The Independent Administrative Authority comes into operation

The launch on 1 September 2025 of the Independent Whistleblower Protection Authority (A.A.I., its Spanish acronym) means that organisations must review their internal procedures to comply with the requirements set out in Law 2/2023, which is the regulation that requires organisations that meet a series of requirements (the main one being that they have more than 49 employees) to establish internal reporting systems to ensure the safety of whistleblowers and prevent retaliation.

One of the key aspects that companies must address is the obligation to inform the A.A.I. —or the competent authority in their autonomous community, as appropriate— the identity of the person responsible for the internal reporting system (Article 8.3 of Law 2/2023).

Royal Decree 110/2024, which regulates the functioning of the A.A.I., introduced a transitional provision extending the initial 10-day deadline to two months. This means that organisations have until 31 October 2025 to report on the designated person.

Although an email communication channel has been set up for sending the notifications required by Article 8.3 of Law 2/2023, accessible via the information note published on the institutional website —currently under development—, it is advisable to postpone the submission of this information, but always within the legal deadline, until the A.A.I. publishes additional guidelines on how to coordinate with regional authorities, as well as completing the launch of its electronic headquarters and other digital management tools that ensure more efficient and secure processing of communications.

This new regulatory scenario requires companies not only to comply with deadlines and formal procedures, but also to ensure that their internal information systems are aligned with the principles of confidentiality, integrity and protection against retaliation established by the Law.

Compliance with these regulatory requirements should not be seen as merely the fulfilment of a legal obligation, but as a strategic opportunity to consolidate an organisational culture based on integrity, transparency and respect for the principles of good corporate governance.