Directive 2019/1937 sets two deadlines most HR teams know exist and few have a reliable system for meeting. Rectifia computes both at case creation, so the clock lives on the case rather than in someone's calendar.
The two clocks
Seven days to acknowledge. From the moment a report is filed, the organization has seven days to acknowledge receipt to the reporter. Not seven days to investigate - seven days to confirm the report reached someone and is being handled.
Three months to provide feedback. From acknowledgment, the organization has three months to give the reporter meaningful feedback on what is being done. It does not have to be a final outcome, but it does have to be substantive.
Both clocks apply regardless of whether the report is anonymous. A reporter without a name or email address still has a right to that acknowledgment and that feedback, which is why every report gets a case ID and passcode: an anonymous reporter can collect the update without ever creating an identifying trail back to themselves.
Where the deadlines actually get missed
Almost never because someone decided to ignore them. Nearly always because the report arrived somewhere without a clear owner, because nobody was tracking the clock in a way visible to more than one person, or because the three-month window looked comfortable in week one and became a scramble in week eleven. None of those look like compliance failures at the moment they happen - they become compliance failures months later, when a reporter who never heard back escalates externally, which the Directive explicitly permits once internal channels have failed to respond in time.
What changes above 1,000 employees
Past roughly 1,000 employees, the six-box checklist - anonymous reporting, 7-day acknowledgment, two-way communication, 3-month feedback, retaliation-protection documentation, GDPR-compliant retention - is table stakes, and the real differentiator moves somewhere the checklist does not reach.
- Multiple investigators across departments and regions means two similar complaints can get different outcomes without anyone doing anything wrong.
- Conflict of interest stops being rare once more people hold case-handler or admin-adjacent roles, so it needs to be caught automatically rather than recognized by an investigator.
- The Directive's own "designated impartial handler" language has to mean something operational, not a line in a policy nobody re-reads at intake.
- Documentation burden rises with headcount, not just case volume: "we investigated case by case" is not itself evidence of fair treatment. A documented pattern is.
How Rectifia handles it
Acknowledgment and feedback clocks start automatically the moment a report is filed. Every case shows its countdown directly, and cases approaching either deadline are surfaced to HR before they lapse rather than after. Where an organization operates under more than one framework, the deadline that applies to a given case is whichever one is strictest, computed automatically rather than worked out by hand before every acknowledgment.