Whistleblowing · EU AI Act
Updated 6 October 2026 · German HinSchG incl. § 2(1) no. 10
Anyone who spots a breach of the AI Act can report it through the channels of the Whistleblower Directive – and is then protected against retaliation. This page sorts out the four reporting routes that are routinely confused around AI and shows what an internal reporting channel needs to handle AI-related reports.
Reporting routes at a glance
Diagram · not a product view
Diagram
Internal reporting office
§§ 12–18 HinSchG
Employees → the company’s office
External reporting office
§§ 19, 28 HinSchG
Reporting person → federal office (BfJ)
Complaint
Art. 85 AI Act
Anyone → market surveillance
Incident report
Art. 73 AI Act
Provider → market surveillance
Only the first two routes are whistleblowing procedures with protection under whistleblower law.
Short answer
Article 87 AI Act applies the Whistleblower Directive (EU) 2019/1937 to breaches of the AI Act; in Germany, § 2(1) no. 10 HinSchG has listed them explicitly since 2026. Employers with, as a rule, 50 or more employees need an internal reporting channel: acknowledgement within 7 days, feedback within 3 months. Externally, the Federal Office of Justice is generally competent.
Context
The AI Act (Regulation (EU) 2024/1689) relies on authorities, documentation and companies’ own controls. Many breaches, however, are first noticed by someone on the inside: the developer who realises that a candidate-ranking tool went live without the promised human review; the sales manager asked to roll out a chatbot that never discloses it is an AI; the contractor who notices that logs are being deleted. Article 87 AI Act addresses exactly this: the reporting of such breaches and the protection of reporting persons are governed by Directive (EU) 2019/1937.
Each member state transposes the Directive into national law. In Germany this is the Hinweisgeberschutzgesetz (HinSchG). Its material scope in § 2(1) has contained a dedicated number 10 for breaches of the AI Act since 2026. There is no longer any need to argue whether an AI breach is “covered” via product safety, data protection or consumer law – the AI Act as a whole is in scope, from the prohibited practices in Article 5 and the transparency duties in Article 50 to the obligations for high-risk AI systems. Other member states’ laws must meet the same minimum standards of the Directive; this page uses the German law as the worked example.
For companies this does not mean setting up a second reporting channel. The existing internal reporting office is also responsible for AI-related reports. It must, however, be able to handle them: what counts as a breach of the AI Act, who in the organisation knows the system concerned, which logs must be secured, and is there a parallel reporting duty of the company itself – such as a serious-incident report under Article 73 or a personal data breach notification under Article 33 GDPR? These interfaces are what this page is about.
Legal basis
Whistleblower protection for AI is an interplay of the AI Act, the EU Directive, national transposition and the companies’ own reporting duties. The table shows which provision governs what and what it means in practice. German provisions are given as the example of national law.
