On September 1, 2025, Spain will officially launch the country’s new independent whistleblower protection authority -Autoridad Independiente de Protección del Informante (AIPI)-. This milestone marks a significant step in the implementation of Law 2/2023, which transposes the EU Whistleblower Directive (2019/1937) and establishes a comprehensive framework for reporting misconduct and protecting whistleblowers.
The activation of the AIPI introduces new compliance obligations for companies operating in Spain, particularly regarding internal reporting systems and the designation of responsible officers.
Key Dates and Immediate Obligations
With the publication of Ministerial Order PJC/908/2025 in the Official State Gazette on August 12, 2025, the AIPI will begin operations on September 1, 2025. From that date, companies subject to Law 2/2023 will have two months to notify the AIPI of the appointment or removal of their internal reporting system officers. The deadline for notification is November 1, 2025.
Although the law does not yet specify the format or platform for these notifications, it is expected that the AIPI will issue operational guidance shortly after its launch.
AIPI’s Mandate and Powers
The AIPI is designed to be a central enforcement and support body with broad powers, including:
- Managing the external reporting channel for whistleblowers.
- Providing protection and support to individuals who report misconduct.
- Initiating and resolving sanctioning procedures for violations of Law 2/2023.
- Issuing circulars and recommendations to guide best practices in whistleblower protection and compliance.
- Developing public sector crime prevention models, which may influence private sector compliance standards.
These functions position the AIPI as a key player in Spain’s anti-corruption and corporate integrity landscape.
The launch of the AIPI signals a shift from voluntary compliance to regulated enforcement. Companies must ensure that:
- Their internal reporting systems are operational, confidential, and accessible.
- A designated officer is in place and properly trained.
- They are prepared to cooperate with the AIPI in investigations or audits.
Failure to comply may result in administrative sanctions and reputational damage. Moreover, ineffective reporting systems could undermine a company’s defense in criminal proceedings under Spain’s corporate criminal liability framework (Article 31 bis of the Spanish Criminal Code).
Looking Ahead: Compliance Beyond the Minimum
The AIPI’s future guidance documents and recommendations are expected to shape the compliance landscape in Spain. These documents may serve as benchmarks for evaluating the effectiveness of internal controls and whistleblower protections.
Companies should view this development not merely as a regulatory hurdle, but as an opportunity to strengthen their corporate ethics culture, enhance risk management, and build stakeholder trust.
Conclusion
Spain’s establishment of the AIPI marks a new chapter in whistleblower protection and corporate compliance. While the regulatory framework is still evolving, the direction is clear: transparency, accountability, and proactive compliance are no longer optional.
Multinational companies operating in Spain should monitor the AIPI’s guidance closely and align their internal policies with emerging standards. In doing so, they will not only mitigate legal risks but also contribute to a more ethical and resilient business environment.
***
