Business obligations, registers and licences · Czechia and Slovakia
Whistleblowing and internal reporting systems
Businesses with at least 50 employees must have an internal system for reporting wrongdoing, with a responsible person, time limits and whistleblower protection. We implement it to meet Slovak and Czech law while remaining practical: clear procedures for real situations without unnecessary bureaucracy. We can also take on investigations as an external person.
- Lawyer admitted to both the Czech and Slovak Bars
- External responsible person service also available
- Prices agreed upfront
What we'll do for you
A system that exists only on paper, that nobody knows or uses, will not withstand inspection. We implement a working system so that when a report arrives, you know exactly what to do and by when.
Select an item to see the details.
-
Assessing obligations
We establish whether you are an obliged entity under Slovak Act No. 54/2019 Z. z., Czech Act No. 171/2023 Sb. or both, and exactly what applies to you.
-
Internal policy
A policy covering all required elements — reporting methods, investigation, confidentiality, record-keeping and measures against retaliation.
-
Reporting channel
We establish practical methods for receiving reports in writing, electronically and in person, with at least one channel continuously available and the whistleblower's identity protected.
-
Responsible person
We train your internal responsible person or take on their duties externally to the extent permitted by law, with the benefit of a lawyer's independence and professional confidentiality.
-
Investigating reports
We acknowledge receipt and investigate within statutory time limits, propose measures and prepare materials for management, including sensitive cases that may lead to a criminal complaint or termination of employment.
-
Training
Short, clear training for management and employees so people understand and trust the system.
Deliverablea functioning reporting system — internal policy, reporting channel and arrangements for investigating reports within statutory time limits
How it works
Does this process fit your matter? Describe it to the attorney →
- Assessmentday 0
We establish your obligations in Slovakia and the Czech Republic and propose the scope of the system.
- Implementing the system
We prepare the policy and documentation, establish the reporting channel and explain the procedure to employees.
- Operation
The system operates internally with our support, or with us as the external person receiving and investigating reports.
- Maintenance and reporting
Records, time limits and updates when the law or company structure changes.
No-obligation enquiry
Ready to start?
Send us an enquiry. We usually reply within 24 hours with a price confirmation and next steps. The first 30-minute consultation is free and commits you to nothing.
- 1Send your enquiry via this form
- 2Usually within 24 h you get a price confirmation and plan
- 3We start work only after your approval
Not keen on calls or email? Message us on WhatsApp →
Prefer to book a time right away? Book a consultation →
Or email us about this matter.
What clients ask
Didn’t find your question? Ask us directly →
When must a business have a reporting system?
In Slovakia, employers with at least 50 employees must have one, as must employers in selected sectors regardless of employee numbers, including financial services, transport safety and the environment. Public authorities are covered from 5 employees (§ 10(1) of Act No. 54/2019 Z. z.). In the Czech Republic, obliged entities include an employer with at least 50 employees as at 1 January, unless it is an obliged entity under Czech anti-money laundering law subject to a special regime (§ 8(1) of Act No. 171/2023 Sb.). This AML exception often causes confusion: a company that believes it is outside the requirement may fall within it through another route. We assess precisely whether and to what extent it applies to you.
Can an external company investigate reports?
Yes. Slovak law expressly allows receipt and acknowledgment of reports to be outsourced by contract, and employers with fewer than 250 employees, other than public authorities, may also outsource the investigation itself (§ 10(2) of Act No. 54/2019 Z. z.). Czech law permits another person to operate the internal reporting system, without affecting the obliged entity's responsibility (§ 8(2) of Act No. 171/2023 Sb.). For groups, Czech obliged entities with no more than 249 employees may share a system or use one established by another obliged entity (§ 8(3)), allowing one reporting line to serve several companies. As lawyers, we add statutory confidentiality and independence from internal company relationships.
What time limits apply to a report?
