Reporting AI problems at work: UK whistleblowing law

A worker who sees an AI system break the law, endanger people or hide its own failures may want to say so. In England, Wales and Scotland, the protection for doing that is in Part IVA of the Employment Rights Act 1996, often called the whistleblowing rules. This page explains what counts as a protected disclosure, who to make it to, and what happens if the worker is punished for it. For the EU rules, see AI and whistleblowing at work.

The short answer: a worker is protected when they disclose information that they reasonably believe is in the public interest and tends to show one of seven kinds of wrongdoing, such as a breach of a legal obligation or a danger to health or safety, and they tell the right person in the right way. Telling the employer is the simplest route. Detriment for making the disclosure is unlawful, dismissal for it is automatically unfair with no minimum length of service, and contract terms that try to stop a protected disclosure are void.

What counts as a qualifying disclosure

Under section 43B, a qualifying disclosure is any disclosure of information which, in the reasonable belief of the worker, is made in the public interest and tends to show that (ERA 1996, s43B):

• a criminal offence has been, is being or is likely to be committed;
• a person has failed, is failing or is likely to fail to comply with a legal obligation;
• a miscarriage of justice has occurred or is likely to occur;
• the health or safety of any individual has been, is being or is likely to be endangered;
• sexual harassment has occurred, is occurring or is likely to occur (added from 6 April 2026; see the duty to prevent sexual harassment);
• the environment has been or is likely to be damaged; or
• information about any of these is being or is likely to be deliberately concealed.

It does not matter whether the failure happens in the UK or elsewhere, or which country's law applies (s43B(2)). For AI at work, the legal obligation point is often the relevant one: a screening tool that discriminates contrary to the Equality Act 2010 (see UK equality law and AI, and on protection for alleging discrimination, victimisation), personal data processed without a lawful basis, or a machine control system run without the risk assessment health and safety law requires (see AI and health and safety in the UK). The worker needs a reasonable belief, not proof. A disclosure is not protected if making it is itself a criminal offence (s43B(3)).

Who to tell

A qualifying disclosure becomes a protected disclosure when it is made in one of the ways set out in sections 43C to 43H (s43A).

• The employer: the main route (s43C). If the worker reasonably believes the failure relates solely or mainly to someone else, such as the vendor of the AI system, they can tell that person. Using a procedure the employer has authorised counts as telling the employer (s43C).
• A prescribed person: a regulator listed in the Public Interest Disclosure (Prescribed Persons) Order 2014, for matters in its area, if the worker reasonably believes the information is substantially true (s43F). The list includes the Information Commission for data protection, the Health and Safety Executive, the Competition and Markets Authority for consumer matters and the Commission for Equality and Human Rights (SI 2014/2418, Schedule).
• Wider disclosure: going to others, such as the media, is protected only in narrower cases. Under s43G the worker must reasonably believe the information is substantially true, not act for personal gain, and meet a condition such as having already raised it with the employer or a prescribed person, or reasonably fearing detriment or a cover up. It must also be reasonable in all the circumstances (s43G). Section 43H covers failures of an exceptionally serious nature (s43H).

In practice, raise it with the employer first unless there is a clear reason not to, and keep a copy of what was said and when.

Who is protected

The rules protect workers, and section 43K stretches that word further than usual for this Part. It includes, for example, people supplied to do work by a third party, such as an agency, where the terms are in practice set by the end user or the agency rather than by the person themselves (s43K). That matters for contractors who label or test AI systems through an intermediary. On who counts as a worker in general, see AI, platforms and UK worker status.

Protection from detriment and dismissal

A worker has the right not to suffer any detriment by any act, or deliberate failure to act, by the employer on the ground that they made a protected disclosure. The same applies to acts by fellow workers or the employer's agents, and the employer is liable for those too; for acts by other workers, it has a defence if it took all reasonable steps to prevent them (s47B(1B) and (1D)). A lowered automated rating, fewer shifts allocated by a scheduling system, or exclusion from work could all be detriments if they were done because of the disclosure. On a complaint, it is for the employer to show the ground on which it acted (s48(2)).

An employee dismissed because they made a protected disclosure is regarded as unfairly dismissed (s103A), and the usual qualifying period of service does not apply (s108(3)(ff)). An employee in that position can also apply for interim relief, which must be presented within seven days after the effective date of termination (s128(2)). See also AI and unfair dismissal in the UK.

Any term in an agreement between a worker and employer, including a settlement agreement, is void in so far as it tries to stop the worker making a protected disclosure (s43J).

Time limits

From 1 October 2026, the time limit for a detriment complaint under s48 and an unfair dismissal claim under s111 is six months, up from three months. The longer limit does not apply where the act complained of, or the relevant date, falls before 1 October 2026 (s48(3), SI 2026/954, regulations 3 and 4). Early conciliation through Acas normally comes first. Interim relief keeps its own seven day limit.

Practical steps

• Workers: write down what the system did, when, and why you think it is unlawful or dangerous, without taking data you are not allowed to access. Raise it in writing with the employer or through its whistleblowing procedure, and keep a copy. If you are then treated worse, note the dates.
• Employers: make sure the whistleblowing policy covers concerns about AI systems and vendors, and that a person reviews any automated rating, shift change or flag affecting someone who has raised a concern before it is acted on. Check that settlement and confidentiality terms do not try to stop protected disclosures.

This page covers England, Wales and Scotland; Northern Ireland has separate rules. It is general information, not legal advice.