The EU launches the ‘AI Act Whistleblower Tool’: a new channel for reporting breaches of the AI Regulation

The European AI Office, which reports to the European Commission, has recently launched the ‘AI Act Whistleblower Tool’, the first external and specialised channel at European level for anonymously reporting alleged breaches of Regulation (EU) 2024/1689 on Artificial Intelligence (hereinafter “AIR”).

Through this tool, individuals professionally connected to AI model providers or certain AI systems can confidentially and anonymously report practices that could jeopardise fundamental rights, pose a risk to health or safety, or undermine the public’s trust in AI, democracy and the rule of law.

The tool is part of the phased roll-out of the AIR and is coordinated with Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law. In this regard, the Commission has specified that protection against retaliation in the context of this reporting channel will be fully applicable from 2 August 2026, with the confidentiality of the report being the only protection currently available.

Although it is true that the obligations for high-risk systems will not be enforceable until the next milestones in the implementation of the AIR, the Office has advocated a preventive strategy consisting of encouraging early detection of risks and strengthening the supervisory capacity of the monitoring authority before the penalty regime becomes fully applicable.

In this context, and considering that AI is increasingly integrated into the activities, processes and decision-making mechanisms of companies, it is essential that organisations review their internal AI usage processes, align their internal AI governance with the obligations of the AI Act and adopt a proactive and comprehensive approach to regulatory compliance that mitigates the risk of penalties and reputational damage in the event of potential reports to the European AI Office. In this regard, the implementation of robust and effective compliance systems is essential to ensure not only compliance with current regulations, but also the consolidation of a corporate culture of integrity and responsibility that reinforces stakeholder confidence and ensures the legal and reputational sustainability of the organisation.