In Slovakia, receipt must be acknowledged within 7 days and the investigation outcome generally communicated within 90 days of acknowledgment (§ 10(6) and (8) of Act No. 54/2019 Z. z.). In the Czech Republic, acknowledgment is also due within 7 days, but assessment of the report's merits has a stricter baseline of 30 days from receipt. In factually or legally complex cases, this can be extended by 30 days at a time, no more than twice, and the whistleblower must be informed in writing before the period expires (§ 12(2) and (3) of Act No. 171/2023 Sb.). Businesses operating in both countries therefore cannot simply copy the Slovak process into the Czech Republic: the Czech baseline is three times shorter. We configure the system to track time limits by country.
Must we also accept anonymous reports?
The two countries must be distinguished. The Slovak system also provides for anonymous reports. Czech Act No. 171/2023 Sb. does not generally require them to be accepted or recorded under the statutory regime; a business may establish a broader voluntary channel. If the identity of an initially anonymous whistleblower becomes known to a person who could expose them to retaliation, protection under § 4(3) applies. We assess the separate AML regime independently. The internal policy will set the rules for receiving and investigating reports.
An employee reported a problem and management wants to dismiss them. What now?
Care is needed: whistleblowers are protected against retaliation, and penalising someone for reporting can be costly. Obtain a legal assessment before taking employment action. We help distinguish legitimate employment grounds from prohibited retaliation.
How much do implementation and administration cost?
Implementation is a one-off charge based on the company's size. The external person service is usually covered by a monthly retainer. We confirm both prices in advance and adhere to what we have agreed.
Legal Q&A
Common questions on this topic
-
Do we need an internal whistleblowing system?
Yes, if you employ at least 50 people; public authorities are covered from five employees, and employers in financial services, transport safety or environmental services regardless of size. The system requires a designated responsible person, published reporting channels, an internal policy and a register of reports. Receipt must be acknowledged within seven days and investigation results communicated within 90 days. The Whistleblower Protection Office may impose a fine of up to EUR 50,000, or EUR 100,000 for employers with at least 250 employees.
Read the answer -
How long must whistleblowing reports be kept and who may have access to them?
In Slovakia an employer must keep a register of reports for three years from their delivery; in the Czech Republic the responsible person keeps the report and related documents for five years from receipt. Access should be limited to the person who receives and examines reports; the whistleblower's identity is not disclosed even to management without their written consent. Reports contain the personal data of several people, so the manner of processing must be set out in an internal policy and aligned with the GDPR.
Read the answer -
Can an employee bypass our reporting channel and go straight to an authority or the media?
To an authority yes; to the media only if certain conditions are met. Both Slovak and Czech law protect a whistleblower who approaches the competent authority directly, without first using the company's internal system. Where information is disclosed publicly, for instance in the media, protection is tied to conditions: the internal or official route produced no result, there is an immediate threat to the public interest, or retaliation is feared. A company cannot prohibit employees from approaching the authorities.
Read the answer
Further reading
Two responsible persons: the DPO under the GDPR and the responsible person for whistleblowing
Slovak law knows two functions bearing the same name: the responsible person under the GDPR and the responsible person under the Whistleblower Protection Act. This article compares their tasks, independence and requirements, and explains when the same individual or external provider may perform both. For companies that must have one or both functions.
Read more →
Dismissing or reassigning a whistleblower: when it amounts to retaliation and what the Office can do
An employee has made a report and the company is shortly afterwards considering dismissal, reassignment or a reduction in pay. In such cases the Slovak Whistleblower Protection Act leaves it to the employer to prove before the Office that the step is unconnected with the report, and gives the Office tools to halt it. This article is for employers in Slovakia and the Czech Republic who need to take a legitimate personnel step and do not want it to look like retaliation.
Read more →
When an AI user becomes its provider: roles under the AI Act
The AI Act allocates obligations by role, not by who wrote the code. A company that has a chatbot built on someone else's model, sells an AI product under its own brand or uses a general-purpose tool for a sensitive purpose may become a provider with all the attendant obligations. This article explains where the line runs and what follows from it for supplier contracts.
Read more →