Scroll the table sideways →
| Provision | Content | Applies to | In practice |
|---|---|---|---|
| Art. 87 AI Act | Directive (EU) 2019/1937 applies to the reporting of breaches of the AI Act and to the protection of persons reporting such breaches. | All member states, all organisations | The bridge between AI law and whistleblower protection; the details sit in national law. |
| Directive 2019/1937, Art. 9 | Internal reporting channels: acknowledge receipt within 7 days, give feedback within a reasonable timeframe not exceeding 3 months. | Member states when transposing | Minimum standard every national law must meet. |
| § 2(1) no. 10 HinSchG | German material scope includes breaches of Regulation (EU) 2024/1689 (added in 2026). | Reporting persons, reporting offices | AI breaches are covered without a detour through other areas of law. |
| § 1, § 3(3) and (8) HinSchG | Protects natural persons who obtained information on breaches in a work-related context; reasonable suspicion is enough. | Employees, applicants, contractors, suppliers | Customers without a professional connection are not covered. |
| § 7 HinSchG | Free choice between internal and external reporting; internal reporting should be preferred where it can be effective and no retaliation is feared. | Reporting persons, employers | Employers must not obstruct the external route but should encourage internal reports. |
| §§ 8, 9 HinSchG | Confidentiality of the identity of the reporting person, the persons concerned and anyone else named; narrow exceptions. | Reporting offices and supporting staff | Experts may support, but learn the identity only where necessary. |
| § 11 HinSchG | All reports are documented; deletion three years after the procedure closes, longer only where necessary and proportionate. | Reporting offices | A separate deletion routine for report files, apart from the incident register. |
| §§ 12, 14 HinSchG | Internal reporting office from, as a rule, 50 employees (certain financial firms regardless of headcount); joint office possible for 50–249 employees; third parties may operate the office. | Employers | The duty to remedy and to give feedback stays with each individual employer. |
| § 15 HinSchG | Independence, the necessary expertise, no conflicts of interest. | Employers | Build or bring in AI Act expertise for AI-related reports. |
| §§ 16, 17 HinSchG | Reports orally or in text form, in-person meeting on request; acknowledgement within 7 days, feedback within 3 months. | Internal reporting office | Track deadlines; the office “should” also handle anonymous reports. |
| § 19(4), §§ 20–23 HinSchG | Federal external reporting office at the Federal Office of Justice (BfJ), unless a special office (federal states, BaFin, Federal Cartel Office) is competent. | Reporting persons | §§ 20–23 name no special office for AI Act breaches – so generally the BfJ. |
| §§ 36, 40 HinSchG | Ban on retaliation with reversed burden of proof; fines up to €50,000 (retaliation, obstruction, breach of confidentiality) or €20,000 (no internal office). | Employers, managers | Train managers: a detriment after a report is presumed to be retaliation. |
| Art. 85 AI Act, § 8 KI-MIG | Any natural or legal person may lodge a complaint with the market surveillance authority; in Germany the Federal Network Agency is the central complaints office. | Anyone | A complaint is not a whistleblowing procedure – it does not by itself trigger HinSchG protection. |
| Art. 73, Art. 26(5) AI Act | Providers report serious incidents involving high-risk AI systems (no later than 15, 10 or 2 days); deployers immediately inform the provider and the authorities. | Providers, deployers | The company’s own duty, regardless of any report; high-risk obligations apply from 2 Dec 2027 or 2 Aug 2028. |
| Art. 33 GDPR | Notify a personal data breach to the supervisory authority without undue delay and, where feasible, within 72 hours. | Controllers | A report can start the 72-hour clock once the company becomes aware. |
Checked on 6 October 2026 against the consolidated AI Act (after Regulation (EU) 2026/1744), the HinSchG as amended on 25 September 2026 and the KI-MIG (Federal Law Gazette 2026 I no. 223). In other member states, their own transposition laws for Directive 2019/1937 apply.
How it works
The procedure follows § 17 HinSchG, which mirrors Article 9 of the Directive. AI-related reports add two checks: whether a separate reporting duty of the company is running in parallel, and which technical traces need securing before anyone changes the system.
The report arrives orally, in text form or, on request, in a personal meeting. Only the responsible and supporting staff have access to the channel.
The acknowledgement must reach the reporting person within seven days at the latest. For anonymous channels, use the agreed return channel.
Does the report fall under § 2 HinSchG? For AI topics this is usually clear via no. 10; data protection, product safety or criminal law may also apply.
If the report points to a serious incident involving a high-risk AI system or a personal data breach, the company must check its own deadlines – without passing on the reporting person’s identity.
Secure logs, model version, configuration and input data before the system is modified. For serious incidents, the system must not be altered in a way that could affect a later evaluation of the causes before the authorities are informed.
Internal investigation, questions to the reporting person, referral to an investigations unit or an authority – or closure for lack of evidence.
No later than three months after acknowledgement: planned and completed follow-up action with reasons, insofar as investigations and third-party rights are not affected.
Close the procedure with documentation. The report file is deleted three years after closure unless longer retention is necessary and proportionate.
