EU launches world’s first whistleblower mailbox for AI
EU AI Office banner (European Commission)
The European Commission has broken new ground today by announcing a new external channel for AI whistleblowing, something Blueprint and other organisations have been advocating for for some time.
Since the public launch of OpenAI's ChatGPT in late 2022, the potential of AI technologies - and the potential threats they pose - have been at the forefront of public debate. We have written previously about the risks presented by the militarisation of AI, and those risks are mirrored in many other sectors.
Notwithstanding these widespread concerns, there have as yet been very few attempts to regulate this new technology on a formal, legal basis. In passing the AI Act in May 2024, the European Union has arguably the most rigorous system of oversight for artifical intelligence that currently exists globally.
The AI Act places duties on the the developers of the most advanced AI models to assess the risks their products might present and take measures to alieviate them. The oversight of these general purpose AI models (GPAI) lies with the EU, and specifically the Union's new AI Office.
As the case of Lukasz Krupski - our 2023 Blueprint Europe Whistleblowing Prize winner - illustrates, disclosures from insiders are absolutely vital for regulators investigating powerful companies.
The AI Act is coming into force gradually, starting this summer, and includes a statement that the 2019 Whistleblower Directive applies to the new Act.
However, until the European Commission's announcement today, it was unclear whether AI whistleblowers with reports about the biggest, most powerful AI models would be able to safely express their concerns to the EU AI Office.
The EU has now launched the first dedicated external channel for AI whistleblowers. This is the first specialised AI whistleblowing channel to be established anywhere in the world. The channel will accept reports about AI models but also about the internal governance of AI companies or “other activities that could endanger fundamental rights, health, or public trust.”
The new EU channel will offer advice about the whistleblowing process and keep whistleblowers updated. It will advise when reports about less powerful systems are better sent to member state agencies and initiate investigations where it looks like the AI Act may have been breached.
While the channel is operative beginning today, the Office's powers to protect whistleblowers from retaliation where there was a "reasonable cause" for their report begin in August 2026. Before this date, whistleblowers will have to rely on the AI Office's commitment to keeping their identity confidential.
As the AI Office has a remit over all AI products available in the EU, AI workers in the US will also be able to use this whistleblowing channel, though the Office will have no ability to protect these workers from retaliation. Nevertheless
To ensure that AI technologies are as safe as possible, and that their developers are held to proper standards, we urge other countries to follow the example the European Commission has set today. California's SB53 does not meet this standard. External channels for AI must be comprehensive, accessible, anonymous and adequately staffed to understand the technical issues raised.