Use case
From a report in the form to feedback after three months: an internal reporting office under the German Whistleblower Protection Act that keeps to deadlines and protects names.
A logistics company with 700 employees and six branches. The internal reporting office sits with the head of HR, alongside her actual job. Friday, 21:40: a report comes in through the form saying that at one branch, a subcontractor's invoices are being paid for journeys that never took place, and that the branch manager signs them off. The clock is slow: seven days until the acknowledgement. The problem lies elsewhere. Her assistant also reads the head of HR's inbox, and the branch manager sits with her in the management meeting every Monday. We supply the software in which your reporting office handles reports like this in isolation, without anyone reading along who is not allowed to. The decisions stay with the reporting office; legal advice is not part of what we do.
Duty
What the law requires
Since 17 December 2023, every employer with 50 or more employees has needed an internal reporting office. The deadlines are generous; the duty of confidentiality is not.
| Legal basis | German Whistleblower Protection Act (HinSchG), in force since 2 July 2023; confidentiality Section 8, documentation Section 11, reporting channels Section 16, procedure Section 17, protection against reprisals Section 36, fines Section 40 |
|---|---|
| Who is affected | Employers with 50 or more employees; for those with 50 to 249 employees since 17 December 2023 |
| Deadlines | Acknowledgement of receipt within 7 days at the latest; feedback on follow-up action and the reasons for it no later than 3 months after the acknowledgement of receipt |
| Procedure | Check whether the report is well-founded, stay in contact with the whistleblower, take follow-up action |
| Reporting channel | Oral and in text form, and in person if the whistleblower asks for it |
| Confidentiality | The identity of the whistleblower must be kept confidential. This applies to every channel and every step of the procedure. |
| Documentation | Every report is documented and deleted three years after the procedure is closed |
| Reprisals | Prohibited. If the whistleblower suffers a disadvantage, the company must prove that it has nothing to do with the report (reversal of the burden of proof). |
| Fine | Up to €50,000 for obstructing reports or for reprisals, up to €20,000 if no internal reporting office has been set up |
| Legal position as of | October 2026. We build the workflow; the legal assessment of whether a report falls under the Act and which follow-up action is right stays with your legal department or law firm. |
Clock
The workflow, week by week
Seven days and three months sound like plenty of time. They pass quickly when the report sits alongside day-to-day business. Day zero is the day the report comes in.
- Day 0
The report arrives, and only the reporting office sees it
A form with an anonymous reply channel, a call or voice message, a letter, a face-to-face meeting: every incoming report goes into a case of its own, not into an inbox. Voice messages are transcribed on your own servers, letters are scanned, meetings are minuted. The reporting office is told only that a case exists.
- Days 1 to 3
Classification with a proposal and reasons
The workflow reads the report and extracts the location, period, roles and evidence. It then proposes whether the report falls under the Act, whether it appears well-founded and which follow-up action suggests itself: an internal investigation, referral to an authority or closure with reasons. The reporting office decides.
- by day 7
Acknowledgement of receipt
The draft acknowledgement is ready on the first working day: thanks, confidentiality, next steps, reply channel. The clock sends reminders on days three and five and escalates to the named deputy if the reporting office has not approved it.
- Weeks 2 to 8
Investigation behind barriers
The investigation needs accounting, internal audit, perhaps a law firm. The workflow writes the investigation request from the case, but without the identity and without details that could lead back to the person. Questions to the whistleblower go through the reply channel, and the answers go into the case.
- Week 6
Interim update
The Act does not require one, but it keeps the whistleblower engaged. The workflow proposes a short message: the investigation is under way, and feedback will follow by a stated date. Anyone who makes a report and then hears nothing for weeks loses trust in the reporting office.
- by month 3
Feedback on follow-up action and reasons
Feedback is due no later than three months after the acknowledgement of receipt. The workflow drafts it from the case: which follow-up action was taken and why, as far as this is possible without harming the investigation or third parties.
- afterwards
Closure, documentation, deletion
On closure, the workflow sets the deletion date: three years later. Until then the case is locked away in the archive; after that the workflow deletes it and records in the log that it was deleted, without the content.
Cascade
Who may learn what, and who may not
With other reporting duties, the point is to reach everyone quickly. Here it is the other way round: each circle receives only what it needs for its part, and only the reporting office can lift a barrier.
| Circle | Recipient | Channel | Content | Approval |
|---|---|---|---|---|
| 1, from day 0 | The reporting office and its named deputy | A case of its own in the isolated workflow, separate from the inbox and the HR system | The report, the identity if known, all evidence | Access for these two people only |
| 2, ongoing | The whistleblower | Anonymous reply channel in the form, letter or telephone, depending on how the report came in | Acknowledgement, questions, interim update, feedback | Reporting office, each message individually |
| 3, for the investigation | Accounting, internal audit, external law firm | Investigation request from the case, answers back into the case | The facts, without the identity and without details that could lead back to the person | Reporting office, extract by extract |
| 4, regularly | Management | Report from the workflow | Number and status of cases, type of follow-up action, no names | Reporting office |
| 5, if necessary | The accused person | A conversation with the reporting office or the law firm | Nothing, until the investigation requires a hearing; then the facts, never the source | Reporting office with legal advice |
| 6, on referral | Competent authority | Handover by the reporting office, timestamp in the log | Facts and investigation findings from the case | Reporting office and management |
Who never learns anything in the example: the assistant who reads the inbox, the branch manager in the management meeting and IT, which runs the server but cannot open any case. You set the circles and their barriers in the analysis, with the reporting office and your legal advisers.
