Is this legal advice?

No. It is educational information to help you understand your options. Whistleblower law is complex and fact-specific, so speak to a qualified employment lawyer or a whistleblowing charity before you act, especially before external or public disclosure.

Should I report internally first?

Usually yes, where it is safe to do so. Internal reporting often keeps your legal protection strongest and creates a record. But if internal channels are compromised or the risk is severe and ongoing, a regulator may be the right first step.

How do I report anonymously?

Use channels designed for it — secure organisational tip lines, a regulator's confidential reporting route, or tools like SecureDrop for journalists. Research and contact them from personal devices and accounts, not employer-monitored systems.

What evidence should I preserve?

Document the specific concern, who is affected, and any internal response. Keep relevant logs, eval results, or public claims that could be edited later — but do not remove originals or copy personal data beyond what is strictly necessary.

Are AI-specific whistleblower protections emerging?

Yes. The EU AI Act includes reporting channels, and regulators increasingly treat AI safety, bias, and deceptive-claims concerns as reportable. Existing whistleblower laws like the UK's PIDA already cover many AI-related disclosures.

What is the AI Whistleblower Protection Guide?

Learn how to safely report AI safety, ethics, or legal violations at your organization or to regulators — covering whistleblower protections by jurisdiction, anonymous reporting channels, evidence preservation, and regulatory contacts. It runs free in your browser on Gera Tools, with nothing uploaded.

AI Whistleblower Protection Guide

Name: AI Whistleblower Protection Guide
Creator: Gera Tools
License: https://creativecommons.org/licenses/by/4.0/

AI whistleblower protection guide

If you’ve seen something at an AI company that crosses a line — a suppressed safety eval, a privacy breach, biased outputs shipped anyway, or deceptive claims to investors — speaking up is daunting and the rules are confusing. This guide explains the protections that apply where you are, how to preserve evidence, and which channels keep you safest, so you can make an informed decision rather than a fearful one.

What kinds of AI concerns can be reported

The concerns that most commonly arise in AI development contexts include:

Safety evaluation suppression — evals that showed harmful outputs were minimised, reframed, or not disclosed to the public or regulators alongside model releases. This concern falls under the EU AI Act’s safety reporting obligations and, in the US, may involve the FTC or relevant sectoral regulators depending on the deployment context.

Privacy and data-protection breaches — training on data without consent, failing to honour deletion requests, or processing personal data without a lawful basis. These are reportable to data-protection authorities (ICO in the UK, national DPAs in EU member states, FTC for some US privacy obligations).

Discriminatory or biased outputs — AI systems that disadvantage protected groups in employment, housing, credit, or other regulated contexts. Reportable to equality bodies, financial regulators, and in the EU, to market-surveillance authorities under the AI Act.

Deceptive claims — material misstatements to investors, regulators, or the public about capabilities, safety properties, or compliance status.

Legal or regulatory breaches — violations of sector-specific law (financial services, healthcare, employment) involving AI systems.

How it works

You select your jurisdiction (UK, EU, US, or other) and the type of concern. The tool surfaces the relevant laws and the protections they give — for example the UK’s PIDA, the EU Whistleblower Directive and AI Act reporting channels, or US sector statutes — and explains how those protections work in practice. It then provides concern-specific steps for documenting and routing the issue, general guidance on internal-versus-external and anonymous reporting, and a list of regulators matched to the concern (data-protection authorities, financial regulators, safety bodies).

How protection works in practice

Protection under most whistleblower laws depends on:

The concern being of public interest — personal grievances or commercial disputes are not protected disclosures; safety, privacy, legality, and public harm are.
Belief in the facts — you must reasonably believe the information is true at the time of disclosure; you do not need to be certain.
The channel used — internal reporting to an appropriate person, then prescribed regulators if internal fails, and only then public disclosure (which carries the strictest conditions). Jumping straight to media rarely gets the strongest protection.
No illegal means — the means of obtaining the evidence matters; disclosures based on material accessed improperly are in more legally uncertain territory.

Protection means protection from retaliation (dismissal, demotion, harassment), not immunity from all employment consequences or from civil claims related to how evidence was obtained. Advice from a specialist before acting is important precisely because the contours of protection depend on the specific facts.

Tips and notes

Protect yourself first. Research and contact advisers from personal devices and accounts, never employer-monitored systems.
Internal first, usually. It typically keeps protection strongest and builds a record — unless internal channels are compromised or harm is severe.
Preserve, don’t exfiltrate. Keep evidence of the concern, but don’t remove originals or copy personal data beyond what’s strictly necessary.
Get advice before going external. A whistleblowing charity or employment lawyer can be the difference between protected and unprotected disclosure. This guide is educational, not legal advice.
Anonymous channels exist. Regulators, ethics hotlines, and tools like SecureDrop for journalists allow reporting without identity disclosure — research and contact them from personal devices only.