HinSchG Communication to Employees: 5 Mandatory Components

Main article: HinSchG: Setting up an internal reporting office — the guide to setting up the internal reporting office in eight steps, with a checklist.

Mandatory or practice recommendation? The five components in a legal check

What is anchored in statute is the workforce information itself — explaining the reporting channels to employees (§ 13 HinSchG, specified for the external reporting procedures in § 13(2) HinSchG). The reviewed source material contains no requirement as to format, frequency or audience-specific tailoring: notice, onboarding module, manager training, refresher and newsletter are practice recommendations. For Austria, the reviewed source material contains no separate provision on workforce information; what is documented there is the duty to set up the office (§ 3(1), § 11(1) HSchG) and the procedural duties of §§ 9 and 13 HSchG.

The column "Classification" says whether the component itself is required by law. The column "Provision behind it" names the rule from which its content or its limit follows.

1. Notice in the break room / intranet

The notice is the visible implementation of the workforce information: it has to explain the reporting channels, not merely assert that they exist.

Sample text for a notice / poster: 'Whistleblower protection: if you suspect legal violations, you can submit a report through our internal reporting office — confidentially, [placeholder: anonymity variant a or b], without reprisals. You can also turn directly to the external reporting office: [placeholder DE: Federal Office of Justice (BfJ) / AT: Federal Bureau of Anti-Corruption (BAK)]. Contact: [URL/telephone].'

Two variants are available for the placeholder — use the one your channel actually delivers. Variant a (no anonymous intake): 'Your identity will only become known to the persons responsible for receiving reports and taking follow-up action and to those supporting them (§ 8(1) HinSchG).' Variant b (anonymous submission possible): 'You may also submit the report without stating your identity; follow-up questions are then only possible through the anonymous return channel.'

Sample text for an intranet teaser: 'Reporting office for reports of legal violations: available at [placeholder: URL/telephone/postal address], confidential and without reprisals. You can also turn directly to the external reporting office — the choice is yours: [placeholder DE: Federal Office of Justice (BfJ) / AT: Federal Bureau of Anti-Corruption (BAK)]. Your report and the related documentation will be deleted three years after the procedure has been concluded (§ 11(5) HinSchG) [AT: five years, § 8(11) HSchG].'

Sample text for the email rollout to the workforce — subject: 'Our reporting office: how to submit reports of legal violations'. Text: '[Salutation], our company operates an internal reporting office. You can reach it at [placeholder: contact details] [placeholder: the reporting form you actually operate — in text form and/or orally]; at your request also in a personal meeting (§ 16(3) sentences 1 to 3 HinSchG). Your identity will only become known to the persons responsible for receiving reports and taking follow-up action and to those supporting them (§ 8(1) HinSchG). You will receive an acknowledgement of receipt within 7 days at the latest and, within 3 months of that acknowledgement, feedback on the follow-up action (§ 17(1) no. 1 and (2) HinSchG).' [Austrian version of this sentence: 'Receipt of written reports is acknowledged without undue delay, at the latest after 7 calendar days — unless you expressly object or the acknowledgement would compromise the protection of your identity (§ 9(1) HSchG); at the latest 3 months after the report has been received you will get feedback on the follow-up action (§ 13(9) HSchG).'] Continuation of the sample text: 'Detriment because of a report is prohibited (§ 36(1) HinSchG; AT § 20(1) HSchG).'

Six items carry the notice in substance. First, the availability of the internal reporting office, which under § 12(1) sentence 1 HinSchG has to be set up and operated. Second, the channels you actually operate: § 16(3) sentence 1 HinSchG requires reports orally or in text form, orally by telephone or by another means of voice transmission (sentence 2); at the request of the reporting person a personal meeting within a reasonable time is added (sentence 3), with their consent also by video and audio transmission (sentence 4). Third, the confidentiality of the identity (§ 8(1) HinSchG; in Austria § 7(1) HSchG). Fourth, protection against reprisals (§ 36(1) HinSchG; AT § 20(1) HSchG). Fifth, the reporting person's right to choose between an internal and an external report, together with the name of the external office (§ 7(1), § 19 HinSchG; AT § 6(1), § 15(1) HSchG). Sixth, an honest statement on anonymity: promise only what your channel really delivers — the two wording variants above show how to keep this separate in the notice.

2. Onboarding module

The onboarding module is a practice recommendation — it ensures that the workforce information also reaches new employees instead of staying on the notice board.

