Infringement Reporting

Legal Framework

Article 87 of the AI Act establishes the infringement reporting framework by directly incorporating Directive (EU) 2019/1937 — the EU Whistleblower Directive — into the AI Act's enforcement architecture. This means that the procedural and protective standards governing whistleblower reports under that Directive apply in full to violations of the AI Act. The Directive requires Member States to establish internal and external reporting channels, mandate acknowledgment of reports within prescribed timeframes, and provide feedback to reporters. Critically, it imposes confidentiality obligations on the identity of reporters and any third parties named in a report, and it establishes a robust anti-retaliation regime covering dismissal, demotion, intimidation, and other forms of professional reprisal.

The framework intersects with broader transparency obligations under adjacent digital regulation. Article 24 of the Digital Services Act imposes transparency reporting duties on providers of online platforms, and Article 42 DSA extends transparency obligations more broadly across the DSA's scope. These provisions create a layered ecosystem where infringement reporting obligations under the AI Act operate alongside — but remain distinct from — transparency and disclosure duties under the DSA.

The GDPR provides a complementary data protection dimension. Article 15 GDPR governs data subject access rights, which may intersect with infringement reports when individuals seek information about whether their personal data has been processed in connection with a complaint. Article 23 GDPR permits Member States to restrict certain data subject rights for reasons of substantial public interest, which can encompass the protection of whistleblower identities. Article 24 GDPR encourages certification mechanisms as compliance tools, relevant where organizations seek to demonstrate the adequacy of their internal reporting channels.

Key Developments

The CJEU's reasoning in Meta Platforms and Others v Bundeskartellamt reinforces that adequate security of systems processing personal data — including databases used for managing public documents and infringement reports — requires protection measures extending to the electronic components and infrastructure supporting those systems. This establishes that organizations cannot treat reporting channel security as merely a procedural matter; the underlying technical infrastructure must meet substantive security thresholds.

Enforcement by national DPAs illustrates the financial stakes of non-compliance with adjacent reporting and transparency obligations. The Croatian DPA (AZOP) imposed a €4.5 million fine on a telecommunications operator for multiple GDPR violations, signaling that failures in reporting infrastructure and data handling attract significant penalties. The Italian Garante's fine against FT Solutions S.r.l. for direct marketing violations further demonstrates that authorities actively pursue entities that mishandle personal data within reporting or complaint ecosystems.

The EDPB's Guidelines 01/2021 and the revised Guidelines 9/2022 on personal data breach notification provide practical benchmarks that inform how infringement reports involving personal data should be managed, particularly regarding timeliness and documentation.

Practical Guidance

• Establish dedicated internal reporting channels compliant with Directive (EU) 2019/1937 standards, ensuring reports can be submitted in writing or orally, with confirmation of receipt issued within seven days and feedback provided within three months.

• Implement strict confidentiality protocols protecting the identity of reporters and all third parties mentioned in reports, applying Article 23 GDPR restrictions where national law permits, to shield whistleblower identities from access requests.

• Conduct a security assessment of reporting infrastructure — including databases, communication channels, and storage systems — to meet the substantive security standards articulated in Meta Platforms v Bundeskartellamt, covering both software and hardware components.

• Document anti-retaliation safeguards in employment policies and contracts, explicitly covering all forms of professional reprisal prohibited under the Whistleblower Directive, and train managers on these protections.

• Align AI Act infringement reporting with existing GDPR breach notification and DSA transparency reporting procedures to avoid fragmented compliance and ensure consistent treatment of overlapping obligations across regulatory regimes.