- The state authority that protects people who report wrongdoing starts work on 1 September.
- It will be the external channel for breaches in private entities that affect more than one region.
- Companies with an internal channel should review their system and who runs it.
The Official State Gazette of 12 August 2025 published Order PJC/908/2025, of 8 August, which sets 1 September as the start date for the Independent Whistleblower Protection Authority, known by its Spanish initials AIPI. It is the body foreseen by Law 2/2023 on the protection of people who report breaches, which until now had no start date. Its statute was approved by Royal Decree 1101/2024 and its first president, Manuel Villoria Mendieta, was appointed by Royal Decree 328/2025.
For companies, the launch has a practical consequence: the external channel stops being a promise in the law and becomes a real route that any employee, supplier or associate can use. The authority is also the recipient of notifications about the appointment of the people in charge of internal reporting systems, under the royal decree that approved its statute. The mere existence of an authority able to investigate changes the perception of risk: it is no longer enough to have a channel on paper, it must be shown to work.
What the AIPI is and does
The law requires many companies and public bodies to have an internal channel for reporting breaches, and also provides for an external channel before an independent authority. At state level, the AIPI handles reports concerning the private sector when the breach affects more than one autonomous region. The regions may create their own authorities for cases within their territory.
As well as receiving reports, the authority offers free advice, certifies the status of protected person and works to prevent retaliation against those who report. Its launch also activates the supervisory and sanctioning powers the law gives it, so the regime stops being largely theoretical.
What changes for companies
The law requires an internal reporting system from private entities with fifty or more employees, with a designated manager, a handling procedure and guarantees of confidentiality and no retaliation. Until now, the lack of an operational authority made non-compliance less visible; with the AIPI running, it is a real risk that deserves serious attention.
A good internal channel is also the best defence: most companies would rather learn of a problem from within before it reaches an authority. That requires trust, clear response times and the reassurance, for whoever reports, that the communication will be handled discreetly and without negative consequences for them. Reporting internally also tends to allow the problem to be corrected sooner, with less harm to the company and to the people involved.
What to review
It is worth checking that the channel is operational, that its manager has been appointed and notified where required, and that the internal procedure reflects the deadlines in the law. Some law firms warn that the deadline for notifying managers to the AIPI does not start running until its portal offers the specific form: the prudent course is to follow the authority’s own information.
It is also the time to train staff, to review the protocol with employee representatives and to document decisions. If your company operates in several regions, consider which reports could end up in the state channel. Consult your adviser on how to fit the system to your specific case. Training should not be limited to those who run the channel: all staff should know that it exists, how it is used and that they are protected against retaliation.
A reporting channel only protects the company if people trust that it works.
This article is general information. It is not legal, tax or investment advice, and it does not take anyone’s particular circumstances into account.
