The EU AI Act is no longer just a proposal, it is the reality. With the GPAI Code of Practice officially published in July 2025 and provider obligations in force since August, the "safety valves" of the regulation are now live.
Real accountability in Artificial Intelligence requires more than just technical benchmarks; it requires a robust "speak-up" culture where concerns can be raised without fear.
Here is how the finalized framework protects those who raise the alarm:
1. The "Safety Valve" is Legal Law (Whistleblowing Directive)
The AI Act explicitly extends the EU Whistleblowing Directive to cover AI infringements according to recital 172.
- Who is covered? Employees, contractors, and external consultants.
- The Protection: If you report a breach, you are legally shielded across the EU from retaliation, including dismissal, demotion, or legal threats (NDAs cannot silence you on regulatory breaches).
- Timing: While the directive’s full transposition for AI specifics hits in 2026, reports on existing EU law violations (data protection, product safety) are protected now.
2. The New Operational Standard (GPAI Code of Practice)
The Code of Practice is the playbook for General-Purpose AI. While voluntary in name, it is the primary way for providers to demonstrate they are compliant with the law.
- Internal Culture: The Code mandates that providers of systemic-risk models must foster a non-retaliatory internal governance culture.
- Transparency: Signatories effectively commit to making their whistleblower policies visible and accessible (e.g., published on websites) to ensure workers know their rights.
- Presumption of Conformity: Providers who adhere to these standards are presumed to be compliant meaning a failure to protect whistleblowers could now directly endanger their regulatory standing.
3. Direct & Anonymous Reporting (The Official Tool)
To bridge the gap between internal alerts and regulatory action, the European AI Office has operationalized a specific channel for reporting systemic risks.
- The Tool: https://ai-act-whistleblower.integrityline.app
- How it works: This encrypted platform allows for anonymous, two-way communication. You can submit evidence of high-risk failures or systemic breaches directly to the regulator without revealing your identity, ensuring that safety signals don't get lost in corporate bureaucracy.
4. The "Public Watchdog" Power (Article 85)
You don’t have to be an employee to act. Article 85 of the AI Act democratizes enforcement by granting any natural or legal person the right to lodge a complaint with a Market Surveillance Authority.
- No "Injury" Required: Unlike some laws that require you to prove personal harm, Article 85 allows you to file a complaint based on grounds to consider that an infringement has occurred.
- Systemic Impact: This empowers civil society, researchers, and competitors to alert authorities to biased algorithms, unsafe deployments, or opaque practices.
Why This Matters Now
We are past the theoretical stage. As of late 2025, the infrastructure for accountability is active. To maintain Europe’s leadership in trustworthy AI, we need to ensure that the experts building these systems feel safe enough to hit the brakes when necessary.