External reporting offices work similarly under § 28 HinSchG: acknowledgement within seven days at the latest, feedback after three months at the latest, six months for extensive cases.
Four routes
Around AI there are four routes by which information reaches an authority or office. They differ in who reports, to whom, with which deadline and with what protection. Mixing them up means missed deadlines or compromised confidentiality.
Scroll the table sideways →
| Route | Who reports | To whom | Legal basis | Deadline | Protection |
|---|---|---|---|---|---|
| Report to the internal reporting office | Employees, agency workers; if the channel is opened, also external persons with a work-related connection | The company’s internal office (an employee, a team or a mandated third party) | Art. 87 AI Act, §§ 12–18 HinSchG | Acknowledge ≤ 7 days, feedback ≤ 3 months | Confidentiality, ban on retaliation, reversed burden of proof |
| Report to the external reporting office | As above, plus persons whose employer has no internal channel | Federal external office at the BfJ, unless a special office is competent | §§ 19–31 HinSchG | Acknowledge ≤ 7 days, feedback ≤ 3 months (extensive: 6) | As internal; free choice under § 7 |
| Complaint to market surveillance | Any natural or legal person, including customers and associations | Market surveillance authority; in Germany the central complaints office at the Federal Network Agency | Art. 85 AI Act, § 8 KI-MIG | No deadline in Art. 85 | No HinSchG protection from the complaint alone |
| Serious-incident report | Providers of high-risk AI systems; deployers inform providers and authorities | Market surveillance authority of the member state where the incident occurred | Art. 73, Art. 26(5) AI Act | ≤ 15 days; death ≤ 10; widespread infringement or critical infrastructure ≤ 2 | Duty of the company, no personal protection |
| For comparison: data breach | Controller under the GDPR | Data protection supervisory authority | Art. 33 GDPR | Without undue delay, where feasible within 72 hours | Duty of the company, no personal protection |
One set of facts can trigger several routes at once: a report about a concealed incident is a whistleblowing case – and may at the same time reveal the provider’s duty under Art. 73 and a data breach under Art. 33 GDPR.
Distinctions
The four routes serve different purposes. Separating them clearly helps when you organise the reporting office.
A natural person with a work-related connection reports information on an actual or potential breach – reasonable suspicion is enough. They choose whether to report internally or externally. Protection does not depend on the suspicion being confirmed, but on their having had reasonable grounds to believe the information was true.
Anyone, including a customer or a consumer association, can complain to the market surveillance authority. The authority takes the complaint into account in its supervision. That is not a formal whistleblowing procedure with a feedback deadline and the confidentiality rules of the HinSchG.
The provider of a high-risk AI system reports a serious incident to the authority itself. This duty exists whether or not anyone has blown the whistle. Concealing it is itself a reportable breach.
A company that only deploys a high-risk AI system immediately informs first the provider, then the importer or distributor and the market surveillance authorities of a serious incident. If the provider cannot be reached, Art. 73 applies mutatis mutandis.
Where personal data are affected, the GDPR’s 72-hour clock starts when the controller becomes aware. A report can create that awareness – which is why the reporting office must know when to pass the facts to data protection.
People affected by a decision based on a high-risk AI system listed in Annex III can request an explanation (except Annex III point 2). That, too, is not a whistleblowing report but a right against the deployer.
Examples
The following examples are invented but realistic. They show what kind of information can fall under the AI Act limb of whistleblower law and what the reporting office should check first in each case.
A team lead reports that a tool analyses employees’ mood during calls and feeds it into performance reviews. Emotion recognition in the workplace is in principle prohibited under Article 5 (exceptions for medical or safety reasons). First check: is the system live, and who approved it?
A developer reports that the new customer chat was deliberately designed so users cannot tell they are talking to an AI. The transparency duties of Article 50 have applied since 2 August 2026. First check: was it approved, and which notices are live?
An HR employee reports that rejections are sent automatically even though the internal policy requires a human review. First check: does the system fall under Annex III point 4, and which oversight measures are documented? High-risk obligations for Annex III apply from 2 December 2027.
