Updated on July 8, 2026
Direct answer: companies required to have a CIPA must maintain formal procedures for receiving, monitoring and investigating reports, with guaranteed anonymity.
Main legal basis: Law No. 14,457/2022, NR-05 and NR-01.
Many business owners and HR managers in Brazil still ask the same question: is my company really required to have a mandatory whistleblowing channel?
The short answer is: if your company is required to have a CIPA, yes. Brazilian Federal Law No. 14,457/2022 established mandatory measures to prevent and combat sexual harassment and other forms of workplace violence. Among these measures is the creation of procedures for receiving, monitoring and investigating reports, while guaranteeing the anonymity of the reporting person.
In practice, this means that companies covered by this obligation must have a structured whistleblowing channel, publicized and secure, capable of preserving confidentiality.
In addition, the update to NR-01 brought psychosocial risk factors into Occupational Risk Management, reinforcing the need for internal mechanisms for listening, prevention and response.
In this article, we answer 10 common questions that every business owner should know about mandatory whistleblowing channels, Law No. 14,457/2022, CIPA, NR-01 and labor risks in Brazil.
1. Is a whistleblowing channel mandatory by law in Brazil?
Yes, for companies required to have a CIPA.
Law No. 14,457/2022, which created the Emprega + Mulheres Program, established in article 23 that companies with a CIPA must adopt measures to prevent and combat sexual harassment and other forms of workplace violence.
These measures include:
- rules of conduct regarding harassment and workplace violence;
- procedures for receiving and monitoring reports;
- investigation of the facts;
- guarantee of anonymity for the reporting person;
- application of administrative sanctions when applicable;
- training and awareness actions.
The law does not necessarily use the expression “whistleblowing channel platform” as a specific product. What it requires are secure procedures for receiving, monitoring and investigating reports. In practice, a whistleblowing channel is the most appropriate way to comply with this obligation.
2. Which companies are required to have a whistleblowing channel?
The obligation applies to companies that are required to establish a CIPA, according to the criteria set out in NR-05.
CIPA is determined per establishment, mainly considering the number of employees and the risk level of the company’s economic activity. Therefore, it is not technically accurate to say that every company with a fixed number of employees will always be required to have a CIPA. The analysis depends on the company’s classification under NR-05.
In many cases, companies with 20 or more employees may already be required to establish a CIPA, especially in higher-risk activities. However, confirmation requires an analysis of the CNAE code, risk level and NR-05’s official sizing table.
Even companies that are not required to establish a CIPA may still have prevention duties, especially when they have employees under Brazilian labor law. In addition, whistleblowing channels have become a practical market requirement: large companies, investors, business partners and contractors increasingly value suppliers with minimum mechanisms of integrity, listening and harassment prevention.
3. What was the deadline to implement the whistleblowing channel?
The legal deadline has already passed.
Law No. 14,457/2022 was published in September 2022 and granted a 180-day period for the adoption of the measures provided for in article 23. In practice, companies subject to the obligation should have been compliant since March 2023.
This means that a company required to have a CIPA and that still does not have formal procedures for receiving, monitoring and investigating reports is exposed to legal and labor risks.
4. What happens if the company fails to comply?
Non-compliance may create different types of risk for the company.
The first is administrative risk, including possible inspection and fines by the Brazilian Ministry of Labor and Employment. However, the most sensitive risk often appears in labor lawsuits, especially in cases involving moral harassment, sexual harassment, discrimination, psychological violence or the company’s omission in the face of internal complaints.
In a labor claim, the absence of a whistleblowing channel, training, internal rules and investigation procedures may be interpreted as a failure by the company to prevent and address the problem.
There are also reputational risks. A poorly handled report may lead to loss of internal trust, difficulty retaining talent, public exposure and direct damage to the company’s image.
5. What does Law No. 14,457/2022 require besides the whistleblowing channel?
The whistleblowing channel is an important part of the obligation, but it does not work alone.
Article 23 of Law No. 14,457/2022 establishes four main measures for companies required to have a CIPA:
- inclusion of rules of conduct regarding sexual harassment and other forms of violence in the company’s internal policies, with broad disclosure;
- creation of procedures for receiving, monitoring and investigating reports, with guaranteed anonymity for the reporting person;
- inclusion of harassment prevention and combat topics in CIPA activities and practices;
- implementation of training, guidance and awareness actions for employees at least every 12 months.
Therefore, simply creating an email address or a generic form is not enough. The company must have a minimally structured process, with internal communication, treatment flow, defined responsible parties, confidentiality and records of the measures adopted.
6. Did CIPA change with Law No. 14,457/2022?
Yes. CIPA became the Internal Commission for the Prevention of Accidents and Harassment, while maintaining the acronym CIPA in Portuguese.
This update was formalized in NR-05 through Ordinance MTP No. 4,219/2022. Previously, CIPA was traditionally associated with the prevention of accidents and occupational diseases. With the change, harassment and other forms of workplace violence became expressly part of the prevention agenda.
It is important to highlight one point: CIPA should not be confused with the whistleblowing channel itself.
