A new business year with new legal obligations, possible penalties, and opportunities and value for your company – Bcnresol

Many companies are about to begin a “new business year” full of changes. Among them, on 1 September 2025 the state-level Independent Whistleblower Protection Authority, A.A.I. (AIPI), will officially begin operating. It is the public body created by Law 2/2023 of 20 February, on the protection of persons who report regulatory infringements and on the fight against corruption.

What is the AIPI?

The Independent Whistleblower Protection Authority (A.A.I. or AIPI) is an independent Spanish public body responsible for applying the whistleblower protection law at national level in order to guarantee the protection of whistleblowers, fight corruption and coordinate with other similar public bodies.

Its main mission and objectives include supervising compliance with Law 2/2023 by the public and private entities bound by it, protecting whistleblowers from workplace, disciplinary or personal retaliation, and monitoring how internal reporting/alert channels (the channels that organisations run themselves) operate.

What role will the AIPI play for entities subject to Law 2/2023?

The A.A.I. (or AIPI) will be able to penalise any public or private entity bound by Law 2/2023 that fails to comply with it.

Which bodies are subject to Law 2/2023 and what does it require?

These are private companies with 50 or more employees, or with fewer than 50 employees but operating in particularly sensitive sectors (financial services, money laundering, transport and product safety, environment, public health, etc.).

They also include all public sector entities, political parties, trade unions, business organisations and foundations that receive or manage public funds.

Under Law 2/2023, all of them must:

• Implement an Internal Information System (SII) that includes an internal reporting channel.
• Appoint a Person Responsible for the Internal Information System (RSII). This person must register with the AIPI before 1 November 2025 (except in autonomous communities that have their own competent body in this area and retain those powers).
• Have policies and procedures for handling the reports received.

What penalties can the A.A.I. impose on these bodies if they fail to comply with Law 2/2023?

The infringements regulated by Law 2/2023 are classified into three categories: minor, serious and very serious.

Both individuals and legal entities can be penalised:

• Individuals: fines between €1,001 and €300,000.
• Legal entities: fines between €100,000 and €1 million.

What are the key dates under the new rules?

Two stand out:

At co-resol they work to create safe environments that promote wellbeing through their ethics alert channel.

A channel that not only helps you comply with current regulations and avoid possible penalties, but also builds an internal culture based on protection and trust, increases employee engagement and wellbeing, and has a positive impact on your company’s reputation.

If you need more information, write to info@bcnresol.com.

• 1 September 2025: the AIPI starts operating and penalties may be imposed from then on.
• 1 November 2025: deadline for registering the Person Responsible for the Internal Information System (RSII) in autonomous communities that do not have their own body with powers to register it.