Whistleblowing Flash

Independent Whistleblower Protection Authority now operational: everything you need to Know to appoint your Internal Reporting System Responsible

The Independent Whistleblower Protection Authority (AAI) has been operational since 1 September 2025. This marks a critical milestone for companies required to establish an Internal Reporting System (SII) under Spain’s Whistleblowing Directive transposition, Law 2/2023. These entities now have a two-month window—until 1 November 2025—to notify the AAI of the appointment of their Internal Reporting System Responsible.

While the online platform for registering the Responsible —including the specific form for this notification—is not yet available, the AAI anticipates it will be operational by the end of September.

Below, we outline the key points to consider when making this appointment.

How should the notification be made?

• Notifications must be submitted via an online platform (to be enabled by the AAI).
• The AAI will require the formal appointment document for the Responsible and proof of representation for the individual submitting the registration, who may be the Responsible themselves or an authorised representative.

What notifications are required?

• You must notify the AAI of appointments, as well as terminations and their reasons.
• Changes to the Responsible’ s role must be communicated within 10 business days (starting from 1 November 2025).

What profile and requirements should the SII Responsible meet?

• The role can be assumed by the compliance officer or integrity policies officer, if such a position already exists within the organisation.
• The Responsible must be formally appointed by the organisation’s governing or administrative body.
• They must have adequate personal and material resources to fulfil their responsibilities.
• Independence and functional autonomy are essential for the role.

What are the Responsible's responsibilities?

• Managing the system and handling reports received through the whistleblowing channel.
• Ensuring the diligent processing of whistleblowing procedures.
• Supervising investigations.
  -Guaranteeing confidentiality and data protection.
• Reporting to the Public Prosecutor’s Office when there are indications of criminal activity.
• Maintaining the logbook of reports.

Why act now?

We remind you that non-compliance with the law can result in significant penalties: fines of up to €1 million for companies and up to €300,000 for individuals, in addition to other sanctions such as disqualification from contracting with the public sector or receiving subsidies.

This is the perfect opportunity to adopt the SII

If your organisation has not yet implemented an Internal Reporting System, now is the time to act. The appointment of the SII Responsible is a crucial step in ensuring compliance with the law and safeguarding your organisation from potential penalties.

Contact our Simmons & Simmons team today for expert assistance in notifying the AAI of your Of Responsible’ s appointment and implementing your Internal Reporting System. Let us help you navigate this process seamlessly and ensure your organisation is fully compliant.