CIPA plays a role in prevention, awareness, campaigns, risk analysis and support for building a safer work environment. The whistleblowing channel, on the other hand, must preserve confidentiality, anonymity and access segregation, especially when the report involves leaders, CIPA members or HR personnel.
Therefore, the ideal approach is for the company to have a clear flow: CIPA acts in prevention and improvement of the work environment; the channel receives the reports; and the investigation follows a confidential, impartial and documented procedure.
7. Does the whistleblowing channel need to guarantee anonymity?
Yes. The guarantee of anonymity is one of the central points of Law No. 14,457/2022.
The reporting person must have the possibility of reporting a situation without identifying themselves. In addition, the information must be treated confidentially, avoiding undue exposure, retaliation or embarrassment.
This point is very important in practice. When employees believe they will be identified or punished for reporting, they tend to remain silent. As a result, the company loses the opportunity to solve the problem internally before it reaches the courts, the Labor Prosecutor’s Office, labor inspection authorities or even social media.
For this reason, an anonymous reporting channel that is well structured, with access control, investigation flow and records, fulfills the purpose of the law far better than improvised solutions.
8. What does NR-01 have to do with whistleblowing channels?
NR-01 did not, by itself, create an express obligation to hire a whistleblowing channel platform. What it did was reinforce the need to manage psychosocial risk factors related to work within Occupational Risk Management.
The new wording of NR-01 expressly includes psychosocial risk factors in GRO/PGR. This involves situations such as harassment, workplace violence, excessive pressure, overload, organizational conflicts, abusive targets, lack of support and other elements that may affect workers’ mental health.
In this context, the whistleblowing channel becomes an important tool for listening and evidence.
The reports received help the company identify risk signals, address internal problems, guide training and demonstrate, in a possible inspection, that there is a real prevention and response mechanism.
In other words: Law No. 14,457/2022 strengthens the whistleblowing channel obligation for companies with CIPA; NR-01 expands the importance of psychosocial risk management for organizations with employees under Brazilian labor law.
9. When does NR-01 inspection on psychosocial risks begin?
The new wording of NR-01, approved by Ordinance MTE No. 1,419/2024, had its enforceability postponed by Ordinance MTE No. 765/2025 and became enforceable from May 26, 2026.
Since May 26, 2026, the inclusion of psychosocial risk factors in Occupational Risk Management has been enforceable by labor inspection authorities.
This point deserves attention: NR-01 has a broad scope and applies to organizations with employees governed by Brazilian labor law. However, there are differentiated rules for individual microentrepreneurs, microenterprises and small businesses in certain situations, especially regarding the preparation of the PGR.
Even so, differentiated treatment does not mean absence of responsibility. Every company with employees must take prevention, health, safety and the work environment seriously.
In addition, the Brazilian Labor Prosecutor’s Office does not depend exclusively on NR-01’s administrative schedule to act. In cases involving harassment, illness, discrimination or company omission, it may initiate investigations and legal actions based on the Constitution, the Brazilian Labor Code and other workplace protection rules.
10. My company is small. Is it worth having a whistleblowing channel even without a direct obligation?
Yes. Even when a company is not required to establish a CIPA, maintaining a whistleblowing channel can be an important measure for prevention, risk management and reputational protection.
There are three practical reasons for this.
First, the cost of implementing a digital channel is usually low when compared to the impact of a labor lawsuit, a report to the Labor Prosecutor’s Office or a poorly managed internal crisis.
Second, data shows that workplace mental health has become increasingly relevant. According to information cited by Fundacentro, data from the Ministry of Social Security indicated 472,000 benefits for mental disorders in 2024, with only 9,827 recognized as work-related.
Third, the channel works as an early warning system. The company gains an organized way to listen to internal problems, identify patterns, correct conduct and act before the situation becomes litigation, inspection or public exposure.
In other words: even when it is not a direct legal obligation, a whistleblowing channel can be a simple, accessible and strategic tool to protect the business.
Conclusion: is a whistleblowing channel a legal obligation or business protection?
Both.
Law No. 14,457/2022 made it mandatory, for companies with CIPA, to establish procedures for receiving, monitoring and investigating reports, with guaranteed anonymity. In practice, this requires a structured whistleblowing channel.
At the same time, the update to NR-01 placed psychosocial risk factors at the center of occupational health and safety management, increasing the importance of internal listening and prevention mechanisms.
More than complying with a legal obligation, a whistleblowing channel helps the company protect people, reduce labor risks, strengthen internal culture and preserve its reputation. If your company has not yet adapted, the time to act has already arrived.
Want to adapt your company to Law 14,457/2022 and NR-01?
Get to know the Denuncie Aqui platform and set up a secure, anonymous and structured channel.
Important note
This article is for informational purposes only and does not replace legal analysis of a specific case.
In addition, when a report involves facts that may also constitute a crime, such as sexual harassment, threats, assault, discrimination or other conduct provided for by law, the company’s internal channel does not replace the possibility of reporting the matter to the competent authorities.