Plan for 30 minutes and five blocks: What is the HinSchG?, Who is a reporting person?, Which violations?, How to report?, What protection? — the slide core for each block is set out at the end of this section.

The block "Which violations?" is where Germany and Austria diverge most clearly — no uniform text may be used here. The rules on the burden of proof also differ in the block "What protection?": see section 3. In Germany, § 2(1) nos. 1 to 3 HinSchG covers all criminally sanctioned violations, violations subject to administrative fines insofar as the rule infringed serves to protect life, limb or health or the rights of employees or their representative bodies, as well as numerous listed federal, Land and EU provisions. In Austria the scope is narrower: § 3(3) HSchG names the EU areas (among others public procurement, financial services, product and transport safety, the environment, food, public health, consumer protection, data protection) plus the corruption offences of §§ 302 to 309 of the Criminal Code (StGB). In the block "What protection?" two sides belong in the same module: the exemption from liability for obtaining and disclosing the information (§ 35 HinSchG; AT § 22 HSchG) and its limit — under § 38 HinSchG, anyone who intentionally or through gross negligence reports incorrect information is liable, and the protection of identity does not apply in those cases (§ 9(1) HinSchG). Add the point that the rights of reporting persons cannot be restricted by agreement (§ 39 HinSchG); the reviewed source material names no equivalent in the Austrian HSchG.

Sample text for onboarding — slide core for the five blocks, one statement with a source each:

• What is the HinSchG? An act that protects persons who report violations under § 2(1) HinSchG against reprisals (§ 36(1) HinSchG); in Austria § 3(3) and § 20(1) HSchG.
• Who is a reporting person? In Austria, protection applies to anyone who has sufficient grounds to assume that the report is true and that it falls within the scope of the act — protection takes effect once the report is submitted to an internal or external office (§ 6(1) HSchG). For Germany, the reviewed source material contains no entry on the personal scope of protection; do not use a uniform text here. Anyone who intentionally or through gross negligence reports incorrect information loses the protection of identity (§ 9(1) HinSchG).
• Which violations? DE: all criminally sanctioned violations, violations subject to administrative fines that serve to protect life, limb, health or employee rights, as well as the listed federal, Land and EU provisions (§ 2(1) nos. 1 to 3 HinSchG). AT: the EU areas (among others procurement, financial services, product and transport safety, the environment, food, public health, consumer protection, data protection) plus the corruption offences §§ 302 to 309 StGB (§ 3(3) HSchG). No uniform text.
• How to report? The channels you actually operate, under § 16(3) sentences 1 to 4 HinSchG (list as in the notice, section 1), plus the contact details [placeholder: URL/telephone/postal address].
• What protection? You are not liable for obtaining and disclosing the information (§ 35 HinSchG; AT § 22 HSchG). The limit: anyone who intentionally or through gross negligence reports incorrect information is liable (§ 38) and loses the protection of identity (§ 9(1)). Your rights cannot be restricted by agreement (§ 39 HinSchG). Your identity will only become known to the responsible persons and to those supporting them (§ 8(1) HinSchG; AT § 7(1) HSchG).

3. Manager training

Manager training is a practice recommendation — its contents are not: obstructing a report (§ 7(2)), reprisals (§ 36) and breaches of confidentiality (§ 8(1)) are subject to administrative fines under § 40 HinSchG and affect managers personally; the tiers (EUR 50,000/20,000/10,000) are set out in section 4.

A 60-minute module covers three guiding questions — how to react to reports, which prohibitions apply, and when a report is passed on to the reporting office; the five points below fill them out.

