Notes:

• The Critical Role of Whistleblowers: Employees are often the first to detect fraud, corruption, and safety violations. Protecting them is essential for early detection and prevention.
• Legal Frameworks:
  • US (Dodd-Frank & SOX):
    • Dodd-Frank: Offers monetary incentives (10-30% of sanctions) and strong anti-retaliation protections for reporting securities violations to the SEC.
    • SOX: Protects employees of public companies from retaliation for reporting mail, wire, bank, or securities fraud.
  • EU (Whistleblower Directive): Requires all EU member states to establish secure reporting channels and protect whistleblowers in the public and private sectors.
  • California (TFAIA 2026): Specifically protects whistleblowers in the AI sector and requires companies to share reports with the board quarterly.
• Reporting Channels:
  • Multi-Channel: Offer multiple ways to report (hotline, email, web portal, in-person) to accommodate different comfort levels.
  • Anonymity: Allow for anonymous reporting where legally permissible.
  • Third-Party Management: Many companies use independent third-party vendors to manage hotlines to ensure neutrality and trust.
• Anti-Retaliation Policies:
  • Zero Tolerance: Strict prohibition of retaliation against whistleblowers.
  • Investigation: Prompt, impartial, and thorough investigation of all reports.
  • Remediation: Immediate action to protect the whistleblower if retaliation is suspected (e.g., transfer, legal support).
• Board Oversight: The Audit Committee (or a dedicated Ethics Committee) must regularly review whistleblower reports, investigation outcomes, and retaliation allegations.