what exactly must be included in the annual report on the reporting channel

No legally prescribed format for the annual report

There is no fixed table of contents for an annual report on disclosures in the Whistleblower Protection Act or in the underlying directive. What is established, however, is the obligation to have an internal reporting procedure with clear agreements on receipt and follow-up of disclosures — and an annual report is in practice the way an organization demonstrates that this procedure is actually being followed. For this reason, the content of such a report usually consists of a combination of figures, processing times and a description of how the channel functions, without individual disclosures being identifiable.

In practice, an annual report includes elements such as: the number of disclosures received, a breakdown by type (breach or undesired conduct), the average time to acknowledgement of receipt and to substantive feedback, and a general overview of handling — for example how many cases have been closed and how many are still ongoing. A brief review of any adjustments to the procedure or communication to employees also fits here. Those who still need to develop the reporting procedure themselves will find its basic components described at what must a whistleblower regime contain?; the annual report is in fact the accountability for how that regime was used in practice. Since the role of the works council is mandatorily established in this, it is also common for an annual report to be shared with or discussed in the consultation where approval of the reporting procedure was given.

Where this follows from: Article 9 of the directive and Article 2 WPA

Article 9 of Directive (EU) 2019/1937 requires procedures for internal reporting and follow-up, with attention to timely feedback to the discloser. Article 2 of the Whistleblower Protection Act elaborates this into an internal reporting procedure that an employer must have and apply. Neither of these provisions prescribes an annual report with fixed content; the content described above is therefore a common way to demonstrate that the procedure functions, not a legally prescribed checklist.