An internal channel, where the Directive requires one
The duty comes from the Whistleblower Directive: private entities with 50 or more workers, and public bodies. AI Act reports belong in that channel, not in a second one.
EU AI Act — Article 87
EU AI Act whistleblowing: confidential reporting for AI violations.
Since 2 August 2026, Article 87 of the EU AI Act applies the Whistleblower Directive (2019/1937) to infringements of the AI Act. Ashio gives organizations that already run a channel a secure, anonymous way to take AI reports, with the case record behind them.
Last reviewed: October 7, 2026
Overview
What does the AI Act require for whistleblowing?
Adopted in 2024, the EU AI Act (Regulation 2024/1689) is the world's first comprehensive AI regulation. Its Article 87 does one thing: it applies the EU Whistleblower Directive (2019/1937) to infringements of the AI Act. People who report bias, unsafe deployment or other AI breaches are therefore protected on the same terms as other EU-law reporters, and organizations that already run an internal channel handle AI reports through it. The AI Act does not create a second reporting regime.
Key Requirements
What Article 87 means for organizations.
Because the AI Act borrows the Whistleblower Directive rather than inventing new rules, the obligations are the ones that framework already sets:
Protection against retaliation
Reporting an AI Act infringement carries the Directive's protection: no dismissal, demotion, withheld promotion or other detriment for raising a concern.
Acknowledgment in 7 days, feedback in 3 months
Similar to the EU Whistleblower Directive, reports should be acknowledged within 7 days with follow-up within 3 months of the acknowledgment.
Comprehensive documentation
All AI-related reports, investigations, and outcomes must be documented to demonstrate compliance during regulatory reviews.
How Ashio helps
Meet AI Act reporting requirements with Ashio.
Ashio is a ready-to-use whistleblowing platform for the Whistleblower Directive, the framework Article 87 applies to AI reports.
Anonymous & confidential intake
Reporters can flag AI violations anonymously — no IP tracking, no cookies, no identifying data collected.
Audit-ready documentation
Every report, status change, and follow-up action is timestamped and logged in an immutable audit trail.
Deadline tracking built in
Automatic tracking of the 7-day acknowledgment and 3-month feedback deadlines, including on reports filed under the AI Act category.
FAQ
Common questions about AI Act whistleblowing.
Who has to handle AI Act reports?+
Organizations the Whistleblower Directive already covers: private entities with 50 or more workers, and public bodies. If you run a channel for other EU-law reports, AI Act infringements belong in it. Deploying high-risk AI does not by itself create a channel duty.
Is this separate from the EU Whistleblower Directive?+
No. There is no second regime to add. Article 87 applies the existing Whistleblower Directive to AI Act infringements, so you extend the channel you already have instead of building another one. In Ashio that is one category inside the same case workflow, with its own routing and audit trail.
When does the AI Act take effect?+
The AI Act was adopted in August 2024 and applies in stages: general-purpose AI rules from August 2025, most of the Act including high-risk obligations from August 2026, and the remaining product rules from August 2027. Article 87 has applied since 2 August 2026.
Can we use the same channel for AI Act and Whistleblower Directive reports?+
Yes, and that is the intended design. One channel, with AI Act reports kept in their own category so routing, access and audit trail stay clean.
What are the requirements of the EU AI Act?+
The EU AI Act (Regulation (EU) 2024/1689) sets tiered requirements based on risk: prohibited AI practices are banned outright; high-risk AI systems must meet transparency, data governance, human oversight and documentation obligations; and general-purpose AI models must provide technical documentation and EU copyright summaries. Reporting of AI Act infringements runs through the Whistleblower Directive framework that Article 87 applies, and Ashio provides that channel.
EU directives covered
Related compliance guides.
Explore Ashio's coverage of each EU regulation.
EU Whistleblowing Compliance
One platform for every EU directive — NIS2, AI Act, CSRD, CSDDD, Pay Transparency, ISO 37002.
Read moreEU Whistleblower Directive
Requirements, deadlines, and penalties under Directive 2019/1937.
Read moreNIS2 Incident Reporting
Cybersecurity incident reporting timelines and internal channels.
Read moreISO 37002:2021
How Ashio aligns with the global whistleblowing standard.
Read moreReady for Article 87?
Set up a reporting channel that covers AI Act infringements and the rest of the Whistleblower Directive in one place, in minutes.