The details of the procedure for receiving and processing alerts are set!

Law 2022-401 of 21 March 2022 on the protection of whistle-blowers simplified the reporting procedures. The long-awaited implementing decree No. 2022-1284 of 3 October 2022 sets out the content of the procedure for receiving and processing internal alerts and has been in force since 5 October 2022.
 
All private companies and public companies employing at least 50 employees must establish a procedure for receiving and processing alerts. The number of employees is calculated at the end of two consecutive business years.
 
Each company must establish its own internal alert procedure, after consulting their works council. It is up to the company to determine the legal instrument best suited for establishing this internal alert procedure. For example, the procedure maybe set up through an internal policy or an in-house collective agreement.
 
The internal alert procedure should contain the following information:
 
1. How the company receives the alert
 
The procedure must provide for:

• a description of the channel for receiving written or oral alerts, such as a generic email address, a dedicated telephone line, an in-person meeting or a videoconference. The reception channel must allow for the transmission of any element, whatever its form or medium, that could support the facts of the alert.
  • The reception channel may be managed on behalf of the company by a third party (individual, association, law firm, service provider),

• the information that the whistle-blower receives an acknowledgement of receipt of the alert in writing within 7 working days ,
• the information pertaining to the verification of the alert with regards to the provisions of the "Sapin 2" law and the law on the protection of whistle-blowers and, where applicable, information of the whistle-blower on the non-compliance of the alert with these provisions as well as the follow-up given to these non-compliant alerts,
• the information on the possibility for the whistle-blower to verify, modify and approve the transcript of the conversation or the minutes of the alert upon signature.

 
2. How the company processes the alert
 
The procedure must provide for:

• the information of the individuals or departments within the company designated to receive and process alerts
• the information on the communication in writing to the whistle-blower, within a reasonable period of time not exceeding 3 months from the acknowledgement of receipt of the alert, on the measures contemplated or applied to assess the accuracy of the allegations and, where appropriate, to correct the subject of the alert
• clauses guaranteeing the integrity and confidentiality of the information received (including the identity of the whistle-blower and of the individuals referred to or mentioned in the alert), the prohibition of access to the information by unauthorised staff members, the transmission without delay of the alerts received to the designated individuals or departments for processing, the communication of the information received to third parties only if such communication is necessary to process the alert.

The internal alert procedure must be made available by any means, notably by individual notification to employees, posting within company premises and publishing on the company's website.
 
Companies with less than 250 employees, including those belonging to the same group, may share resources for receiving alerts and assessing the accuracy of the allegations made in the alert.