Binds: Operator (see the article)
All obligations
EU AI Act Art.87: Reporting of infringements and protection of reporting persons
Article 87 of the EU AI Act binds the operator (see the article). It requires Directive (EU) 2019/1937 applies to the reporting of infringements of this Regulation and to the protection of persons who report. This page states what it requires, who it binds and the evidence to keep. Browsing is free; the conformance kit is USD 499.
Specifics
| Instrument | Regulation (EU) 2024/1689 (the EU AI Act), as amended by Regulation (EU) 2026/1744 |
|---|---|
| Article | Art.87 |
| Binds | Operator (see the article) |
| Group | Post-Market Monitoring, Market Surveillance and Rights |
| Evidence items | 5 |
| Linked NIST AI RMF controls | 0 |
| Linked ISO/IEC 42001 controls | 2 |
| Last updated |
Who does Art.87 bind?
The article binds the operator (see the article). The Act places each duty on a named party in the value chain, so a system can carry a provider duty and a deployer duty at once. Confirm your own position against the text; this page names the party, it does not rule on your facts.
Applies with the high-risk regime: 2 December 2027 for stand-alone systems listed in Annex III, and 2 August 2028 for AI embedded in regulated products listed in Annex I (Article 113, as amended by Regulation (EU) 2026/1744). See the full timeline.
What does Art.87 require?
Directive (EU) 2019/1937 applies to the reporting of infringements of this Regulation and to the protection of persons who report them. An organisation within the scope of that Directive must therefore make its internal reporting channels and procedures available for infringements of this Regulation, acknowledge and follow up such reports within the timeframes that Directive sets, preserve the confidentiality of the reporting person's identity, and protect reporting persons against retaliation on the same terms as for the other areas of Union law the Directive covers.
This is our plain-language statement of the article, not the text of the regulation. Read the article: Art.87 (Regulation (EU) 2024/1689 on EUR-Lex).
What evidence should we keep for Art.87?
| Category | Evidence to keep |
|---|---|
| Whistleblowing | Internal reporting channel documentation showing infringements of this Regulation are within its declared scope |
| Whistleblowing | The published description of the reporting procedure, naming AI Act infringements among the reportable matters |
| Whistleblowing | Acknowledgement and follow-up records evidencing the Directive's timeframes are met for AI related reports |
| Whistleblowing | Training or communication showing staff know AI Act infringements can be raised through the channel |
| Whistleblowing | Non-retaliation measures, and records of protection applied to any reporting person |
What does a linked control mean here?
A linked control is a NIST AI RMF or ISO/IEC 42001 control that the held rule set records as a topical match, with a confidence and a one-line reason. It does not establish that meeting one requirement satisfies the other, it is not legal advice, and it is not certification. Where no control is recorded, the page says so and does not guess. Sources: the NIST AI RMF and ISO/IEC 42001.
Which NIST AI RMF controls line up with Art.87?
No NIST AI RMF control is recorded as a match for this obligation in the held rule set. It is left unlinked and marked, never guessed.
Which ISO/IEC 42001 controls line up with Art.87?
2 controls in the held rule set is recorded as a topical match for this obligation, each with its confidence and reason.
| Control | ISO/IEC 42001 | Confidence |
|---|---|---|
A.3.3 | Reporting of concerns Internal reporting channels for AI Act infringements, with confidentiality and protection from retaliation. | high |
A.8.3 | External reporting Whistleblower channels accept infringement reports from workers and contractors, not the public. | medium |
What does the conformance kit add for Art.87?
The kit renders this obligation into your own role checklist with the evidence register, the linked controls and a CSV export, for USD 499 one off. See what is in the kit or open it.