D.Lgs. 24/2023: The 50-Employee Rule and Integration with Model 231

Legislative Decree No. 24 of 10 March 2023 — implementing EU Directive 2019/1937 — introduced into the Italian legal system a structured regulatory framework for whistleblower protection. For Italian companies, the initial question is often the same: are we subject to the obligation? The answer depends on two distinct criteria that sometimes overlap: the 50-employee size threshold and the adoption of an Organizational Model under D.Lgs. 231/2001.

In this guide, we analyze both criteria, clarifying scope of application, calculation methods, and practical implications for Legal, HR, and Compliance functions. For the wider European baseline, start with EU Whistleblowing Directive by Country.

This guide is general information for software and process evaluation, not legal advice. Country rules change and should be checked with qualified local counsel before rollout.

Scope of Application Under D.Lgs. 24/2023

The decree applies to all entities in both the public and private sectors that are required to activate internal reporting channels, as provided by Art. 4 of D.Lgs. 24/2023. Protection extends to a broad range of individuals: not only employees, but also freelancers, consultants, volunteers, shareholders, facilitators, and persons connected to the reporter up to the fourth degree of kinship.

It is essential to understand that protection applies even to reports made before the employment relationship was established (selection phase, probationary period) or after its termination, provided the information was acquired during the relationship itself (Art. 3(4), D.Lgs. 24/2023).

The 50-Employee Threshold: Who Is Obligated

For the private sector, the obligation to establish internal reporting channels is triggered when the entity has averaged at least 50 employees in the previous year, under permanent or fixed-term contracts.

Companies with an average of 50 to 249 workers had until 17 December 2023 to comply. Companies with 250 or more employees were already subject to the requirement from 15 July 2023.

Teams comparing proportionate programmes for smaller organisations may also find Whistleblowing for Small Businesses useful alongside this threshold analysis.

Calculation Method

The threshold refers to the average number of employees in the previous year. For operational calculation — including the computation of part-time contracts and full-time equivalent units — it is advisable to verify the applicable criteria with a labor consultant or internal legal counsel. Continuous and coordinated collaborators and holders of relationships other than employment do not count toward the threshold — although they are still among the protected persons who may use the reporting channels.

Channel Sharing for 50–249 Employees

Private entities with an average of no more than 249 workers may share the internal reporting channel and its management among themselves (Art. 4(4), D.Lgs. 24/2023). When sharing, a single infrastructure with autonomous sub-channels for each entity must be used, and each entity must still appoint its own channel manager. Entities sharing the channel act as joint controllers under Art. 26 GDPR and must define their respective responsibilities through an internal agreement.

For corporate groups, sharing is permitted only if each company in the group has up to 249 workers. Above this threshold, sharing is not permitted, but outsourcing to an external provider remains possible.

Model 231: The Obligation That Applies Regardless of Size

D.Lgs. 24/2023 creates a crucial intersection with D.Lgs. 231/2001. Art. 6(2-bis) of D.Lgs. 231/2001 — introduced by the whistleblowing decree — provides that the Organizational Model (MOG 231) must include an internal reporting channel that complies with the requirements of D.Lgs. 24/2023.

This means that any entity that has adopted a Model 231 is required to have a compliant reporting channel, even if it has fewer than 50 employees and would therefore not fall under the size threshold. Upgrading the Model is not optional: it is a requirement for the model's effectiveness for the purpose of exemption from administrative liability of entities. Note that for sub-threshold entities with a MOG 231, the scope of reportable violations is typically tied to conduct relevant under D.Lgs. 231/2001 and the model's related prescriptions; it is advisable to assess with internal legal counsel the scope of reportable categories in relation to the company's specific profile.

What the Model 231 Must Include

According to the ANAC Guidelines No. 1 (Resolution No. 478 of 26 November 2025), the Model must:

• Describe the available internal and external channels
• Define the reportable violations
• Explain the protections for reporters and how they can be activated
• Regulate the receipt and management of reports, including oral reports
• Reference any contract with an external channel manager
• Provide an updated sanctioning system to penalize violations of whistleblowing rules

Policy wording alone is not enough: the operational process behind the channel still needs to match what the Model describes. For a broader policy framing, see Whistleblowing Policy Explained.

The Role of the Supervisory Body

The Supervisory Body (OdV — Organismo di Vigilanza) may be designated as the channel manager. In this case, it receives reports and can exercise its supervisory functions under D.Lgs. 231/2001. If the channel is managed by another internal or external party, the organizational act must regulate the coordination between the OdV and the channel manager.

ANAC recommends adopting a single internal reporting channel rather than separate channels, to ensure consistency and simplify management.

Internal vs. External Reporting: When to Approach ANAC

D.Lgs. 24/2023 establishes a hierarchy among reporting pathways. Internal reporting represents the primary channel: the reporter should first turn to the entity's internal channel when it is active and compliant. External reporting to ANAC is a legitimate alternative only in specifically prescribed cases (Art. 6, D.Lgs. 24/2023):

• The internal channel is not active or does not comply with legal requirements
• The reporter has already made an internal report and has not received feedback within the required timelines
• There is a well-founded fear of retaliation if the report is made internally
• There is imminent danger or evidence of serious harm to the public interest
• The report concerns unlawful conduct falling within ANAC's competence for the external channel

Public disclosure — the dissemination of information about violations through the media or publicly accessible platforms — is further subject to more restrictive conditions (Art. 15, D.Lgs. 24/2023): the reporter must have first made an internal or external report, or there must be imminent danger to the public interest or a risk of evidence destruction.

