A technician notices that the company's sales chatbot never says it is an AI. An HR manager discovers that the new call-centre software "reads" the operators' emotions. Since 2 August 2026 both can report it with whistleblower safeguards: confidentiality, a ban on retaliation, dedicated channels. For the company the question is very concrete: can our reporting channel recognise and handle a report about artificial intelligence? In most of the procedures we see, AI is not even mentioned.
What changed on 2 August 2026
The AI Act (Regulation (EU) 2024/1689) devotes a one-sentence article to the subject. Article 87, in the "Remedies" section of Chapter IX, provides that "Directive (EU) 2019/1937 shall apply to the reporting of infringements of this Regulation and the protection of persons reporting such infringements". The rule has applied since 2 August 2026, the Regulation's general date of application; the Digital Omnibus (Regulation (EU) 2026/1744) postponed the obligations for high-risk systems but did not touch this article.
Until that date, anyone reporting an AI-related problem was protected only if the breach fell within an area the Directive already covered: product safety, consumer protection, personal data, network security. Now an infringement of the AI Act is reportable as such. Which infringements depends on the Regulation's timetable:
| AI Act obligations | Applicable from |
|---|---|
| Prohibited practices (Art. 5) | 2 February 2025 |
| Obligations of providers of general-purpose AI (GPAI) models | 2 August 2025 |
| Transparency obligations (Art. 50) | 2 August 2026 |
| Requirements and obligations for high-risk systems | 2 December 2027 (Annex III) and 2 August 2028 (Annex I) |
Who is protected, and on what conditions
In Italy the Directive is implemented by Legislative Decree 24/2023. Protection is not limited to employees: Article 3 includes self-employed workers and collaborators, freelancers and consultants, suppliers' workers, volunteers and trainees, shareholders and directors. It also covers people who acquired the information during recruitment or a probationary period, and former workers, and it extends to facilitators, colleagues and relatives who might suffer retaliation.
There are two conditions (Article 16): at the time of the report the person must have reasonable grounds to believe the information is true and within the scope of the rules, and must have used the channels provided. The personal motives behind the report are irrelevant. Well-founded suspicions about breaches that, on the basis of concrete elements, could be committed can also be reported.
The safeguards are robust: identity cannot be disclosed without consent (Article 12); any retaliation is prohibited and, in court, it is the employer who must prove that the contested measure is unrelated to the report (Article 17); retaliatory acts are void and a dismissed person is entitled to reinstatement (Article 19).
Where to report: internal channel, ANAC, AI Office
| Channel | Who runs it | When it is used | Timing |
|---|---|---|---|
| Internal | The company, through an autonomous and trained person or office, which may be external (Art. 4) | The ordinary route | Acknowledgement within 7 days, feedback within 3 months (Art. 5) |
| External | ANAC | Internal channel missing or non-compliant, internal report without follow-up, well-founded fear of retaliation or ineffective follow-up, imminent or manifest danger to the public interest (Art. 6) | Acknowledgement within 7 days, feedback within 3 months, 6 in justified cases (Art. 8) |
| AI Office | European Commission | AI Act infringements, in particular those of GPAI model providers | Confirmation of receipt within 7 working days |
| Public disclosure | — | Only in the cases of Art. 15: no feedback within the deadlines, imminent danger, risk of retaliation or of evidence being concealed | — |
If the breach falls outside its remit, ANAC forwards the report to the competent authority (Article 8(2)). For AI market surveillance, Law 132/2025 (Article 20) designated ACN. The AI Office channel, live since 24 November 2025, accepts reports, including anonymous ones, in any official EU language and allows a dialogue with the office without revealing one's identity.
Not to be confused with whistleblowing is the Article 85 complaint: any natural or legal person, including a customer or a competitor, can turn to the market surveillance authority. It does not require a work-related context and does not carry protection against retaliation.
The Italian knot: Legislative Decree 24/2023 does not name the AI Act
Article 87 is a cross-reference: it does not amend the Directive's annex, it states that the Directive "shall apply". Legislative Decree 24/2023, however, defines the reportable breaches of Union law through a list of acts and sectors (Article 2(1)(a)(3)). At the date of this article, the text of the decree in force does not expressly cite Regulation (EU) 2024/1689. Three practical considerations:
- Article 87 sits in a regulation, directly applicable in every Member State: the most common reading among commentators is that the decree must be applied as if it included the AI Act. An express clarification from the legislator or from ANAC would be useful and, to date, we are not aware of one;
- many AI-related breaches in any case fall within sectors the decree already lists: product safety and compliance, consumer protection, personal data, security of network and information systems;
- since 30 September 2026, Legislative Decree 160/2026 has added the new Article 25-vicies to Legislative Decree 231/2001: the AI-related crimes it refers to are relevant conduct for "231" purposes, and therefore reportable through the internal channel of every entity that has a compliance model.
Who must have a channel, and what can reach it, depends on the entity's size and organisation (Article 2(1)(q) and Article 3(2)):
| Company | Internal channel | AI-related reports |
|---|---|---|
| Average of at least 50 employees over the last year | Mandatory | Breaches of EU law, via internal channel, external channel and public disclosure; also "231" conduct if there is a compliance model |
| Fewer than 50 employees, with a "231" model | Mandatory | Only conduct relevant under Decree 231, only through the internal channel |
| Fewer than 50 employees, no "231" model | Generally not mandatory (except certain regulated sectors, such as financial services) | The Article 85 complaint and the AI Office channel remain available |
There is one operational conclusion: rejecting an AI-related report as "out of scope" is the riskiest choice the channel manager can make.
What to do in the company: six steps
- Update the scope of the procedure. Expressly name infringements of Regulation (EU) 2024/1689 among the reportable ones, with a few recognisable examples: a use prohibited by Article 5, an undisclosed chatbot or synthetic content, a system used outside the provider's instructions.
- Update the notice. Article 5 requires clear information on the internal channel and on the external ones, visible in the workplace and on the website, accessible to consultants and suppliers too. Add AI and, alongside ANAC, the AI Office channel.
- Train whoever runs the channel. The law requires "specifically trained" staff (Article 4): today that also means being able to recognise a prohibited practice or a missed transparency obligation. ANAC's Guidelines on internal channels (Resolution No 478 of 26 November 2025) give specific attention to the role of the channel manager and to training.
- Define the technical investigation. An AI-related report requires skills the channel manager rarely has: decide in advance who supports them (AI lead, DPO, IT) and how, without revealing the reporter's identity. The inventory of AI systems is the first document that will be needed.
- Align the "231" model. If the entity has one, the risk mapping must be updated to Article 25-vicies and the flow between the channel manager and the Supervisory Body must be clarified.
- Protect the reporter and keep the evidence. No unfavourable measure towards the person who reported; documentation kept for as long as necessary and in any case no more than five years from the outcome (Article 14); a record that deadlines were met.
The cost of inertia is defined. ANAC imposes fines from €10,000 to €50,000 for retaliation, obstructing a report or breaching confidentiality, and in the same range for missing channels, non-compliant procedures or reports left unexamined (Article 21). And a report that goes unheard internally now has three external recipients: ANAC, ACN, the AI Office.
Where to start
A well-handled internal report is the cheapest early-warning system a company can have on its use of AI: it arrives before the authority does, and from the people who see the system working every day. The first step is to check whether the procedure, the notice and the channel's skills can withstand a report about artificial intelligence. An independent gap assessment compares the whistleblowing channel with the inventory of AI systems and with the AI Act obligations already applicable, and returns a short list of corrections: what to write, whom to train, whom to involve when the first report arrives.