Five points belong firmly in this module. Prohibition of reprisals: § 36(1) HinSchG prohibits reprisals directed against reporting persons, including the threat and the attempt; in Austria, retaliatory measures are legally ineffective under § 20(1) HSchG. Burden of proof: In Germany, § 36(2) HinSchG presumes that a work-related detriment which the reporting person claims to be a consequence of their report is a reprisal — the party causing the detriment has to prove otherwise. The Higher Labour Court of Lower Saxony confirmed this two-stage test under § 36(2) HinSchG in its judgment of 11 November 2024 (7 SLa 306/24); practice recommendation: document the proof of independence for every HR measure taken after a report. Austria, by contrast, only requires the reporting person to show prima facie evidence and allows counter-evidence of a more probable alternative motive (§ 23 HSchG) — a weaker standard than the German reversal of the burden of proof. Prohibition of obstruction: Under § 7(2) HinSchG it is prohibited to obstruct reports or the subsequent communication, or to attempt to do so. First reaction: practice recommendation for the conversation: accept the report and document it with the date and the way it came in, do not investigate within the line organisation yourself, and promise neither anonymity nor a particular outcome. Two limits are non-negotiable here: the identity stays outside the line organisation (§ 8(1) HinSchG, wording in variant a of the sample notice text), and discouraging or stalling falls under the prohibition of obstruction (see above). Passing on: a manager who receives a report passes it on to the reporting office. Practice recommendation: without undue delay, at the latest on the next working day — the 7-day deadline only starts to run when the report reaches the internal reporting office (§ 17(1) no. 1 HinSchG; AT § 9(1) HSchG); every day of delay in the line organisation in effect shortens the reporting office's processing time. The statutory expertise requirement of § 15(2) HinSchG addresses the officers of the reporting office (experience value, not a statutory minimum: training typically 5 to 8 teaching units); for managers, the reviewed source material contains no separate expertise requirement.

4. Annual refresher

The annual rhythm is a practice recommendation, not a statutory deadline — its purpose is to keep the communicated legal status current.

15-minute module + newsletter reminder. Update on the applicable legal status at the time: the HinSchG of 31 May 2023 (BGBl. 2023 I Nr. 140) was last amended by Article 2 of the Act of 22 July 2026 (BGBl. 2026 I Nr. 223); since 29 July 2026, § 2(1) no. 10 HinSchG also covers violations of Regulation (EU) 2024/1689 (AI Act). The fine ranges of § 40(6) HinSchG have remained unchanged: up to EUR 50,000 (obstructing a report, reprisals, breach of confidentiality), up to EUR 20,000 (no internal reporting office set up, knowingly incorrect disclosure) and up to EUR 10,000 in the remaining cases. In Austria, § 24 HSchG applies instead: a fine of up to EUR 20,000, in case of repetition up to EUR 40,000, imposed by the district administrative authority.

Three points are worth including in the next round. Addressee of the fine: for legal persons, § 30(2) sentence 3 OWiG allows a tenfold increase of the maximum — up to EUR 500,000 for the offences carrying EUR 50,000. § 40(6) sentence 2 HinSchG, however, orders this only for (2) nos. 1 and 3 as well as (3) and (4), not for the missing internal reporting office; there the limit remains EUR 20,000 for companies too. Competence: the HinSchGOWiZustV (entry into force see the list below, source in the sources section) transfers the prosecution of administrative offences under § 40 HinSchG to the Federal Office of Justice (BfJ) — but only insofar as the execution of the act falls to the Federal Ministry of Justice or an authority within its remit. Infringement proceedings: there are no proceedings concerning group-level outsourcing under § 14 HinSchG; the outcome of the German proceedings INFR(2022)0052 is set out in the list below, the practice recommendation on the group solution in the FAQ "What do group subsidiaries communicate?". The HinSchGOWiZustV and the EU infringement proceedings concerning the transposition of Directive (EU) 2019/1937 in Germany have no equivalent in Austria.

What belongs in the 2026 round — the changes from 2024 to 2026 documented in this article, bundled together:

• Higher Labour Court of Lower Saxony, judgment of 11 November 2024 (7 SLa 306/24): two-stage test under § 36(2) HinSchG (section 3).
• HinSchGOWiZustV, in force since 15 April 2025: competence of the Federal Office of Justice (BfJ) for fines within the remit of the Federal Ministry of Justice.
• Amendment of the HinSchG by Art. 14 of the Act of 2 December 2025 (BGBl. 2025 I Nr. 301) — fine ranges of § 40(6) unchanged.
• EU infringement proceedings concerning § 14 HinSchG: no proceedings pending — the German proceedings INFR(2022)0052 concerning Directive (EU) 2019/1937 ended with the CJEU judgment C-149/23 of 6 March 2025 (lump sum EUR 34 million) and were closed on 4 June 2026 (as at 17 August 2026).

5. Anonymised success stories

Anonymised case reports are a practice recommendation — their content is limited by the confidentiality requirement.

Quarterly newsletter: 'How our reporting office helped in 2025 — anonymised examples'. Practitioner assessment: this strengthens trust and the participation rate.

