A compliant whistleblowing operation runs two SLA clocks per case: 7 days from intake to acknowledgement, then up to 90 days from acknowledgement to substantive feedback. Both timers come straight from Articles 9 and 11 of EU Directive 2019/1937, and they are mirrored verbatim in every Member-State transposition: France’s Loi Waserman, Italy’s D.lgs. 24/2023, and Germany’s HinSchG. Lay them on top of the ISO 37002:2021 four-stage management cycle (Receive, Assess, Address, Conclude), add a parallel 12-month retaliation watch, and you have a workflow that satisfies the directive, the international standard, and the operational reality of running an investigation. A platform that does not surface both clocks per case as countdown badges (rather than as background retention settings) is non-compliant by design.