Interview with the President of the Spanish Whistleblower Protection Authority: The challenge of cultural change in organisations

With the recent establishment of Spain’s Independent Authority for the Protection of Whistleblowers (AIPI) and the official start of its activities on September 1, a new chapter begins in the consolidation of the EU Whistleblower Directive and Spain’s Law 2/2023. At Whistlelink, we had the opportunity to talk with the Authority’s president, Professor Manuel Villoria, to gain insight on the key challenges and priorities organizations face when implementing this vital framework for organizational integrity.

How will the Authority support companies in complying with the new law?

– At this initial stage, the Authority’s institutional support will focus on training and information. The goal is to become a trusted reference in terms of clear guidance and the dissemination of best practices, helping organisations understand their obligations and encouraging a stronger culture of whistleblower protection.

– We aim to support companies with educational tools that allow them to make informed decisions and move forward in creating safer, more transparent environments. This educational mission will be especially important because many organizations are still unaware of their obligations under the new law.

From your perspective, what are the biggest challenges Spanish organisations face in implementing effective whistleblowing procedures?

– Complying with the law brings multiple challenges, but for many organisations, the most immediate are technological and budgetary. Many entities, especially SMEs and local administrations, still lack the appropriate systems and resources to manage secure and effective reporting channels.

– Beyond the technical side, however, there are deep-rooted cultural barriers that pose equal or even greater challenges. Fear of change, internal resistance, and uncertainty around how to respond to a report continue to hinder genuine implementation. Added to this is the need to break historical stigmas that associate whistleblowing with disloyalty — perceptions that damage both the organisation and the whistleblower’s reputation.

– Addressing these issues requires a broad approach, not just legal compliance, but a genuine shift in organisational culture. Fear should never be an obstacle to achieving higher standards of ethical development in organisations.

What advice would you offer compliance officers and business leaders seeking to align their organisations with Spanish legislation?

– One of the key messages is the importance of protecting compliance officers as central pillars of the system. Their role is essential to ensure that reporting procedures function properly and with due impartiality. To do this, they must have institutional support, independence in their role, and an environment that allows them to act with legal and personal security.

– The Authority (AIPI) will defend compliance officers managing external channels with the same principles applied to whistleblowers.

– It’s also critical that organisations embrace their social responsibility in building a culture of legality. It’s not just about ticking legal boxes, it’s about creating environments where integrity becomes part of the daily norm.

– That said, compliance is not optional: Law 2/2023 establishes fines of up to one million euros for companies that fail to implement the required measures, underlining the need for foresight and commitment.

Lastly, what message would you give to employees who may hesitate to use internal or external reporting channels?

– One of the Authority’s greatest institutional challenges will be to build trust among citizens and employees. In this sense, training, transparency, and leading by example, from both public institutions and private companies, will be essential tools to encourage employees to report without fear, and to understand that the law protects them when they use these channels to exercise their rights.

– In any case, anonymous reporting is available, and I encourage its use as a way to reduce the risk of retaliation.

This interview was conducted in August 2025, as the Spanish Whistleblower Protection Authority prepared to launch its operations. Whistlelink Territory Manager Maria Bobóc spoke with Professor Manuel Villoria, President of the Authority, to discuss the path ahead for whistleblower protection in Spain.