Article 30
Aanmeldingsprocedure
Infringement Reporting Procedures and Mechanisms
This new topic is needed because the content specifically addresses the procedures, mechanisms, and requirements for reporting infringements of AI Act requirements, which is a distinct procedural framework not adequately covered by existing topics.
infringement reporting violation reporting non-compliance reporting reporting mechanism reporting procedure reporting channel infringement notification breach reporting
Overview
Legal Framework
The legal framework for infringement reporting procedures under the AI Act is established by its Recital 172. This provision mandates that the reporting of infringements of the AI Act, and the protection of persons reporting such infringements, falls under the scope of Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law (the Whistleblowing Directive). The recital explicitly requires that this Directive applies to AI Act violations, thereby importing its comprehensive procedural and protective mechanisms into the AI regulatory regime. Concurrently, for entities within its scope, the NIS2 Directive imposes specific cybersecurity incident reporting obligations, which may intersect with reporting related to AI system security breaches.
Practical Application
The practical application centers on the mandatory implementation of the Whistleblowing Directive's requirements for relevant entities. Organizations must establish secure and confidential internal reporting channels and procedures for receiving and following up on reports of AI Act infringements. This includes designating an impartial person or department to handle reports, maintaining strict confidentiality to protect the whistleblower's identity, and providing feedback to the reporting person within prescribed timeframes. The protection against retaliation—covering dismissal, demotion, intimidation, and other forms of unfair treatment—is a core component. In practice, this means an employee reporting a prohibited AI practice, a data breach involving an AI system, or non-compliance with transparency obligations must be shielded from reprisals. The interaction with NIS2 reporting timelines and authorities must also be managed, particularly where an incident triggers obligations under both regimes.
Key Considerations
- Channel Integration: Entities must integrate AI-specific infringement reporting into their existing or newly established whistleblowing procedures required by the Whistleblowing Directive, ensuring staff are aware it covers AI Act breaches.
- Retaliation Safeguards: Implement concrete measures to prevent and remediate retaliation, including clear internal policies, training for managers, and accessible avenues for whistleblowers to challenge retaliatory acts.
- Dual Reporting Triggers: Establish internal protocols to assess whether a single event, such as a security breach of a high-risk AI system, triggers a separate, mandatory incident report to the CSIRT under NIS2 alongside the whistleblowing channel report.
Laws (30)
View all 30Article 87
Melding van inbreuken en bescherming van melders
Recital 172
Recital 22
Recital 24
Recital 25
CYBERSECURITY RISK-MANAGEMENT MEASURES AND REPORTING OBLIGATIONS
Recital 93
Recital 95
Recital 102
Recital 127
Recital 137
Article 23
Reporting obligations
Recital 28
Recital 31
Recital 74
Recital 76
Recital 83
Recital 106
Recital 4
Guidance (9)
Versiegeschiedenis
guidelines meldplicht datalekken
Richtsnoeren 4/2019 inzake artikel 25 Gegevensbescherming door ontwerp en door standaardinstellingen
guidelines privacy by design en default
Richtsnoeren 01/2021
Guidelines 1/2019 on Codes of Conduct and Monitoring Bodies under Regulation 2016/679
Guidelines on codes of conduct and monitoring bodies
Guidelines 9/2022 on personal data breach notification under GDPR
Guidelines on personal data breach notification under GDPR
VERSIEGESCHIEDENIS
binding corporate rules voor verwerkingsverantwoordelijken
Richtsnoeren 1/2019 voor gedragscodes en toezichthoudende organen in de zin van Verordening 2016/679
guidelines gedragscodes en toezichthoudende organen
Richtsnoeren 3/2022 betreffende het herkennen en vermijden van misleidende ontwerppatronen in de interfaces van socialemediaplatforms
guidelines misleidende ontwerppatronen
Deze richtsnoeren bieden praktische aanbevelingen aan aanbieders van sociale media als verwerkingsverantwoordelijken van sociale media, ontwerpers en gebruikers van socialemediaplatforms, over het beoordelen en vermijden van zogenaamde 'misleidende ontwerp patronen' in de interfaces van sociale media die inbreuk maken op de vereisten van de AVG. Daartoe beveelt de EDPB aan dat verwerkingsverantwoordelijken gebruikmaken van interdisciplinaire teams, bestaande uit onder meer ontwerpers, func...
Richtsnoeren 07/2020 over de begrippen 'verwerkingsverantwoordelijke' en 'verwerker' in de AVG
guidelines over de begrippen 'verwerkingsverantwoordelijke' en 'verwerker' in de AVG
De begrippen 'verwerkingsverantwoordelijke', 'gezamenlijke verwerkingsverantwoordelijke' en 'verwerker' spelen een cruciale rol bij de toepassing van de algemene verordening gegevensbescherming (AVG, Verordening (EU) 2016/679), aangezien ermee wordt bepaald wie verantwoordelijk is voor de naleving van verschillende gegevensbeschermingsregels en op welke wijze betrokkenen hun rechten in de praktijk kunnen uitoefenen. De precieze betekenis van deze begrippen en de criteria voor de jui...
News (3)
Can organizations realize efficiencies by combining DPO and whistleblower roles?
> Following the implementation of the EU Whistleblower Directive in 2021, companies' data protection officers were tasked with setting up secure reporting channels. As these data protection and whistleblowing systems are exercised by the same unit, is it reasonable for companies to combine the DPO and whistleblower roles? PBK Technology Compliance and Operational Risk consultant František Nonnemann, CIPP/E, lays out the commonalities between DPOs and whistleblowing officer
Can the roles of DPO and whistleblowing officer be merged?
> Personal data protection and whistleblowing are two different topics — different regulations with different purposes, scope and requirements. But, in fact, they are closer than they seem, especially for practical reasons. Both data protection governance and whistleblowing systems are often exercised by the same unit — the compliance department — or even by the same person. This solution offers several advantages, but also some problematic points that need to be highligh
Europese Commissie presenteert nieuwe regels om seksueel misbruik van kinderen op internet te voorkomen en te bestrijden
The proposed rules would require online service providers to detect, report and remove child sexual abuse material on their services. Those providers must also assess the risk of their services being used to distribute child sexual abuse material. A new European Center on Child Sexual Abuse will provide support to providers, law enforcement and victims.