must I also open the reporting channel to customers and suppliers

Opening to customers and suppliers is not a legal obligation

The obligation to establish an internal reporting channel concerns employees, not customers or suppliers. Article 2 of the Whistleblower Protection Act addresses the internal reporting procedure for workers, and the same scope is set out in Article 9 of Directive (EU) 2019/1937. An employer who opens the reporting channel only to its own staff thereby complies with the core of the legal requirement.

That does not mean that opening it to external parties is unusual or undesirable. Some organizations choose to also give access to the channel to self-employed persons, trainees, temporary workers, or even suppliers, for example because they actually face the same risks of misconduct within the organization. This is a choice of the organization, not a legal obligation. Those who add these groups are well advised to make this clear in the reporting procedure, so that everyone understands who can turn to whom and what happens with a report. What must in any case be included in that procedure, regardless of the chosen target group, is described on the page about what must be included in a whistleblower protection scheme.

Why the law focuses on employees

Both the Whistleblower Protection Act and the underlying EU Directive are based on the employment relationship: they concern persons who, in connection with their work, become aware of misconduct and who must be able to report it within the organization without adverse consequences. Article 2 of the Act and Article 9 of the Directive direct the internal procedure to that group. For the question of who may subsequently handle the reports, and what role is appropriate for that, the guidance on who within a company may handle whistleblower reports is relevant, even when the group of reporters is broader than the law strictly requires.