On 1 September 2025, the Independent Authority for Whistleblower Protection (AIPI or the Authority) became operational. This is an independent administrative authority regulated under Law 2/2023, of 20 February, governing the protection of persons who report regulatory breaches and the fight against corruption.
This same Law establishes the obligation for every body or entity required to have an Internal Reporting System (SII) to appoint a Person Responsible for the System (RSII or the Responsible Person). The RSII is responsible for ensuring the effectiveness of the System and the diligent handling of the reports received.
Entities are also required to notify the Authority of the appointment and removal of the RSII.
The AIPI has published Guide 1/2026 on the notification of the Person Responsible for the Internal Reporting System, which explains who must notify, who may be appointed as Responsible Person, who is competent to appoint the RSII, and how and within what timeframe appointments and removals must be notified.
All entities that are required to have an Internal Reporting System must notify the Authority of the appointment and removal of the Responsible Person. Private-sector entities that have voluntarily implemented an Internal Reporting System, even where they are not legally required to do so, must also make this notification.
The appointment of the RSII must be carried out by the management or governing body and, where a collegiate body is appointed, its composition must be expressly indicated.
The Person Responsible for the System may only be a natural person or a collegiate body that meets the following requirements:
In the case of an RSII who is a natural person: in the private sector, this must be a senior manager who performs their role independently from the management body. Where the size of the entity does not allow for the existence of a senior manager with such independence, a person holding a lower position may be appointed, provided that, in carrying out their RSII functions, they are not subordinate to middle management and report directly to the governing or management body.
In the public sector, a public employee must be appointed, as public employees offer greater guarantees of stability, professionalism and compliance with the principle of legality. As in the private sector, the person must perform their RSII functions independently. Whenever possible, elected officials should be excluded from this function in order to preserve the neutrality of the system.
The person responsible for regulatory compliance within an entity may be appointed as the RSII.
Where a collegiate body is appointed: the number of members may not exceed five, and at least one of them must belong to the entity.
In the private sector, the member of the body to whom the system management functions are delegated must perform their RSII duties with full independence from the management body.
In the public sector, the guarantees required where the RSII is a natural person should be observed by all members of the collegiate body.
In corporate groups, a single RSII may be appointed for the entire group, or one RSII may be appointed for each of the companies comprising the group, subgroup or set of companies. Where a single RSII is appointed for more than one company, each obligated company must submit a separate notification identifying the parent or controlling company.
The notification is made through the online form link and must be accompanied by a copy of the act or resolution of appointment or removal. Where the appointment derives from holding a specific position within the entity, a copy of the act in which that decision was made must be attached. The Guide also recalls that the removal of the RSII must always be reasoned.
The deadline for making the initial notification is two months from the launch of the AIPI electronic office, that is, until 10 April 2026. Subsequent notifications of removals and appointments must be made within 10 business days from the appointment or removal.