A manufacturer’s service technician reports that a malfunction of an AI-based safety component led to a serious injury and that management decided to “wait and see”. First check: is this a serious incident under Article 3(49), and is the Art. 73 deadline running?
An external contractor reports that automatically generated logs of a high-risk system are overwritten after a few days. Providers and deployers must keep logs for at least six months (Art. 19, Art. 26(6)). First check: retention period and backup, immediately.
A project manager reports that test results were left out of a reply to market surveillance. Supplying incorrect, incomplete or misleading information to authorities is subject to fines under Article 99. First check: which documents were sent, and who signed them off?
All examples are constructed. Whether a breach exists in the individual case is for the reporting office to assess with the necessary expertise – the reporting person does not need to be able to judge that.
Channel check
Four questions, one overview: which routes are open, which deadlines apply and what the company concerned must have in place. The check is based on German law (HinSchG, KI-MIG) and gives orientation – it does not replace an assessment of the individual case.
Result: reporting routes
Not all questions answered yet
Answer the first three questions to see suitable routes, deadlines and duties.
Simplified assessment under the HinSchG, AI Act, KI-MIG and GDPR, as of 6 October 2026. Not legal advice; special rules (e.g. § 4 HinSchG for financial supervision, state-level offices, other member states’ laws) are not covered.
Set-up
Whistleblower law does not require an AI department. It does require expertise (§ 15(2) HinSchG) and the authority to examine reports and take follow-up action (§ 12(4)). For AI-related reports this means in practice: the office needs access to knowledge and to technical traces without giving up confidentiality.
Recommendation: keep the reporting office itself small – one person or a small team with a deputy, internal or a mandated third party. Complement it with a fixed list of experts who can be brought in case by case: the AI lead or AI officer, the data protection officer, IT security and the owners of the systems concerned. Under § 8(1) sentence 2 HinSchG, supporting persons may learn the identity where it is needed for the task – usually it is not. For the technical assessment the facts are normally enough.
Expertise in the AI Act does not mean knowing every article by heart. The office should, however, recognise whether a report concerns a prohibited practice under Article 5, a transparency duty under Article 50, a high-risk system under Annex III or communication with authorities – and which deadlines then run in parallel. An up-to-date AI inventory helps: the office can see without asking around who owns a system, which risk class it has and whether the company is provider or deployer.
For companies with 50 to 249 employees, a joint reporting office with other private employers can make sense (§ 14(2) HinSchG). The duty to remedy the breach and to give feedback to the reporting person remains with each company, though. For AI-related reports in particular, the joint office therefore needs a clear contact in each company who has access to the systems.
Data protection
AI-related reports are technical and often contain more personal data than expected: names of developers, extracts from training data, screenshots of user accounts. Whistleblower law gives the reporting office the powers it needs but sets tight limits.
The reporting office may process personal data insofar as necessary for its tasks and, exceptionally, special categories such as health data – with specific safeguards (§ 10 HinSchG). The identity of the reporting person, of the persons concerned and of anyone else named stays confidential (§ 8). The office may disclose the reporting person’s identity only in the cases listed in § 9, for instance in criminal proceedings at the request of the prosecuting authorities or with separate consent in text form for each individual disclosure.
In practice this means a separation that matters particularly for AI: the report file with identity and correspondence stays in the reporting office. Only the facts go into the technical incident process, into tickets or into a compliance tool – which system, which behaviour, which period. Make sure the facts themselves do not allow conclusions about the person, for instance because only one person had access to the log in question.
Telephone reports may only be recorded or transcribed verbatim with consent; otherwise the office writes a summary of the content (§ 11(2)). Documentation is deleted three years after the procedure closes (§ 11(5)). That period applies to the report file, not automatically to technical records the company must keep under the AI Act anyway – such as logs for at least six months or a provider’s technical documentation for ten years.