The legal framework for this is narrow. § 8(1) HinSchG protects not only the identity of the reporting person but also that of the persons concerned and of other persons named in the report; the group of people who may know is the same as in variant a of the sample notice text. Austria states the limit even more explicitly: § 7(1) and (2) HSchG also covers all information from which the identity can be derived directly or indirectly. Practitioner assessment: in small units, department, period and type of case can together be enough for re-identification — and that is exactly where anonymised case reports fail. Practice recommendation: do not publish any combination of site, department and time window, but rather the type of case and the outcome category; in very small units, leave out the individual case altogether. Aggregated reporting statistics carry a considerably lower risk to identity; the best-practice checklist for reporting-office documentation lists them as the check point "statistics of reports"; compliance with the 7-day and 3-month deadlines forms part of the likewise voluntary effectiveness self-assessment. A breach of confidentiality is subject to administrative fines (intentional or reckless § 40(3) — up to EUR 50,000; negligent § 40(4) — up to EUR 10,000, in each case § 40(6) HinSchG; AT § 24 HSchG).

Practice recommendation — release rule for case reports: (1) describe only the type of case and the outcome category; as soon as two of the three features site, department/team and time window are named, the report has to be deleted. (2) Check against the smallest unit identifiable in the report: if the circle of possible persons can be narrowed down from the text to a single-digit number, drop the case. (3) Release under the four-eyes principle by the reporting office and internal communications, documented in the release note on anonymisation (evidence artefact in the table). The benchmark for (2) is § 7(1) and (2) HSchG (information that can also be derived indirectly).

Deadlines and competent authorities that belong in the workforce information

Four items belong in the workforce information: acknowledgement of receipt within 7 days, feedback within 3 months, the competent external reporting office (DE: Federal Office of Justice (BfJ), AT: BAK) and the retention period for the documentation (DE 3 years, AT 5 years). They answer the questions employees actually ask before making a report: When will I hear something? When will I know what happened? Whom can I turn to outside the company? How long will my report be kept? All four rows of the table reflect procedural or competence details laid down by law; including them in the workforce information is a practice recommendation.

Practice recommendation on distributing this across the carriers: the poster should carry only availability, confidentiality, protection against reprisals and the external office; the intranet page and the email additionally the 7-day and 3-month deadlines as well as the retention period.

Who maintains which component, how often — and with what evidence?

In practice, responsibility can be split like this: the notice and the case reports sit with the reporting office together with internal communications, the onboarding module with HR, training and refresher with the reporting office — and every measure leaves a dated artefact with which it can later be evidenced. Frequency, responsibility, evidence artefact and the ad-hoc triggers in the following table are practice recommendations; what is documented is only the legal changes named there. The reviewed source material contains no statutory requirement on frequency, responsibility or evidence. Of the items in this table, only the retention of the reporting-office documentation is prescribed by law (§ 11(5) HinSchG; AT § 8(11) HSchG, see the table above).

Three statements that have no place in employee communication

Three widespread claims do not stand up to the wording of the act — anyone who repeats them in the notice or in training promises the workforce something the company does not owe. All three statements concern the German HinSchG only; in Austria the HSchG applies instead, with its own provisions.

"Anonymous reports have been mandatory since 1 January 2025." § 16(1) sentence 4 HinSchG formulates a recommendation: the internal reporting office should also process reports received anonymously. Sentence 5 expressly clarifies that there is no obligation to design the reporting channels for the submission of anonymous reports. The date cited comes from a draft that did not become law; the transitional provision § 42 HinSchG concerned the deadline for setting up the office for employers with 50 to 249 employees (17 December 2023) and the applicability of § 40(2) no. 2 (1 December 2023) — both dates passed long ago.

"Three reporting channels are mandatory." § 16(3) sentence 1 HinSchG requires reports orally or in text form; to that extent the employer has a choice. The only mandatory addition is the personal meeting on request (sentence 3; the complete list of channels is set out in section 1). Three parallel channels are widespread best practice and, in practitioner assessment, reduce the risk of disputes — they are not a statutory obligation.

"The 2026 HinSchG amendment requires an annual audit." No such amendment exists. § 22 HinSchG governs the external reporting office at the Federal Cartel Office for competition-law violations including the DMA; no audit obligation for companies follows from this. The annual effectiveness self-assessment of the internal reporting office remains best practice, not a statutory obligation.