Whistleblowers at IT Companies: Why B2B Contractors Count Toward the 50-Person Threshold

You run a software house with 15 employees on employment contracts and 40 B2B contractors. You assume the Whistleblower Protection Act does not apply because you “only have 15 employees.” But 15 plus 40 equals 55 people. You have exceeded the 50-person threshold, so the duty to implement an internal reporting procedure already applies to you.

The Act of 14 June 2024 on the Protection of Whistleblowers (Journal of Laws 2024, item 928) defines the threshold differently from what most founders assume. It does not count only employees. It counts every person who performs paid work for your entity, including B2B contractors who provide services personally.

This article explains how to count your team correctly for the Act, which categories of people count toward the threshold, when to verify the workforce, and what to do if the duty has already arisen. The approach is straightforward: recalculate your team before the prosecutor does it for you.

Key terms you need to know

Before getting into the details, it is useful to clarify the terminology used in the Act and in this article.

Why a company with 15 employees may be covered by the Whistleblower Protection Act

The reasoning often goes like this: “I have 15 employees on employment contracts, so I am nowhere near the 50-person threshold.” But Article 23(1) of the Act does not refer only to “employees.” It refers to people performing paid work.

Article 23(2) specifies two categories counted toward the total of 50:

1. Employees, counted as full-time equivalents: people hired under an employment contract, appointment, election, nomination, or a cooperative employment agreement.
2. People performing paid work on a basis other than an employment relationship, provided they do not employ other people to perform that type of work, regardless of the basis on which they are engaged.

The second category includes mandate contractors, service providers, management contractors, and, especially for the IT industry, B2B contractors operating as sole traders.

There is one condition: the contractor must perform the work personally and must not employ subcontractors to carry out work for you.

Return to the example. A software house has 15 full-time employees and 40 B2B contractors who are sole traders with no subcontractors:

The 50-person threshold has been exceeded. The duty to implement an internal reporting procedure arises.

The Act also provides sectoral exceptions: entities in financial services, AML, transport safety, and environmental protection must implement a procedure regardless of the number of people. If your IT company serves clients in these industries, check whether this creates a separate duty for your business.

Contact us

How to count the 50-person threshold: a full list of categories

People included in the threshold

People NOT included in the threshold

1. Volunteers: they work without pay and do not meet the “paid work” criterion. They may be whistleblowers, but they do not increase the count.
2. Unpaid interns and trainees: excluded from the threshold. If they receive remuneration, they count in the relevant category.
3. Legal entities, such as companies and external businesses: they are not natural persons and are not counted.
4. B2B contractors who employ subcontractors: if a contractor delegates work to other people, they do not meet the personal-performance condition.

The personal-performance test: what to check

To determine whether a B2B contractor performs work personally, check three things:

1. Does the agreement allow tasks to be delegated to subcontractors?
2. Does the contractor actually do the work themselves rather than sending someone else in their place?
3. Does the contractor employ people in their business to perform work for you?

If the contractor is a sole trader with no employees or subcontractors and personally writes code, they count toward the threshold.

One contractor working 5 hours a week: a full unit or a fraction?

The Act does not give a clear answer to this question. That is precisely why you need to consider it.

Article 23(2) provides for full-time-equivalent calculations only for employees in the first category. An employee working 0.5 FTE counts as 0.5 unit. An employee working 0.25 FTE counts as 0.25 unit. The logic is clear.

For people on civil-law contracts and B2B contracts in the second category, the provision does not provide for this type of calculation. This creates an interpretative gap with two competing readings:

There is no official ministerial guidance or case law resolving this question.

What does this mean for your company? If you use the purposive interpretation and a supervisory authority applies the literal interpretation, you risk an allegation that you failed to implement a procedure.

Our recommended approach is to count each B2B contractor and mandate contractor as one full unit. This cautious approach minimizes risk. If the resulting count is below 50, you have a safety margin. If it exceeds 50, you know that the duty has very likely already arisen.

