EU Whistleblower Directive transposition took longer than expected

EU Whistleblower Directive transposition delays stretched to almost three years. The deadline was 17 December 2021. Two of 27 member states met it: Denmark and Sweden. Poland closed the list on 25 September 2024, 1,013 days late. The dates come from our 2026 report on the EU Whistleblower Directive, which compares all 27 national laws. Here is the full timeline.

What was the deadline to transpose the directive?

Directive 2019/1937 gave member states until 17 December 2021 to pass a national law. Mid-sized private firms, 50 to 249 workers, got extra time, until 17 December 2023. Only Denmark and Sweden made the first date. Nobody was early. The European Commission opened infringement cases against most of the 25 states that missed it.

A directive binds governments, not companies. A worker is protected only once a national law exists. We explain how that works in why the EU created the Whistleblower Directive.

"2 of 27 member states transposed on time, Denmark and Sweden, both on 17 December 2021. Nobody was early."
WeMoral, 2026 Report on Whistleblower Directive Transposition Across the EU, p. 4

Which countries transposed the directive late, and by how much?

Every member state except Denmark and Sweden missed the deadline. Malta came closest, seven days late. Cyprus and Latvia followed at 49 days. At the other end, Estonia took 989 days and Poland 1,013. The average member state was 380 days late, more than a year.

Source: WeMoral, 2026 Report on Whistleblower Directive Transposition Across the EU, p. 6. Belgium is dated on its private-sector law; its eight instruments span 1 September 2022 to 18 January 2024.

Denmark and Sweden made it look easy. Both acts took effect on the deadline day itself. Their laws are covered in the Danish and Swedish whistleblower law posts. The table below gives every country's date and delay.

Source: WeMoral, 2026 Report on Whistleblower Directive Transposition Across the EU, p. 6.

Poland closed the list, 1,013 days late

"1,013 days is Poland's delay, the longest in the EU. The average member state was more than a year late."
WeMoral, 2026 Report on Whistleblower Directive Transposition Across the EU, p. 4

Poland's act took effect on 25 September 2024, almost three years past the deadline. By then the directive's own extra time for mid-sized firms had run out. So the Polish law arrived with no phase-in at all. Every obliged employer was caught at once. The full story of that law is in our Polish whistleblower law post.

Estonia was the second-worst case at 989 days. It then pushed the duty for mid-sized private firms back once more, to 1 January 2025. An Estonian company with 100 workers got its channel duty more than a year after its Finnish twin across the gulf.

How did each state transpose, new act or amendment?

Twenty of 27 member states wrote a new dedicated whistleblower act. Six amended a law that predates the directive: France, Ireland, Lithuania, Malta, the Netherlands and Slovakia. Belgium stands alone. It used eight separate instruments, federal laws plus regional decrees and orders.

Source: WeMoral, 2026 Report on Whistleblower Directive Transposition Across the EU, p. 6.

"Belgium needed eight separate laws, decrees and orders to transpose one directive."
WeMoral, 2026 Report on Whistleblower Directive Transposition Across the EU, p. 4

The amendment route explains some odd dates. Malta was only seven days late because it just amended its 2013 act. France folded the directive into its Sapin II law from 2016. Slovakia's base act has run since 1 March 2019, so its 50-worker duty is older than the directive. Ireland amended its Protected Disclosures Act 2014. The Netherlands rebuilt its 2016 act. Where the old structure survived, parts of the directive arrived only half-done. Our report flags each such case for legal review.

Belgium's package spans 1 September 2022 to 18 January 2024. The private-sector law took effect on 15 February 2023. A company operating there has to read federal and regional rules side by side. The Belgian whistleblower law post walks through that layered setup.

Source: WeMoral, 2026 Report on Whistleblower Directive Transposition Across the EU, p. 6.

What did the transposition delay mean for companies?

A directive without a national law leaves companies in limbo. Until each state's own date, there was no national law to follow. The directive spoke only to governments. In the late states, the extra time for mid-sized firms ran out before any national law existed to use it.

The safer path was to build the channel early. The directive's floor was public from 2019: an internal channel, confirmed receipt within seven days, feedback within three months. Firms that set that up before their national law landed had little to change later. What the directive requires, article by article, is in our EU Whistleblower Directive explainer.

27 laws in force, 27 different rulebooks

All 27 laws are now in force, so the delay story is closed. What the late years produced is far from uniform. The national laws differ on fines, on anonymity, on retention, and on who checks compliance. A company that waited for its own law to arrive now has 27 rulebooks to read. The 2026 transposition report puts them side by side, 33 data points per country, with every start date next to the rules that came with it. Check your countries' rows before you build one policy for all of them.