Scroll the table sideways →
| Information | Stored in | Access | Retention |
|---|---|---|---|
| Identity of the reporting person, correspondence | Report file of the reporting office | Reporting office; supporting staff only where necessary | 3 years after closure (§ 11(5) HinSchG) |
| Facts without identity (system, behaviour, period) | Incident process / incident register | AI lead, system owners | Per the incident process’s own deletion rule |
| Secured logs of the AI system | System logs | IT / system owners | At least 6 months (Art. 19, Art. 26(6) AI Act), longer during an investigation |
| Notification to an authority (Art. 73, Art. 33) | The company’s incident file | Owners of authority communication | Per the company’s documentation duties |
Recommendation: align GDPR information duties towards persons concerned and a possible data protection impact assessment for the whistleblowing system with your data protection officer.
Interface
The reporting office assesses whether a breach exists. Whether the company itself must notify anything is decided in the incident process. Both must mesh without the reporting person’s identity travelling along.
The critical moment is awareness. For Art. 73 the deadline runs from the provider becoming aware of the serious incident; for Art. 33 GDPR from the controller becoming aware of the breach. If the reporting office learns of a possible serious incident, it should therefore pass the facts to the responsible function immediately – not only after finishing its own assessment. Recommendation: decide in advance who receives this hand-over and that it happens without names.
Conversely, the incident process must not undermine the reporting office. If the whistleblower is “found” via the incident process – for example because tickets are created with names – that breaches the confidentiality rule, which carries fines of up to €50,000 if intentional or reckless and up to €10,000 if negligent. Treat the hand-over as an interface with a fixed format: what is passed on, who receives it, and what status the office needs back for its own feedback to the reporting person.
Scroll the table sideways →
| Step | Reporting office | Incident process |
|---|---|---|
| Report of a possible serious incident | Hand over the facts without identity immediately | Document awareness, check deadline under Art. 73 or Art. 26(5) |
| Report of a possible data breach | Facts to data protection | Check the 72-hour deadline under Art. 33 GDPR |
| Technical assessment | Formulate questions, file answers in the report file | Secure logs, analysis by system owners |
| Measures | Record follow-up action | Implement corrective action, update risk assessment |
| Feedback | Feedback to the reporting person within 3 months | Status of measures to the reporting office |
Common mistakes
Breaches of the AI Act are expressly in scope. A reporting office that “refers” such reports back to IT leaves the protected procedure.
Telling employees to “complain to the Federal Network Agency” may cost them whistleblower protection. In Germany the external office for reports is generally the BfJ.
Art. 73 and Art. 33 GDPR are the company’s own duties. A report can trigger them but does not replace them – and the deadlines run from awareness.
Hastily changing the model or configuration after a report may destroy the traces needed to evaluate the causes (Art. 73(6)).
The identity belongs in the report file, not in tickets, mailing lists or project chats. A single distribution list is enough for a breach of confidentiality.
Conflicts of interest under § 15(1) arise quickly when the person who approved a system assesses the report about it.
Seven days to acknowledge is short, especially over public holidays. Without reminders and a deputy the deadline is regularly missed.
Without a duty to run an internal office, external reporting and the ban on retaliation still apply. A simple voluntary channel is usually the better choice (recommendation).
And SimpleAct?
SimpleAct is neither a whistleblowing system nor a reporting office. To receive reports you need your own confidential channel. SimpleAct comes in where no identity is needed: the facts about an AI system, the investigation and the evidence.
The Art. 73 report itself is filed outside the platform. Recommendation: put only the facts into SimpleAct – no names or details that could point to the reporting person. Based on the product documentation (incident management, audit trail, data breaches, authority cases).
FAQ
More questions? We're happy to help. Send email · Get started
Updated: · SimpleAct editorial team
This page is for orientation only and is not legal advice. Whether a breach exists and which duties apply to your organisation depends on the individual case; consult your legal advisers where necessary.
Reports stay with your reporting office. For the inventory, risk assessment and incident capture of your AI systems, there is SimpleAct.
