This section will detail each major step of the reporting channel: from incentivizing whistleblowers to come forth, to protecting their transmission of information to the verifier, to ensuring that the verifier tactfully handles and discloses the information.
Watch the below video to hear about the historical importance of whistleblowers—but also why individuals often don't say something when they see something.
Whistleblower Statutes
Already, there is legislation to protect whistleblowers in the context of preventing catastrophic risks from advanced AI models. Read the below California whistleblower protection statute, paying attention to what the statute does not say or leaves ambiguous: what types of disclosures does the statute not protect? Can you hypothesize why?
Read §§1107–1107.2 in full.
California Legislature (effective 2026) | 6–8 min
What the contract clause covers
The operative language says a developer "shall not … enter into a … contract that prevents a covered employee from disclosing." — California Labor Code §1107.1(a)
Read that sentence together with the statute's definition of a covered employee, its two protected subjects, and its named recipients. The protection attaches to disclosures within those conditions; it does not declare every NDA void for every disclosure. The separate AIWI/CARMA analysis of SB 53 also notes that the chapter does not expressly protect public disclosure.
Broader Standards in AI Whistleblowing
Beyond explicit statutory enactments, see the below AI Whistleblowing Law: Best Practice Guide for a more comprehensive framework for effective implementation of whistleblower protections. The core idea is: "whistleblower rights must override confidentiality/nondisclosure agreements." — AIWI/CARMA, Retaliation Protection
AI Whistleblowing Law: Best Practice Guide
Read the Introduction and all seven recommendation sections; stop before the biographies.
Abra Ganz and Karl Koch | AIWI and CARMA (2026) | 8–10 min
Can the Report Leave the Organization?
Even if a whistleblower has an incentive to report, it doesn't matter if there are physical barriers preventing them from disclosing the report, from monitored devices to surveillance.
Read the five proposals and the limitation that follows them.
Wasil et al. (2024) | 2 min
Baker proposes a similar solution against this problem of physical access, including visits to a building that the verifier physically secures, as you read earlier in Appendix A.8, "Whistleblower Programs".
Legal permission, a financial incentive, and a web form do not by themselves create a usable route. The route also has to survive monitored devices, physical surveillance, conflicts inside the receiving office, and the need for safe follow-up.
Mechanism to Effect
Sources: Wasil et al., SB 53, Business and Professions Code §22757.13(c), and ACM Code of Ethics §1.2.
After the Report Arrives
Once the verifier receives the report, there are still careful standards they should abide by to ensure that they protect, use, and disclose the report's information without compromising the reporter's confidentiality, the integrity of the evidence, or the fairness of what follows for the accused. Read the below excerpts from Quality Standards for Investigations for four key principles that a reliable verifier should adhere to.
Quality Standards for Investigations
Read the four qualitative standards: planning, execution, reporting, and information management.
Council of the Inspectors General on Integrity and Efficiency (2025) | 3–4 min
Below are five fragments of internal whistleblower policies. One question about what the quoted language does — and does not — establish follows each fragment. For each question, choose the one best answer. The answers appear after you submit the whole set.