can I manage the reporting channel internally myself or must it be with an external party

Manage it yourself or outsource — both are permitted

A reporting channel may be set up internally, with your own staff and systems, or it may be outsourced to an external provider. Neither the Directive nor the Whistleblower Protection Act mandates one approach over the other. What is established, however, is that there must be a procedure meeting a number of requirements, regardless of who handles the technology and administration: there must be a way to receive reports, someone must be authorised to process them, and the deadlines for acknowledgement and feedback must be met.

In practice, what matters is not so much where the channel is located, but who has access to it and how the handling is safeguarded. An externally hosted channel is often chosen because it makes confidentiality and anonymity easier to maintain: an employee reports to a party with no direct relationship to the employer, which can lower the threshold for some reporters. Internal management can work just as well, provided confidentiality is secured and the people receiving and handling reports are appointed in the proper manner. Whichever route is chosen, the decision often affects workers' representation as well: the works council has a right of approval over the reporting arrangements, and that approval applies equally to internal and external set-ups.

What Article 9 and Article 2 do and do not regulate

Article 9 of Directive (EU) 2019/1937 describes the procedures for internal reporting and follow-up, with requirements on confidentiality, acknowledgement and feedback, but without prescribing the technical or organisational location of the channel. Article 2 of the Whistleblower Protection Act elaborates this for the internal reporting procedure under Dutch law and leaves the choice between internal management and outsourcing equally open. Whether something must necessarily be placed with an external provider is not answered affirmatively by either source; they set requirements for the outcome of the procedure, not for the form in which it is organised.