Approval
What stays with your people
- The classification. The workflow proposes and gives reasons. Whether a report falls under the Act and is well-founded is decided by the reporting office, in case of doubt with legal advice.
- The follow-up action. Internal investigation, referral to an authority or closure: a person decides and records the reason.
- Every message to the whistleblower. Acknowledgement, questions and feedback are drafts until the reporting office approves them.
- Every barrier that is lifted. What internal audit, the law firm or management sees is approved by the reporting office, extract by extract.
Integration
Which systems the workflow sits in
Here, separation is the core of it. The workflow runs entirely on your own servers and reads from other systems only where the investigation requires it.
- IncomingForm on your intranet and website with an anonymous reply channel, telephone number with voicemail, postal address of the reporting office, template for minuting a face-to-face meeting
- CaseA separate case store on your server, kept apart from the inbox, HR system and ticketing system, with access only for the reporting office and its deputy
- TranscriptionSpeech recognition on your own server; no recording leaves your premises
- InvestigationRead access to ERP or accounting, such as supplier invoices and approvals, only for the approved investigation request
- AuthorityIn the case of a referral, the workflow pre-fills the documents, a person hands them over, and the timestamp goes into the log.
Evidence
The log is the evidence
The workflow documents every report as it goes: receipt, classification with reasons and the name of the person in the reporting office, acknowledgement, every question, every investigation request with recipient and extract, feedback, closure, deletion date. On top of that, who opened the case and when.
This matters when it comes to reprisals. If the whistleblower later suffers a disadvantage, the company must prove that it has nothing to do with the report. A log showing that the line manager never saw the name is then worth more than any statement.
Reports that were closed also stay in the case with their reasons until the deletion period expires. Twice a year a made-up report runs through the workflow, so that you can be sure the deputy and the reply channel work.
Experience
What we bring
Reading incoming items, matching them to the right case and routing them only to the responsible team is something we know from a technology distributor with twelve sites, where enquiries from twelve sites across Europe reach the right team according to rules. Checking a text against a set of rules and giving the source for every classification is something we built for a fuel cell manufacturer. Cases with log, approval and graded access rights run every day in our own operations, on our own servers.
We put the workflow into operation together with the person who runs the reporting office at your company. The acceptance test is a made-up report, from the form to the feedback. It must show that neither the assistant nor IT can open the case, that the anonymous reply channel responds and that the deputy takes over when the reporting office is on holiday. We show you what a log with every access looks like in the first call, using an example.
Price
Price and scope
The order of magnitude first: the workflow analysis costs €4,900 at a fixed price and takes three days. Based on our projects, a custom tool typically costs between €25,000 and €60,000, as a fixed price that becomes binding after the analysis; the first version is ready in about six weeks, longer with several duties and languages. Ongoing operation after that starts at €2,900 a month and can be cancelled monthly. More precision in advance would be guesswork: a reporting office for one site and one for six companies in four languages are two different tools. What determines the price:
- number of incoming channels and whether voice messages are transcribed
- number of languages in which your workforce makes reports
- number of companies and reporting offices
- whether the workflow also covers data breaches, which often come to light through the same report
Data flow: reports, recordings and names stay on your server. For this workflow we recommend open models on your own servers, because even the fact that a report exists is confidential; a report never goes to a model that trains on it. Data flow per service.
Related
Related use cases
- GDPR: reporting a data breach within 72 hours. A report always contains personal data and sometimes uncovers a data breach in itself.
- NIS2: reporting a security incident in your own operations. Classification, approval and log as here, but with a clock that counts in hours.
- AI Act: a serious incident. If a report concerns an AI system, a second duty can begin.
- All use cases: reporting duties with deadlines, with the table of deadlines across all duties.
Further reading: Introducing AI with the works council and AI data protection in companies: three ways.
Questions
Questions about the internal reporting office as a workflow
What the reporting office, the works council and management ask before reports stop landing in an inbox. More answers under Questions and answers.
Does the AI find out who made the report?
The model reads the report in order to classify it, and runs on your server to do so. It learns nothing from it. Who sees the name is governed by the access rights in the workflow: only the reporting office and its deputy. Investigation requests to others are created without the identity.
We receive two reports a year. Is it worth it?
Especially then. Anyone who receives a report twice a year has no routine and writes the acknowledgement from scratch every time. The workflow keeps deadlines, templates and barriers ready, and the trial run twice a year makes sure the deputy knows what to do.
Who is there at night and at the weekend, and who is liable for what?
Nobody needs to be woken here: a report from Friday evening sits isolated in its case, the acknowledgement is ready as a draft on the first working day, and the clock reminds the reporting office and its deputy according to your on-call list. As part of ongoing operation we monitor that the workflow is running, with response times on working days; round-the-clock standby is agreed separately and is rarely needed here. If the workflow fails, the templates and the list of open deadlines are ready for the reporting office as an export. Your company remains responsible as the employer for deadlines and confidentiality; we are liable for the tool under our terms and conditions.
Does the works council have to agree?
As a rule, yes: a tool that processes cases concerning employees is subject to co-determination when it is introduced. We show the works council what is stored, who sees what and when it is deleted. A workflow with barriers protects employees better than an inbox that several people read.
Handover
The first step is a 30-minute call.
You tell us about the workflow that costs you the most time. We tell you honestly whether AI pays off there and what the next step would be. Whether a workflow analysis follows is up to you.