Whistleblower protection is relevant to all three ESG pillars: environmental, social and governance. If your company is subject to, or will soon become subject to, ESG reporting, you need to show how you handle reporting channels, protection from retaliation and a culture of transparency. Below are specific details about who is covered, what information must be disclosed and what to implement.
What is ESG?
ESG describes how companies demonstrate care for the environment, society and ethical management. The abbreviation refers to three areas:
- Environmental: environmental protection, greenhouse gas emissions, management of natural resource use and waste management.
- Social: employment policy, workplace safety, sustainable development of local communities, employee rights and social engagement.
- Governance: the company’s management structure and practices, transparency, business ethics and anti-corruption policy.
The CSRD: the legal basis for reporting
ESG rules are set out in the CSRD (Corporate Sustainability Reporting Directive), which entered into force on 5 January 2023. The directive requires companies to report information about their sustainability activities. The deadline for Member States to transpose it expired in July 2024.
From 2024, specified categories of entities in the European Union are required to report on ESG. In Poland, implementation of the CSRD was conducted in stages. A draft implementing law was published in April 2024, and legislative work continued in the following months.
What is an ESG report?
An ESG report, or sustainability report, is a company’s report on activities relating to sustainability. It is intended for stakeholders, including investors, financial and insurance institutions, customers, employees and local communities. The information in it enables an assessment of the company’s impact on the environment and society.
Who is covered by ESG?
Not all companies have to prepare ESG reports at the same time. The CSRD sets out a phased implementation schedule. The obligation depends on the company’s number of employees and revenue.
CSRD implementation schedule
- 2024: the first entities required to adapt to the new rules were large public companies employing more than 500 people and meeting at least one of these conditions: balance-sheet total above PLN 110 million or net sales revenue above PLN 220 million. These entities filed their first reports in 2025.
- 2025: large companies that had not previously been required to report joined if they met at least two of three criteria: at least 250 employees, balance-sheet total above PLN 110 million and/or net revenue above PLN 220 million. They file their reports in 2026.
- 2026: the reporting obligation covers listed small and medium-sized enterprises (SMEs) meeting two of three criteria: 50 to 250 employees, balance-sheet total of PLN 33 million to PLN 110 million and/or annual net revenue of PLN 66 million to PLN 220 million.
- 2027: reporting will cover companies from outside the EU operating in the EU, with a subsidiary or branch in Poland, that generate annual revenue in the Union above EUR 150 million.
What should you do first?
Check whether your company meets the criteria and when the reporting obligation applies to you. Even if you are not directly required to report, you may have to provide ESG data as part of your contractors’ supply chain.
Whistleblower protection rules and ESG
Whistleblowers, people who report or disclose irregularities in organizations, play a role in all three ESG pillars. Their protection directly affects transparency and the ethical conduct of business.
Whistleblower protection in the “Governance” pillar
ESRS G1-1: what must you disclose?
In July 2023, the European Commission adopted the first set of European Sustainability Reporting Standards (ESRS). The standards provide detailed guidance on the scope and methods for measuring and disclosing non-financial information.
The ESRS G1-1 standard concerns organizational culture and business conduct. It relates to how a company manages its business, minimizes risks and builds trust with investors and contractors. Under this standard, companies must disclose how they address business ethics, anti-corruption and whistleblower protection.
In practice, this means providing the following information:
- Whether the company has internal channels for reporting irregularities and informs employees about them.
- Whether it trains employees and the people responsible for receiving reports.
- What measures it takes to protect whistleblowers from retaliation in accordance with applicable rules.
What if you do not yet have a whistleblower protection policy?
If your company has not yet implemented a whistleblower protection policy, you must state this in the report. Also indicate whether you plan to implement such rules and, if so, provide a schedule of activities.
Effect on the company’s credibility
Organizations that implement whistleblower protection procedures show that they care about compliance with the law and ethical business conduct. Companies with functioning whistleblower protection mechanisms are seen as more credible and responsible, which may make them more attractive to investors.
Whistleblower protection in the “Social” pillar
The “Social” pillar of ESG concerns an organization’s relationships with its employees, contractors and the communities it affects.
Employee rights and protection from retaliation
Introducing whistleblower protection mechanisms demonstrates care for employee rights. Employees who report violations such as workplace bullying, discrimination or breaches of labor law should be protected from retaliation.
