From regulation to reality: the new Independent Whistleblower Protection Authority (Autoridad Independiente de Protección del Informante, or A.A.I.) and the challenges of Spanish Law 2/2023 for companies and the public sector
On 1 September 2025, the Independent Whistleblower Protection Authority (A.A.I), established by Spanish Law 2/2023, which transposes Directive (EU) 2019/1937, began its functions. The A.A.I. will manage the external state channel, support whistleblowers, and will be able to apply penalties for non-compliance
The Law requires companies with 50 or more employees, entities in regulated sectors, as well as political parties, trade unions, and business organisations with their foundations, to implement a confidential and operational Internal Reporting System (Sistema interno de información, or SII).
Failure to comply with these obligations may constitute a very serious offence, with fines of up to €1,000,000 for legal persons, in addition to the potential prohibition from entering into procurement procedures with the public sector or obtaining subsidies.
In this context, companies must review and consolidate their internal channels, appoint responsible individuals, and ensure their effective functioning, minimising legal and reputational risks.