For companies, the message is clear: a well-designed and well-managed internal channel significantly reduces the risk that reporters turn directly to ANAC or the media. This not only mitigates sanction exposure but allows the entity to manage the report in a controlled manner and demonstrate its organizational diligence.

Practical Implementation Challenges

Compliance with D.Lgs. 24/2023 presents operational challenges that go beyond merely adopting a channel. Larger organizations often undergo an organizational review process involving multiple internal functions.

Cross-Functional Coordination

Legal, HR, IT, and Compliance must collaborate to define the channel architecture. Legal is involved in updating Model 231 and drafting the organizational act; IT in selecting and configuring the technology platform; HR in internal communication and training; Compliance in continuous monitoring and management reporting. The absence of structured coordination often leads to fragmented solutions that do not meet ANAC requirements.

Change Management

Introducing a reporting channel entails a cultural shift. Employees must be informed of the channel's existence, the protections available, and how to access it. Internal communication must be clear, transparent, and ongoing: a single launch email is not enough. Companies that invest in a structured communication strategy register a significantly higher channel utilization rate and greater trust in the system.

Costs and Resources

Implementing a compliant channel requires investment in technology, training, and legal counsel. For SMEs with 50–249 employees, the cost can represent a significant challenge. Channel sharing among multiple entities or outsourcing to an external provider can reduce costs, but requires careful assessment of confidentiality guarantees and GDPR roles.

When evaluating tooling, many teams also revisit How to Choose an EU-Compliant Whistleblowing Platform and How to Build Anonymous Reporting Channels at Work.

Common Mistakes and How to Avoid Them

Experience gained from implementing D.Lgs. 24/2023 reveals several recurring mistakes:

1. Using Corporate Email as the Reporting Channel

Email does not guarantee the confidentiality of the reporter's identity. Yet many companies still use a generic email address (e.g., whistleblowing@company.com) as their sole channel. This exposes the entity to ANAC sanctions and confidentiality breaches. For the fuller channel configuration view, see ANAC internal reporting channels: written and oral requirements.

2. Not Providing the Oral Modality

Some companies implement only written reporting, neglecting the obligation to also provide the oral form. ANAC is explicit: both modalities are mandatory.

3. Not Updating the Sanctioning System

The Model 231 or organizational act must provide disciplinary sanctions for those who breach confidentiality or commit retaliatory acts. Many companies adopt the channel but do not update the sanctioning system, rendering the protections ineffective.

4. Not Documenting the Process

A channel without documentation is a channel that cannot demonstrate its own compliance. Every phase — receipt, acknowledgement, management, feedback, deletion — must be tracked and documented. For auditability expectations, see the EU-compliant whistleblowing software audit trail checklist.

5. Underestimating the DPIA

The DPIA is not a formal exercise: it is a risk analysis tool that should guide technical and organizational choices. Skipping the DPIA or reducing it to a box-ticking exercise means missing the opportunity to identify and mitigate the specific risks of your channel. For the fuller privacy and anti-retaliation view, see whistleblowing privacy, Garante guidance, and anti-retaliation. Privacy buyers often also start with GDPR Questions to Ask Before Buying Whistleblowing Software.

Sanctions for Non-Compliance

The consequences of non-compliance are concrete. Art. 21 of D.Lgs. 24/2023 provides for administrative fines of €10,000 to €50,000 for:

• Failure to establish reporting channels
• Failure to adopt management procedures
• Procedures that do not comply with Articles 4 and 5 of the decree

The same sanction applies in case of breach of confidentiality of the reporter's identity or retaliatory acts. A reporter acting with malice or gross negligence may be fined between €500 and €2,500.

Operational Compliance Checklist

• Verify the average number of employees in the previous year
• Verify whether a Model 231 has been adopted (if yes, the obligation applies regardless of the threshold)
• Integrate the reporting channel into the Model 231 or an organizational act
• Designate the channel manager (OdV, autonomous internal unit, or external provider)
• Define the sanctioning system for violations and retaliation
• Ensure both reporting modalities (written and oral)
• Prepare the DPIA and privacy notice
• Document the receipt, management, and feedback process

Final Take

Compliance with D.Lgs. 24/2023 is not a formal exercise: it is a governance requirement that protects the company from fines up to €50,000 and strengthens the effectiveness of Model 231.

For employers, the key question is whether the channel and handling model can stand up under real operating conditions — including OdV coordination, oral reporting, and documented follow-up — not just whether a reporting route technically exists.

Once the obligation applies, configure the channel against ANAC written and oral requirements. If you are comparing Italy with other EU markets, continue with EU Whistleblowing Directive by Country, or review peer implementations in Germany and the Netherlands.

Disclosurely supports anonymous, secure, and documentable reporting channels designed around ANAC and GDPR expectations. Request a demo if you want to see how that workflow operates in practice.