Six Years, Three Reports, One Verdict: Progress on Paper, Problems in Practice

Six Years, Three Reports, One Verdict: Progress on

Date published: 30 April 2026
Authored by: Ida Nowers

A series of new reports, published within weeks of each other, deliver the most comprehensive picture yet on whether the European Union’s “groundbreaking” whistleblowing law, the EU Directive on the protection of persons who report Union law (Dir(EU)2019/1937 is actually working to protect whistleblowers.

The Directive was designed to harmonise a high level of protection for whistleblowers who report breaches of Union law across the bloc, ensuring that anyone who reports wrongdoing in any member state benefits from confidential reporting channels, robust safeguards – including interim relief measures and full compensation.

The headline is: Six years on, that ambition has only been half-met. Whilst every EU country now has now a adopted a new law to ‘transpose’ the Directive’s requirements into its national legal system (fewer than half did prior) this new flurry of analysis show an uncomfortable pattern emerging: Protection is not only uneven, but there are also serious weaknesses in each the 27 jurisdictions.

What the Directive was supposed to do

Adopted in 2019 after a string of cross-border scandals – most notably “LuxLeaks” – the Directive set common minimum standards for protecting people who report wrongdoing. It aimed high – with protection of reporting persons wider than workers and introduced significant obligations on public and private sectors organisation to establish impartial and confidential reporting channels and required both follow up and feedback on those reports, with requirements for effective and dissuasive penalties for breaches. Critically, it bans retaliation, prohibits gag orders, and reverses the burden of proof so that employers – not whistleblowers – must show that adverse actions weren’t reprisal (a key known loophole of many whistleblowing laws worldwide). In terms of international best practice principles, it fared well (not perfect) – scoring joint first place (16.5/20) with Australia and the US. Hopes were high yet civil society knew they had to play close attention – as the devil was in the detail.

What we have known until now

Member states had until 17 December 2021 to transpose the Directive into national law. Only four met the deadline. Two (Estonia and Poland) were three years late. The European Commission opened infringement proceedings against 24 member states and ultimately referred six to the Court of Justice of the EU, which fined Poland, the Czech Republic, Hungary, Luxembourg and Estonia and Germany over 3.8 million Euros for delays.

In late 2023, Transparency International published the first systematic civil-society assessment of how member states had transposed the Directive.

Of the 20 countries reviewed, 19 failed to meet minimum Directive standards in at least one of four key areas – the right to report directly to authorities, access to remedies and full compensation, access to free and accessible advice, and effective penalties for those violating whistleblower protection. None met best practice in all of the additional areas examined.

Even this early in the day, credible voices were calling on all EU governments to review and amend their legislation.

The European Commission’s own conformity assessment followed, published in July 2024, and came to remarkably similar conclusions. The 11-page report assessed transposition efforts and confirmed that, while every state had implemented the Directive’s main provisions, the quality of transposition fell short across multiple critical areas.

The Commission is now in the middle of a deeper, mandatory evaluation under Article 27(3) of the Directive. The public consultation just closed with the final evaluation report expected by the end of the year. That evaluation could open the door to legislative revision – but in the current political climate in Brussels, with a changed Commission and a broader EU push to reduce administrative burdens, civil society has warned that “simplification” risks could see protections weakened rather than strengthened.

And reforms have begun: Bulgaria, Greece, Ireland, Latvia and Romania have already made amendments to their national frameworks following initial transposition, and Belgium, Slovakia and the Netherlands are considering further reforms. Several of these amendments have been driven directly by feedback from the European Commission or linked to conditionality under EU Recovery and Resilience funding – evidence that EU-level pressure can shift national policy. However, the picture is therefore not static: laws are being tested, found wanting, and in some cases improved. But this momentum is also uneven.

A floor – maybe, but a long way short of harmonisation

So this is where things stood: every country had a law, the Commission and civil society had both flagged systemic weaknesses, and a high-stakes evaluation was underway.

What the new wave of reports now adds to this picture is the most detailed evidence yet of where the Directive is actually breaking down – and what needs to happen next.

The picture they paint is pretty consistent and fairly concerning. The Directive has raised the floor of whistleblower protection across the Union (and set a standard outside of Europe too) – yet has not delivered on what it was hoped it would achieve.

Three new reports, three different lenses

Three new reports, published within weeks of each other in early 2026, now make this picture concrete.

Transparency International and the EU Whistleblowing Monitor have tracked how the law is actually functioning across the Union, drawing on emerging case law, national authorities and the work of civil society on the ground.