Whichever method you use, document it internally, for example, in a board resolution or internal policy. If inspected, you can show that your decision was considered and based on an analysis.

When to count: the reference dates of 1 January and 1 July

Verify the workforce twice a year, on 1 January and 1 July. These are the reference dates under Article 23(1) of the Act.

The process is simple:

1. On 1 January or 1 July, check how many people perform paid work for you.
2. If the total is 50 or more, the duty to implement a procedure arises.
3. A drop below 50 between reference dates does not release you from a duty that has already arisen.
4. Verify again on the next reference date.

The dispute over the first reference date

The Act entered into force on 25 September 2024, including the provisions on internal reports. There was disagreement about which reference date came first:

In 2026, this dispute has less practical significance: you verify the count on 1 January 2026 and 1 July 2026. But if you did not implement a procedure earlier and the threshold was exceeded on 1 January 2025, the delay may be grounds for liability.

What about people on leave or sick leave?

The Act refers to performing paid work as of a specified date. The cautious approach is to count people on vacation or sick leave if they remain formally employed or have an active contract on the reference date.

Agency workers: the only exception to the rule?

A temporary worker hired by a temporary work agency has a formal employment relationship with the agency, not your company. But in practice the person works at your premises, under your direction, and for your benefit.

The Act does not expressly resolve whether temporary agency workers count toward the 50-person threshold on the user-employer’s side. There is no official ministerial guidance or case law.
Arguments for counting them include:

1. Literal interpretation: Article 23(2) refers to people “performing paid work for a legal entity,” and a temporary worker in practice works for the user employer.
2. Purposive interpretation: excluding temporary workers could allow employers to replace permanent roles with temporary work to avoid the duty.
3. Analogy with the PFRON system: the Government Plenipotentiary for Disabled Persons has allowed temporary workers to be included in the user employer’s workforce count.

It is worth noting that the Act expressly lists temporary workers as people who may qualify as whistleblowers (Article 4(1)(2)). They may report violations at either the agency or the user’s workplace.

Recommendation: count temporary workers toward your threshold and document the methodology.

What about body leasing and outsourcing?

People delegated by an external company to work on your projects generally perform paid work for their own employer, while your company is the client. Each case requires an individual review of the contract structure and how the work is actually performed.

Checklist: audit your team structure in 30 minutes

Here is a process you can carry out yourself. The aim is to answer one question: will your company exceed the 50-person threshold on the next reference date?

Stage 1: collect data (10 minutes)

1. Ask HR for a list of employees on employment contracts, with FTE and contract status on the reference date.
2. Ask accounting or operations for a list of people on civil-law and B2B contracts that are in force on the reference date.
3. For each B2B or mandate contractor, mark whether they perform work personally and whether they employ subcontractors.
4. Add paid members of the management board and supervisory board, and paid commercial proxies.

Stage 2: calculate (10 minutes)

1. Add employee FTEs, for example: 30 × 1.0 + 10 × 0.5 + 4 × 0.25 = 36 FTEs.
2. Count B2B and mandate contractors who meet the personal-performance condition, with each person counting as 1 unit.
3. Add paid members of corporate bodies and paid commercial proxies.
4. Add the results from items 1 to 3.

Stage 3: decide (10 minutes)

1. If the total is 50 or more, implement an internal reporting procedure.
2. If it is below 50 but close to the threshold, for example, 42 to 49, plan another check before the next reference date and monitor team changes.
3. Document the method used, for example, in a board resolution or internal note.
4. If the duty has arisen, check whether a procedure is in place. If not, plan its implementation.

