Internal Information System Officer (RSII): how to notify the AIPI correctly

Deadline and key interpretative criteria in 2026

The extraordinary deadline for notifying the Independent Whistleblower Protection Authority (AIPI) of the appointment of the Internal Information System Officer (RSII) under Law 2/2023 expires on 10 April 2026. From that date onwards, the standard regime will apply, requiring each appointment or removal to be reported within ten working days.

Beyond formal compliance, the main practical question is not the deadline itself, but which authority is competent to receive the RSII notification.

AIPI or regional authority? A key issue under Law 2/2023

Article 8.3 of Law 2/2023 establishes that notification must be submitted to the AIPI “or, where applicable”, to the competent regional authority, in line with the decentralised supervisory model for internal reporting systems.

In the private sector:

• The AIPI will be competent when the activity extends across several autonomous communities or when no competent regional authority exists.
• Responsibility will fall to the regional authority when the activity is limited to a single autonomous community with a designated authority.

AIPI criteria: when notification is required

According to the FAQs published in February 2026, notification to the AIPI is mandatory for:

• Entities with establishments in more than one autonomous community.
• Entities based in an autonomous community without a competent regional authority.

In other cases, notification to the AIPI is voluntary.

Is there an obligation to notify both authorities of the RSII?

From a formal perspective, there is no general obligation to notify both authorities.

In autonomous communities with a competent authority, such as Catalonia, notification of the RSII to the regional authority is considered sufficient to comply with the legislation.

Areas of uncertainty in practice

Despite the clarity of the legislation, significant questions remain regarding:

• Corporate groups with decentralised structures.
• Entities operating in several autonomous communities.
• Interpretation of the concept of establishment.

These situations create legal uncertainty in the practical application of the legislation.

A cautious approach: dual notification as a precautionary measure

In the absence of consistent administrative guidance, various practitioners recommend a conservative approach. In cases of uncertainty, it may be advisable to notify both the AIPI and the competent regional authority of the RSII appointment as a risk mitigation measure.

This approach helps strengthen legal certainty in a regulatory environment that is still evolving.

Conclusion: regulatory compliance and risk management

Notification of the RSII under Law 2/2023 requires not only meeting deadlines but also correctly determining which administrative authority has jurisdiction.

In situations of uncertainty, taking a proactive and cautious approach is essential to ensuring regulatory compliance and avoiding potential liabilities.