On 1 September 2025, the Independent Whistleblower Protection Authority (AAI) finally began operating, in accordance with the provisions of Order PJC/908/2025, of 8 August, published in the Official State Gazette on 12 August.
Law 2/2023, of 20 February, regulating the protection of persons who report regulatory infringements and the fight against corruption, which entered into force in March 2023, devotes Title VIII to the AAI. Article 43 sets out its main functions, namely:
Management of the AAI’s external communication channel
Adoption of whistleblower protection measures within its sphere of competence in accordance with the provisions of Article 41 of Law 2/2023
Mandatory reporting of preliminary drafts and drafts of general provisions affecting its area of competence and the functions it performs
Exercise of sanctioning powers within its sphere of competence
Fostering and promoting a culture of information
The eleventh final provision of Law 2/2023 established a period of one year to approve the AAI’s statute, an instrument that would regulate the appropriate provisions on the AAI’s organisation, structure, operation and all aspects necessary for the performance of its functions. This mandate was fulfilled through the publication of Royal Decree 1101/2024, of 29 October, which approved the Statute of the Independent Whistleblower Protection Authority, AAI (Statute).
The start of the AAI’s activities and operations on 1 September entails not only the exercising of its sanctioning power within its sphere of competence for all those subject to Law 2/2023 who violate its provisions, but also the start of the two-month period to notify the AAI of the appointments and dismissals of the individually designated natural person, as well as the members of the collegiate body, designated as responsible for the internal information system.
In effect, the fourth paragraph of the sole transitional provision of the Statute established a period of two months from the date of entry into force of the AAI – September 1 2025 − to comply with the obligation to notify the AAI of the appointment and dismissal of the person responsible for the internal information system in accordance with Article 8.3 of Law 2/2023.
Consequently, those required to comply with Law 2/2023 have until November 1 2025 to comply with the aforementioned reporting obligation. As of that date – November 1 2025 – the appointment and dismissal of the person responsible for the internal information system must be notified to the AAI within 10 business days.
However, to date, no specific instructions or procedures have been published to clarify how to effectively comply with the obligation to report the appointment of the person responsible for the internal information system. Therefore, it will be necessary to pay close attention to the start of the AAI’s activity, which is expected to define the steps to be taken in the coming weeks.
