Dejan Jasnic · Co-founder & Compliance Lead, Trusty · 20+ years anti-fraud & compliance · ACFE Swiss Chapter Board
Since 2 August 2026, people who report violations of the EU AI Act are protected by EU whistleblowing law, and employers with 50 or more workers must be able to receive those reports through their internal channel. You do not need a new channel. You need to update the form, the policy and the training behind the one you have.
This guide explains what changed, what counts as a reportable AI Act breach and the exact updates to make.
What is AI Act whistleblowing?
AI Act whistleblowing is reporting a suspected breach of the EU Artificial Intelligence Act that you learned about through your work. The report can go to your employer’s internal channel, to a competent authority or, in limited cases, to the public.
The person who reports is protected from retaliation under the EU Whistleblowing Directive, in the same way as someone who reports fraud or a safety breach.
Trusty provides a compliant whistleblowing system for companies with 50 or more employees, live in minutes.
What does the AI Act say about whistleblowing?
The AI Act extends the EU Whistleblowing Directive to AI in a single sentence. Article 87 states that Directive (EU) 2019/1937 applies to the reporting of infringements of the AI Act and to the protection of the people who report them.
That provision applies from 2 August 2026. From that date, the whole directive, including its rules on channels, deadlines, confidentiality and retaliation, covers AI Act reports.
under 5 minutes
Need a channel that accepts AI Act reports? Trusty sets one up in less than five minutes, with anonymous two-way contact and policy templates included.
Were AI concerns protected before August 2026?
Some were. Before that date, an AI-related report was protected only if it also fell under an area the directive already covered, such as product safety, consumer protection or data protection. The change removes that uncertainty for AI Act breaches.
Is there an EU-level channel for AI Act reports?
Yes. The European Commission launched an AI Act whistleblower tool on 24 November 2025, run by the EU AI Office. Reports can be anonymous, in any official EU language and in any relevant format.
That tool is an external route. It does not replace an employer’s duty to run an internal channel, and a well-run internal channel is how you hear about a problem first.
What AI Act violations can be reported?
Any actual or likely infringement of the AI Act can be reported, as can an attempt to conceal one. The reporter needs reasonable grounds to believe the information is true, not proof.
Area of the AI Act | Example of a reportable concern | Reference |
|---|---|---|
Prohibited practices | A system scores people's social behaviour, or infers employees' emotions at work | Article 5 |
High-risk systems: provider duties | A hiring or credit-scoring system ships without risk management or data governance checks | Articles 9 and 10 |
High-risk systems: human oversight | Staff are told to accept an AI decision without any real ability to review it | Article 14 |
High-risk systems: deployer duties | A company uses a system against the provider's instructions or without informing workers | Article 26 |
Transparency | A chatbot does not tell users they are talking to AI, or deepfakes are not labelled | Article 50 |
General-purpose AI models | A model with systemic risk lacks adequate cybersecurity protection | Articles 53 and 55 |
The AI Act applies in stages, so some duties take effect later than others. A concern about a future or likely breach is still a protected report.
One limit is worth knowing. Commentators note that it is unclear whether risks arising only from a company’s internal use of AI always qualify, so treat borderline reports as protected until you have legal advice.
Which employers are affected by AI Act whistleblowing?
Every employer that already needs a whistleblowing channel is affected, because its channel must now accept AI Act reports. That means private companies with 50 or more workers and public sector bodies.
The change matters most if your organisation does any of the following:
• Develops AI systems or models and places them on the EU market
• Uses AI in decisions about people, such as recruitment, performance, credit, insurance or access to services
• Deploys chatbots or generated content that customers see
• Buys AI tools from vendors, since deployers have their own duties under the AI Act
A company with no in-house AI team can still receive an AI Act report. Many concerns will be about tools bought from someone else.
Who is protected when reporting an AI Act violation?
Anyone who learns of a breach in a work-related context is protected, not only employees. That includes contractors, suppliers, shareholders, board members, trainees, job applicants and former workers.
Protection also covers facilitators who help the reporter, and colleagues or relatives who could face retaliation. If the reporter suffers a detriment, the employer must prove it was unrelated to the report.
What should employers update in their reporting channel for the AI Act?
Employers should make seven updates: the policy, the report form, the case team, the routing, the external information, the training and the vendor process. None of them requires a new system.
1. Update the whistleblowing policy. Add EU AI Act infringements to the list of reportable matters, with one or two plain examples.
2. Add an AI category to the report form. A reporter should be able to pick “artificial intelligence” instead of guessing between IT and compliance.
3. Give the case team an AI contact. Name someone with technical or AI governance knowledge who can be consulted under the same confidentiality rules.
4. Check for conflicts of interest. If the person who owns an AI system also handles reports, route AI cases to someone independent.
5. Update the external reporting information. Tell people which national authority takes external reports and mention the EU AI Office whistleblower tool.
6. Train employees and managers. Explain that AI concerns are protected reports and that retaliation rules apply.
7. Cover suppliers and contractors. Make sure people outside your payroll who work with your AI systems can reach the channel.
Keep the standard deadlines. Acknowledge an AI Act report within seven days and give feedback within three months, as for any other report.
one tool
Make every update in one place. Trusty gives you a custom AI report category, conflict-free case routing and ready-made policy and training templates. Or book a demo.
How can you get an AI-ready whistleblowing channel quickly?
The quickest way is to run your channel on whistleblowing software that already meets the directive, then add AI to your policy and training. Trusty is built around the EU Whistleblowing Directive, with a customisable setup that is ready in less than five minutes.
• Written and voice reports, with voice disguising so a speaker cannot be recognised
• Anonymous two-way contact, so case handlers can ask technical follow-up questions without learning who reported
• Role-based access, which keeps system owners out of cases about their own systems
• A case dashboard that shows each report and its status against the deadlines
• A qualified eIDAS timestamp on each report and a tamper-proof audit log
• Hosting in Germany in ISO/IEC 27001 certified data centres
• Policy templates and employee training included
Try Trusty free for 7 days at trusty.report, or book a short demo.
Frequently asked questions about AI Act whistleblowing
Yes. Article 87 of the AI Act applies the EU Whistleblowing Directive to reports of AI Act infringements, so people who report them are protected from retaliation.
It started on 2 August 2026. Before that date, AI-related reports were protected only if they also fell under an area the directive already covered, such as product safety or data protection.
No. The existing internal reporting channel must accept AI Act reports. Employers should update the policy, the report form and the training, not build a second channel.
Anyone who learns of a breach through their work can report it, including employees, contractors, suppliers, shareholders, trainees, job applicants and former workers.
Yes, through the EU AI Office whistleblower tool, which accepts anonymous reports. For internal channels, the duty to accept anonymous reports depends on national law, and Spain requires it.
They can be reported to the competent national authority or through the EU AI Office whistleblower tool, launched on 24 November 2025.
Retaliation is prohibited. The employer must prove that any detriment was unrelated to the report, and faces penalties under national law, plus possible reinstatement and compensation orders.
with EU Directive & GDPR
Whistleblowing software made simple, built by compliance experts.
Sources
• Article 87: Reporting of Infringements and Protection of Reporting Persons, EU Artificial Intelligence Act
• Whistleblowing and the EU AI Act, EU Artificial Intelligence Act
• Commission launches whistleblower tool for AI Act, European Commission
• Directive (EU) 2019/1937, EUR-Lex
• Trusty, product information
This article is general information, not legal advice.