path. Acting now forecloses the risk of a fine, a criminal complaint, or an enforcement notice that precludes a clean compliance record. To receive an expert assessment of your whistleblower channel obligations, contact info@kordeckipartners.com.

Frequently asked questions

Q: Does the obligation apply if we use contractors rather than direct employees?

A: Yes. The Act covers individuals performing work on the basis of civil-law contracts, not only employment contracts. If those contractors personally perform work for your organisation and the total count reaches 50, the threshold is met. Misclassifying workers as contractors to stay below the threshold does not eliminate the obligation and may create additional labour-law exposure.

Q: How long does it take to implement a compliant channel from scratch?

A: A realistic minimum is four to six weeks. The procedure must be drafted, reviewed, and then consulted with employee representatives for at least five days. The channel itself – whether a dedicated email address, a web platform, or a physical post box – must be operational before the procedure is published. Rushing the consultation step is the most common implementation error and can invalidate the entire procedure.

Q: Is it a misconception that only large companies need to worry about this?

A: It is a widespread one. Sector-specific obligations apply regardless of headcount. A small entity in financial services, public procurement, or environmental regulation is fully in scope from day one. Additionally, the external reporting channel managed by the RPO is available to workers at any employer – meaning even exempt small employers face retaliation liability if they act against a reporter who used the external route.

KORDECKI & Partners is a law firm based in Warsaw and Krakow, advising business clients across 30 jurisdictions. Our team combines expertise in Polish and international law with a practical approach to employment compliance, whistleblower channel implementation, and workforce management. We work with Polish entrepreneurs, foreign investors, and in-house legal teams. To discuss your situation, contact info@kordeckipartners.com.

Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. KORDECKI & Partners assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@kordeckipartners.com.