Practical guide
How to draft a whistleblowing report with AI
5 min read · Updated September 2026 · Editorial oversight: Avv. Federico Papa
Legislative Decree 24/2023 comprehensively reformed whistleblowing regulations in Italy, implementing the principles of EU Directive 2019/1937 on the protection of persons reporting breaches of Union law. The internal report, governed by Art. 4 of Legislative Decree 24/2023, represents the primary channel for reporting violations of national or European regulatory provisions learned within a public or private work context. This act not only allows for the disclosure of unlawful conduct, but also activates a rigorous protection framework that guarantees the confidentiality of the reporter and prohibits any form of retaliation. Proper drafting is essential to ensure that the report is declared admissible and can be investigated by the designated officers.
In brief
Legislative Decree 24/2023 regulates internal reports of national and European violations within work contexts, implementing EU Directive 2019/1937. The procedure requires verifying Art. 2 requirements, excluding personal disputes. Drafting, assisted by AI, must include detailed factual descriptions, supporting evidence, and formal confidentiality requests. The channel manager must provide an acknowledgment within 7 days and feedback within 3 months. Failure to meet these deadlines permits external reporting to ANAC. Articles 17, 18, and 19 establish a protection framework against retaliation and ensure identity confidentiality for employees, collaborators, and professionals.
The steps
- 1.
Verification of objective and subjective requirements
The professional must verify that the subject of the report falls within the scope of violations provided for under Art. 2 of Legislative Decree 24/2023, excluding purely personal disputes or matters concerning individual employment contracts. It is also necessary to confirm that the reporter belongs to protected categories, such as employees, collaborators, freelancers, or interns working for the entity. The existence of a work context as the source of information is an indispensable prerequisite for applying statutory protections; without these requirements, the report risks being handled as a common complaint lacking special legal guarantees.
- 2.
Identification of the channel and the manager
The report must be addressed to the specific internal person or office designated by the entity pursuant to Art. 4 of Legislative Decree 24/2023 to manage reports. Before submission, it is necessary to consult the published corporate procedure to identify the permitted technical methods, such as dedicated IT platforms, hotlines, or voice messaging systems. Submitting the report to an unauthorized department, such as a direct superior or human resources lacking a specific mandate, could compromise confidentiality. The channel manager is the sole recipient authorized to receive and process the disclosure while ensuring strict confidentiality.
- 3.
Detailed description of the unlawful facts
The narrative must be precise and contain all elements necessary to allow the channel manager to conduct the relevant checks. It is essential to specify the time period, the place where the violation occurred, and the identities of the persons involved, including any witnesses. It is recommended to distinguish clearly between facts directly witnessed and information reported by third parties, thereby facilitating the assessment of credibility. A vague or generic description hinders investigative scrutiny and may lead to immediate dismissal due to a lack of detailed facts.
- 4.
Provision of supporting evidence
The reporter must attach all relevant documentation to corroborate the alleged facts, such as emails, invoices, accounting records, or technical reports. If the reporter does not physically possess the documents, precise instructions must be provided on where to locate them or which corporate databases the entity should query. Pursuant to Art. 17, paragraph 2, of Legislative Decree 24/2023, a legal presumption of retaliation applies with a reversal of the burden of proof onto the entity; nevertheless, the report must still be based on reasonable grounds rather than unfounded allegations. Solid supporting evidence significantly increases the likelihood that the entity will take prompt corrective action.
- 5.
Formulation of the request for protection
The report should include an express clause requesting confidentiality regarding the reporter's identity and any other information from which it might be inferred, directly or indirectly. The protection framework against direct or indirect retaliation, governed by Articles 17, 18, and 19 of Legislative Decree 24/2023, applies automatically by law where statutory requirements are met. It is also advisable to specify whether the reporter consents to the disclosure of their identity strictly in cases provided for by law, such as when indispensable for the defense of the accused party. This section serves as a formal notice against the improper processing of the reporter's personal data.
- 6.
Monitoring feedback deadlines
Following submission, the professional must ensure receipt of the acknowledgement within seven days from the channel manager. Within three months of that notice, the entity is required by law to provide feedback on the measures planned or adopted to follow up on the report. Exceeding these deadlines without communication from the entity entitles the reporter to proceed with an external report to ANAC. Maintaining an accurate timeline tracker is essential to safeguard the right to resort to competent authorities in the event of corporate inertia.
Legal basis: Art. 2 D.Lgs. 24/2023Art. 4 D.Lgs. 24/2023Art. 15 D.Lgs. 24/2023Artt. 17, 18, 19 D.Lgs. 24/2023
The template structure
The standard sections that make up the document. The full template can be opened and completed directly on edit.legal.
Recipient of the report
Person or office managing the internal channel to which the report is addressed.
Reporter details and context
Identity of the reporter (or anonymous report) and work context in which the facts were learned.
Description of the violation
Reported facts, times, places, and subjects involved in the unlawful conduct.
Supporting elements and clues
Documents, data, or known circumstances that corroborate the report.
Request for protection and confidentiality
Request for handling the case and applying the protections and confidentiality under D.Lgs. 24/2023.
Place, date, signature
Place, date, and possible signature of the reporter.
Mistakes to avoid
- Including complaints exclusively related to wage claims or personal conflicts with colleagues, which are excluded from whistleblowing regulations.
- Transmitting the report to offices not designated to manage the internal channel, thereby losing the legal guarantees of confidentiality.
- Providing a generic description of the facts without temporal or documentary evidence, leading to inadmissibility for lack of specificity.
- Publicly disclosing the contents of the report outside the strict conditions set out in Art. 15 of Legislative Decree 24/2023.
Frequently asked questions
What are the maximum response times for the entity?
The entity must send an acknowledgement of receipt within 7 days and a substantive response within 3 months. If these deadlines expire without a response, the reporter can activate the external reporting channel managed by ANAC.
Is it possible to submit a report anonymously?
Yes, anonymous reports are permitted if adequately detailed; however, protections against retaliation only apply if the reporter is later identified. Many companies use encrypted platforms that allow the manager to communicate with the reporter without knowing their identity.
What does the reporter risk if the report proves to be unfounded?
If the reporter acted in good faith based on reasonable grounds, protection remains even if the alleged facts are not confirmed. However, if criminal liability for slander or defamation or civil liability for intentional misconduct or gross negligence is established, protections are forfeited and disciplinary sanctions may be imposed.
What edit.legal automates
- —Automatic verification of consistency between the factual description and violation categories under Art. 2 D.Lgs. 24/2023.
- —Assisted drafting of confidentiality and data protection clauses with a dynamic editor for reporter protection.
- —Automated calculation of limitation periods and deadlines for mandatory feedback from the receiving entity.
Put edit.legal to the test on actual cases
Try edit.legal for free on an active case. No credit card required.
Try edit.legal for freeThis guide is for informational purposes only and does not constitute legal advice for your specific case.