Workers are often the first to see an AI system go wrong: a screening tool that rejects people for odd reasons, a monitoring system that collects more than it should, or a product shipped without the checks the law requires. Raising that concern can feel risky. This page explains when the law protects people who report problems with AI at work, which channels they can use, and what employers must have in place.
The short answer: in the EU, the Whistleblower Directive protects people who report breaches of listed areas of EU law that they learned about through work, and since 2 August 2026 the AI Act says that Directive applies to reports of AI Act infringements. Protection depends on having reasonable grounds to believe the information was true and on using internal, external or, in limited cases, public channels. In the US, there is no single AI whistleblower law; employees who raise concerns together may be protected under the National Labor Relations Act.
EU: what the Whistleblower Directive covers
Directive (EU) 2019/1937 sets common minimum standards for protecting people who report breaches of EU law in listed areas (Directive (EU) 2019/1937). Article 2 lists them, and several touch on AI at work: product safety and compliance, consumer protection, and the protection of privacy and personal data and the security of network and information systems.
The AI Act adds a direct link. Article 87 says Directive (EU) 2019/1937 shall apply to the reporting of infringements of the AI Act and the protection of persons reporting such infringements (Regulation (EU) 2024/1689, Article 87). Article 87 sits in Chapter IX, which applies from 2 August 2026 under Article 113. Examples of AI Act infringements a worker might see include a prohibited practice such as emotion recognition in the workplace (Article 5(1)(f)), or, once the high-risk deployer duties apply to employment systems from 2 December 2027 (as amended by Regulation (EU) 2026/1744), an employer putting a high-risk AI system into use at work without first informing workers' representatives and the affected workers (Article 26(7)). Separately, Article 85 lets any person who considers the AI Act has been infringed submit a complaint to the relevant market surveillance authority.
Who is protected
Article 4 covers people who acquired information on breaches in a work-related context, including at least:
- workers, including civil servants;
- self-employed people;
- shareholders and members of management or supervisory bodies, volunteers and paid or unpaid trainees;
- anyone working under the supervision and direction of contractors, subcontractors and suppliers.
It also covers people whose work relationship has ended, and job candidates who learned of a breach during recruitment.
Conditions and channels
Under Article 6, a reporting person qualifies for protection if they had reasonable grounds to believe the information was true at the time of reporting and fell within the Directive's scope, and they reported internally, externally or by public disclosure as the Directive sets out. A report can include reasonable suspicions about actual or potential breaches (Article 5).
- Internal channels: private sector employers with 50 or more workers must set up internal reporting channels (Article 8). The report must be acknowledged within seven days, and feedback given within a reasonable timeframe not exceeding three months (Article 9).
- External channels: people can also report directly to the authorities each Member State designates, which must acknowledge receipt within seven days and give feedback within three months, or six months in duly justified cases (Article 11).
- Public disclosure: protected only in set cases, such as when internal and external reports led to no appropriate action in time, or there are reasonable grounds to believe there is an imminent or manifest danger to the public interest, or, where the person reported externally, a risk of retaliation or a low prospect of the breach being effectively addressed (Article 15).
The identity of the reporting person must not be disclosed beyond authorised staff without their explicit consent, apart from narrow legal exceptions (Article 16).
Protection against retaliation
Article 19 prohibits retaliation, including threats and attempts. Its list includes dismissal, demotion or withheld promotion, a change in working hours, a negative performance assessment, disciplinary measures, harassment, and discrimination. That matters where AI tools score or rank staff: a sudden drop in an automated rating after a report could fall within this list. In proceedings about a detriment, once the person shows they reported and suffered a detriment, it is presumed to be retaliation, and whoever took the measure must prove it was based on duly justified grounds (Article 21(5)). Rights under the Directive cannot be waived by any agreement, policy or condition of employment (Article 24).
The Directive had to be transposed by 17 December 2021, with internal channel rules for employers of 50 to 249 workers by 17 December 2023 (Article 26). Each country applies it through its own law, so the local rules, authorities and any extra protections differ. The UK is outside the Directive and has its own rules; see UK whistleblowing law and AI.
United States
There is no federal whistleblower law specific to AI. For most private sector employees, Section 7 of the National Labor Relations Act protects the right to engage in concerted activities for mutual aid or protection, and Section 8(a)(1) makes it an unfair labor practice to interfere with, restrain or coerce employees in exercising that right (NLRB, Section 7 and 8(a)(1)). The NLRB explains that activity is concerted if it is engaged in with or on the authority of other employees, not solely by and on behalf of one employee. Raising concerns about an AI system's effect on pay, workload or monitoring together with coworkers can fall within that. Many federal and state laws protect reports in specific sectors; check the rule that covers your situation.
Practical steps
- Workers: write down what you saw, when and which system, without taking data you are not allowed to access. Find out whether your employer has an internal channel and which authority handles external reports where you work. A union or representative can help; see AI and unions.
- Employers: make sure the internal channel accepts concerns about AI systems, that reports are handled by an impartial person, and that automated ratings of a reporting employee are reviewed by a person before any adverse decision.
See also AI at work and workers' rights, AI monitoring at work and, on disclosing confidential information to report wrongdoing, AI tools and trade secrets at work. This page is general information, not legal advice.
Questions and answers
Does EU whistleblower protection cover reports about AI?
Yes, for breaches within its scope. AI Act Article 87 says the Whistleblower Directive 2019/1937 applies to reporting infringements of the AI Act, and the Directive also covers areas such as product safety and personal data protection.
Do I have to report internally first?
No. Under the Directive you can report internally or go directly to the competent external authority. Public disclosure is protected only in the cases set out in Article 15.
What if my employer retaliates through an AI performance score?
Article 19 lists a negative performance assessment, demotion and disciplinary measures among prohibited retaliation, and Article 21(5) presumes a detriment after a report was retaliation unless whoever took the measure proves it was based on duly justified grounds.
Is there a US AI whistleblower law?
There is no federal law specific to AI. Private sector employees who act together to raise concerns may be protected by Section 7 of the National Labor Relations Act, and sector laws may also apply.