Infringement Reporting Procedures and Mechanisms

Legal Framework

The legal framework for infringement reporting procedures under the AI Act is established by its Recital 172. This provision mandates that the reporting of infringements of the AI Act, and the protection of persons reporting such infringements, falls under the scope of Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law (the Whistleblowing Directive). The recital explicitly requires that this Directive applies to AI Act violations, thereby importing its comprehensive procedural and protective mechanisms into the AI regulatory regime. Concurrently, for entities within its scope, the NIS2 Directive imposes specific cybersecurity incident reporting obligations, which may intersect with reporting related to AI system security breaches.

Practical Application

The practical application centers on the mandatory implementation of the Whistleblowing Directive's requirements for relevant entities. Organizations must establish secure and confidential internal reporting channels and procedures for receiving and following up on reports of AI Act infringements. This includes designating an impartial person or department to handle reports, maintaining strict confidentiality to protect the whistleblower's identity, and providing feedback to the reporting person within prescribed timeframes. The protection against retaliation—covering dismissal, demotion, intimidation, and other forms of unfair treatment—is a core component. In practice, this means an employee reporting a prohibited AI practice, a data breach involving an AI system, or non-compliance with transparency obligations must be shielded from reprisals. The interaction with NIS2 reporting timelines and authorities must also be managed, particularly where an incident triggers obligations under both regimes.

Key Considerations

• Channel Integration: Entities must integrate AI-specific infringement reporting into their existing or newly established whistleblowing procedures required by the Whistleblowing Directive, ensuring staff are aware it covers AI Act breaches.
• Retaliation Safeguards: Implement concrete measures to prevent and remediate retaliation, including clear internal policies, training for managers, and accessible avenues for whistleblowers to challenge retaliatory acts.
• Dual Reporting Triggers: Establish internal protocols to assess whether a single event, such as a security breach of a high-risk AI system, triggers a separate, mandatory incident report to the CSIRT under NIS2 alongside the whistleblowing channel report.