The Government Accountability Project and the Whistleblowing International Network – with many of the same national experts – have taken a more systematic approach, scoring all 27 member states against twenty best-practice standards to produce the first comparative ranking of post-transposition compliance.

And the VoiceGuard project takes a third route entirely – interviewing (across six countries) whistleblowers alongside the lawyers, judges and psychologists who support them, to ask what reporting wrongdoing actually feels like under the Directive in practice. Read alongside each other, they show where protection is genuinely working, where it is failing, and what needs to change.

Where it breaks

The first of the new reports comes from Transparency International. The analysis moves beyond legal text to look at how the Directive is functioning in practice – with contributions from 19 national experts across TI Chapters, the Whistleblowing International Network and country editors for the EU Whistleblowing Monitor, drawing on emerging evidence on the ground from case law, civil society monitoring, and evidence of how the various national authorities are actually performing their roles.

Rights on paper, gaps in practice (Transparency International) Read more: How Effective Is Whistleblower Protection in the EU? Trends, gaps and emerging practice across member states Key findings: Significant legal gaps persist – particularly on remedies, where reinstatement is rare and compensation often slow, capped or hard to access The reversal of the burden of proof is widely weakened in practice; many laws reproduce the Directive’s language without ensuring the burden actually shifts to employers Authorities are fragmented and under-resourced – many lack the powers to prevent retaliation or impose meaningful sanctions Penalties vary wildly across member states (from €15 to €1m), are rarely applied, and tend to fall at the lower end when imposed Few formally recognised whistleblowing reports are being processed, suggesting limited awareness, narrow legal interpretation, and restricted access to advice Access to independent advice and support is patchy; civil society fills the gap, but is rarely formally recognised, protected or sustainably funded No member state systematically collects gender-disaggregated data, leaving structural barriers to reporting invisible

The second new report, from the Government Accountability Project (GAP) and the Whistleblowing International Network (WIN), takes a different approach. It scores all 27 member states against twenty best-practice standards, producing the first full comparative ranking of post-transposition compliance across the Union.

No country is fully compliant; the back end is where it falls apart (Government Accountability Project & Whistleblowing International Network) Read more: National Laws under the EU Whistleblower Directive Key findings: Average score: 14.2 / 20 (71.2%) Range: 10 to 18 – no country fully compliant (no country below 10) Strongest areas: Personal scope of protection – 94.4% net compliance (most countries protect former workers, contractors, shareholders and connected persons)Comprehensive retaliation protection 90.7% net compliance (broad prohibitions including against retaliatory litigation / SLAPPs)Ban on gag orders and speech waivers – 88.9% net compliance Weakest areas: ‘Duty speech’ protection (reports made in the course of professional duties) – only 14.8% net compliance, the single weakest indicator across the framework ‘Make-whole’ compensation – 50% net non-compliance, meaning many whistleblowers will still “lose by winning “Interim relief pending proceedings – 44.4% net non-compliance, leaving whistleblowers exposed to severe financial pressure during prolonged litigation Personal liability for reprisals – 44.4% net non-compliance The pattern seems pretty consistent: countries perform well on the front end (defining who is covered, prohibiting retaliation, banning gag orders) and badly on the back end (the mechanisms that determine whether a whistleblower can actually win a case and be made whole)

The third new report, from the VoiceGuard project, takes yet another angle – in-depth interviews with 16 whistleblowers and 32 supporting professionals (lawyers, judges, psychologists, civil society representatives – across six member states. It is the first major qualitative study of what reporting wrongdoing actually feels like under the Directive.

Compliance theatre and the cost of speaking up (VoiceGuard) Read more: Needs Analysis: Assessing the Challenges in Whistleblower Protection Key findings: Across the EU, there is a significant gap between the promise of whistleblower protection and the lived reality of those who report In the cases examined: Internal reporting channels often function as “compliance theatre” — systems that exist on paper but disappear reports into a “black hole” of institutional silence Retaliation is rarely straightforward dismissal; it is a calculated strategy of professional and psychological destruction Organisations’ first impulse is typically not to investigate the report but to discredit the person Subtle retaliation (mobbing, gaslighting, social isolation, blacklisting) sits in a legislative void – employment law tends to focus on more overt acts like dismissal The protection system depends on after-the-fact remedies, but there is a “temporal mismatch” (retaliation is immediate while justice is slow, leaving legal victories largely symbolic) Whistleblowers face an “absolute inequality of arms” – court-awarded legal costs are often capped below market rates, producing a net financial loss even when they win The psychological toll is severe – stress, anxiety, antidepressants, in some cases credible fear for physical safety; experts cited research linking workplace bullying to a significant share of adult suicides Interestingly, the report highlights a ‘Luxembourg puzzle’ where it stood out as a positive outlier: 80% of Luxembourgish respondents felt their report was handled professionally and 60% felt protected from retaliation, compared to 12.5% across the five other member states surveyed – suggesting effective protection is achievable, and the widespread failure elsewhere reflects local cultural resistance rather than an unfixable flaw in the law itself.