Organizations addressing the “Social” pillar should also implement anonymous reporting systems. This supports trust between employees and employers and forms part of responsible human resource management.
What to show in the “Social” section of an ESG report
If your company prepares an ESG report, show:
- What steps you take to support whistleblowers.
- How you encourage reporting of issues relating to the social aspects of your activities.
- How you monitor compliance with social standards and prevent discrimination.
Whistleblower activity helps identify problems before they become a threat to the company’s reputation. This builds a transparent and responsible working environment.
The role of whistleblowers in the “Environmental” pillar
Whistleblowers help identify and eliminate practices harmful to the environment and support activities consistent with sustainable development principles.
Disclosing environmental violations
Whistleblowers may disclose company activities that violate environmental protection rules, such as:
- illegal waste disposal,
- pollution of water, air or soil,
- exceeding permitted emissions of CO₂ or other harmful substances.
Their reports make it possible to respond quickly to potential harm to the environment and local communities.
Countering greenwashing
As pressure to take environmental action grows, some companies may present themselves as more environmentally friendly than they really are. This is known as greenwashing, or the false communication of environmentally friendly activity. Whistleblowers may disclose:
- manipulation in environmental reports,
- false environmental certificates,
- inefficient, outdated or harmful technologies and processes.
Building transparency
A functioning whistleblowing system in an organization shows that the company takes responsibility for the environmental impact of its activities. Involving whistleblowers in environmental protection efforts minimizes reputational, financial and legal risks connected with environmental violations.
Summary: what to do and in what order
Implementing ESG is not only a legal requirement but also an opportunity to organize company processes. Whistleblowers support transparency, help identify threats and strengthen organizational accountability across all three ESG pillars.
When reporting starts depends on your company’s size and type. Some entities are already subject to the obligation, and further groups enter the regime in the current and following years.
Your action checklist
- Check the criteria: find out whether and when your company is subject to ESG reporting.
- Review your supply chain: even if you do not report directly, your contractors may require ESG data from you.
- Implement reporting channels: if you do not have them, plan implementation and set a schedule.
- Train employees both to use reporting channels and, where relevant, to handle reports.
- Develop whistleblower protection procedures, including protection from retaliation and rules on anonymity.
- Prepare report data: collect information on whistleblower protection activities across all three ESG pillars.
Frequently asked questions
How do I check whether my company must report on ESG and when? The reporting obligation depends on company size and is phased in: from 2024 for large public companies with more than 500 employees and assets above PLN 110 million or revenue above PLN 220 million; from 2025 for large companies meeting at least two of three criteria (250 or more employees, assets above PLN 110 million, revenue above PLN 220 million); from 2026 for listed SMEs (50 to 250 employees, assets of PLN 33 million to PLN 110 million, revenue of PLN 66 million to PLN 220 million); and from 2027 for non-EU companies with a branch in Poland and EU revenue above EUR 150 million. Even if your company does not meet these thresholds, contractors subject to the obligation may require ESG data from you as part of the supply chain.
What does whistleblower protection have to do with ESG reporting? Whistleblower protection appears in all three ESG pillars: in Governance, as part of business ethics and anti-corruption; in Social, as protection of employee rights from retaliation; and in Environmental, as a way to detect environmental violations and counter greenwashing. If your company must report on ESG, you need to show how reporting channels work, how you protect whistleblowers and how you build a culture of transparency.
What must be disclosed about whistleblowers under ESRS G1-1? The ESRS G1-1 standard requires disclosure of three things: whether the company has internal reporting channels and informs employees about them; whether it trains employees and people responsible for receiving reports; and what steps it takes to protect whistleblowers from retaliation in accordance with applicable rules.
Must an ESG report say that the company does not yet have a whistleblower protection procedure? Yes. If your company has not implemented a whistleblower protection policy, you must state this in the report and indicate whether you plan to implement such rules. If you do, provide a specific schedule of activities.
What should a company do first to connect ESG with a whistleblowing system? Start by checking whether and when your company must report on ESG, then check whether contractors require data from you as part of the supply chain. Next, implement reporting channels if you do not have them and set a schedule, train employees and people who handle reports, develop whistleblower protection procedures that include protection from retaliation and anonymity, and finally collect data on these activities for the report across all three pillars.
