December 2025 – Europe has just introduced two significant developments that will directly affect how companies build, deploy, and oversee AI in 2026. One strengthens reporting. The other reshapes key compliance deadlines.
1. The AI act whistleblower tool is live—and it changes the game
The EU’s new AI Act Whistleblower Tool is officially online, allowing any individual professionally connected to an AI model provider to flag risky or unlawful practices linked to general-purpose AI models and certain regulated AI systems.
Reports can be submitted anonymously, in any EU language together with supporting documents via a secure inbox that also supports follow-up questions.
While the AI Office will maintain strict confidentiality, statutory protection against retaliation applies only from 2 August 2026 for reports on AI Act infringements. Until then, protection depends on whether the matter falls within the existing Whistleblower Directive. Certain AI-related areas, including consumer protection, product safety, data protection, and security already qualify, meaning some reports may benefit from protection even now.
The message is clear: companies must align their whistleblowing framework with the new AI-related risk landscape.
2. The “digital omnibus on AI” could reshape your compliance timeline
On 19 November 2025, the Commission proposed the “Digital Omnibus on AI”, a package of amendments designed to adjust, clarify, and streamline the AI Act before it fully applies on 2 August 2026.
Some of the key changes include:
- Extension of deadlines for high-risk AI requirements, postponed until the publication of harmonised standards;
- Longer grace period for legacy systems, including an additional six months (until 2 February 2027) for GenAI transparency obligations (such as watermarking);
- A broadened bias-mitigation exemption, allowing all providers and deployers to process sensitive data to reduce bias, regardless of the risk of the system;
- Elimination of the registration obligation for non-high-risk systems in Annex III;
- Exclusive supervisory authority granted to the AI Office for systems built on general-purpose AI models.
The Commission is currently seeking feedback on the proposal, with the consultation window open until 11 March 2026. Organisations likely to be affected by revised timelines or expanded obligations should consider submitting input, as this is one of the few opportunities to influence how the final Omnibus will shape the implementation of the AI Act.
Given the time constrains, without swift adoption, companies risk entering August 2026 with a framework that remains difficult to implement and insufficiently standardised.
Why this matters:
- Anonymous reporting will increase, so internal whistleblowing procedures need to be AI-ready.
- Compliance timelines may shift, meaning companies should reassess their AI systems and implementation plans.
- Supervision will tighten, especially for systems built on general-purpose AI models.