What needs to happen next

The three reports converge on a remarkably similar reform agenda, yet each comes at it from a different angle, and each adds something the others don’t:

Transparency International Ensure full and effective reversal of the burden of proof in retaliation cases Effective remedies should ensure annulment of retaliation, reinstatement and full compensation for all losses Effective, proportionate and dissuasive sanctions for all violations – hindering reporting, retaliation, vexatious proceedings, breach of confidentiality Authorities need clear mandates, independence, resources, training and coordination Accessible reporting procedures, proper follow-up, and sanctions for non-compliance Independent confidential advice, accessible legal aid, broader support, including via civil society Recognise and protect civil society support roles; provide sustainable funding Comprehensive gender-disaggregated data on implementation and enforcement Commission to issue interpretive guidance, use infringement procedures, and integrate whistleblowing into the Rule of Law Cycle

GAP/WIN Implement a true reverse burden – require perpetrators to prove the action was “not linked in any way” to whistleblowing Mandatory full compensation for economic and non-economic harm; restoration of professional status Personal liability for managers; significantly higher financial and criminal sanctions; timely interim relief during proceedings Independence safeguards, conflict-of-interest protections, anti-retaliation protection for channel staff Channel structures must be free of conflicts of interest; protection should attach during preparatory conduct, not just at formal report Coverage or reimbursement of legal fees and expert costs; protection extended to facilitators and legal counsel Searchable databases of cases and outcomes; published aggregate data Criteria for assessing penalty effectiveness across member states Commission to take infringement actions and issue clear interpretive guidance

VoiceGuard Reorient the system toward ex-ante prevention: preliminary injunctions, statutory bars on retaliatory action, and authorities empowered to nullify retaliation immediately Introduce state-backed financial support to cover legal costs and living expenses during proceedings Specialised, pre-emptive psychological support delivered through accredited networks Address the “executive power deficit”: give authorities real sanctioning powers, not just advisory ones The state should formally recognise and subsidise specialised NGOs rather than build new agencies A trained network of lawyers, psychologists and civil society support able to act before, during and after a report

A few things stand out from reading the three columns side by side. All three converge on the same core diagnosis: the front-end of the Directive – who is covered, what counts as retaliation is largely in place; the back-end – remedies, enforcement, support – is not. Where they diverge is in emphasis. Transparency International and GAP & WIN press hardest on legislative and institutional fixes. The VoiceGuard project insists that even a perfectly drafted law will fail if whistleblowers cannot afford to wait years for it to work. A system that depends on after-the-fact remedies cannot deliver what the Directive promised by the time the law catches up, the career is already over.

The view from outside the EU – a fourth recent report

The same week these three reports landed, Transparency International published a fourth piece of analysis, looking outward to the ten EU candidate and potential candidate countries that must align with the Directive as part of accession. The findings are sobering. Of the seven enlargement countries with whistleblower protection laws assessed, only one – Albania, after recent reforms – meets the Directive’s requirements in the four core areas examined. The other six (Kosovo, Moldova, Montenegro, North Macedonia, Serbia and Ukraine) fall short. Three other candidates – Bosnia and Herzegovina, Georgia and Türkiye – lack comprehensive whistleblower legislation altogether.

Notably, some of the failings flagged in the candidate countries – restrictive burden-of-proof rules, missing penalties, weak remedies – are not far from those documented in current EU member states. The accession framework appears to ask candidates to clear a bar that current members do not consistently clear themselves.

Six years after adoption, the Directive has done its first job. It established that the EU treats whistleblower protection as a serious infrastructure for democratic governance. The second job – making that protection real for the people who actually rely on it – is where the work now sits.

With the Commission’s evaluation underway and revision on the horizon, the question is whether the next chapter will be one of strengthened delivery or quiet dilution. Whilst there is real concern that opening up the text of the landmark Directive might do more harm than good, there is clearly a long way to go to ensure whistleblower protection is just that; and whether the Directive’s second decade does better than its first now depends on what the Commission and member states choose to do with this new growing evidence.

Visit the EU Whistleblowing Monitor.