Elements of the internal reporting procedure you must provide

If the audit shows that you exceed the threshold, your procedure must include:

1. Reporting channels, online and oral, that allow anonymous reports
2. A designated body to handle reports, such as an internal committee, an external entity, or a mixed body
3. A register of reports kept for 3 years
4. A feedback mechanism for the whistleblower, with a maximum deadline of 3 months from the report
5. Rules protecting whistleblowers from retaliation
6. Consultation with employee representatives for 5 to 10 working days before implementing the procedure

How we can help

Auditing the team structure is only the beginning. If your company exceeds the 50-person threshold, a more common scenario in IT than founders assume, you must implement an internal reporting procedure under the Act.

This means more than preparing documents. You need to design reporting channels, appoint a body to handle reports, train the team, and make sure the system works consistently with your organization’s working model, including remote work, contractor turnover, and project-based work.

We support technology companies in three areas:

1. Workforce structure audit: we verify how many people count toward the threshold, identify interpretative gaps, and document the methodology used.
2. Implementation of a reporting procedure: we design a reporting system for an IT company, including online channels, an automated telephone mailbox, and anonymous correspondence; prepare documentation; and conduct team consultations.
3. Ongoing support and handling reports: as an external entity, we can act as the body that handles reports, providing independence and protecting the whistleblower’s anonymity.

Count your team before the prosecutor does it for you

The Whistleblower Protection Act does not distinguish “real employees” from “contractors.” It counts people performing paid work. For a typical IT company with a dozen or so employees and dozens of B2B contractors, the 50-person threshold is almost automatically exceeded.

Three things to do now:

1. Audit your team structure using the checklist in this article.
2. Document the methodology you use to count the threshold.
3. If you exceed the threshold, implement an internal reporting procedure or check whether your existing procedure meets the Act’s requirements.

Failure to implement a procedure is not a theoretical risk. The Act provides for criminal sanctions: a fine, restriction of liberty, or imprisonment for up to 2 years for knowingly obstructing reports or retaliating against a whistleblower.

If you need support, from an audit through implementation to ongoing report handling, contact us.

Frequently asked questions

Does a B2B contractor who operates as a sole trader always count toward the 50-person threshold?

Not always. The contractor must perform work personally and must not employ other people to perform that type of work. If a B2B contractor has employees or subcontractors to whom they delegate work for you, they are not included. If they personally write code, manage a project, or perform the contracted services, they count as one full unit.

Does a contractor working 3 hours a week count the same as a full-time employee?

This is an interpretative gap. The Act provides for FTE calculations only for employees on employment contracts. It has no such mechanism for mandate and B2B contractors. There are two interpretations: the literal one, where every contractor counts as one person regardless of hours, and the purposive one, where the count is proportional to working time. There is no official guidance or case law. The cautious approach is to count each person as one full unit and document your methodology.

What happens if my company exceeds the 50-person threshold but does not implement a reporting procedure?

The Act provides for criminal sanctions: a fine, restriction of liberty, or imprisonment for up to 2 years, including for obstructing reports or retaliating against a whistleblower. A missing procedure also means your organization lacks protection. A whistleblower may report directly to an external authority, such as the Commissioner for Human Rights, or make a public disclosure, which may create reputational risk.

Do temporary agency workers count toward my threshold?

The Act does not expressly resolve this. A temporary worker has a formal employment relationship with the agency but actually works for you. There are strong arguments for including them: literal and purposive interpretations and an analogy with the PFRON system. The recommendation is to count them on your side and document the method. The Act expressly lists temporary workers as people who may qualify as whistleblowers.

When exactly do I need to check the workforce count?

Twice a year, on 1 January and 1 July. If the total number of people performing paid work for you is 50 or more on either date, the duty to implement a procedure arises. A drop below the threshold between reference dates does not release you from a duty that has already arisen. The next check is on the next reference date.

Can a company below the 50-person threshold implement a procedure voluntarily?

Yes. The Act allows entities below the threshold to implement an internal reporting procedure voluntarily. Once adopted, however, all statutory requirements apply, including maintaining a register of reports, giving feedback to the whistleblower within 3 months, and prohibiting retaliation.