G-03
Governance & Documentation
Whistleblower & Anti-Retaliation Protections
Organizations subject to frontier model safety statutes must implement internal anonymous reporting mechanisms for employees who believe the organization's activities present a specific and substantial danger to public health or safety, and must prohibit retaliation against employees who make such disclosures internally or to external authorities.
Applies to DeveloperDeployerGovernment Sector Foundation Model
Bills — Enacted
0
unique bills
Bills — Proposed
23
Last Updated
2026-03-29
Core Obligation

Organizations subject to frontier model safety statutes must implement internal anonymous reporting mechanisms for employees who believe the organization's activities present a specific and substantial danger to public health or safety, and must prohibit retaliation against employees who make such disclosures internally or to external authorities.

Sub-Obligations4 sub-obligations
ID
Name & Description
Enacted
Proposed
G-03.1
Internal anonymous reporting channel The organization must provide a reasonable internal process through which covered employees may anonymously disclose information indicating a specific and substantial danger to public health or safety or a violation of applicable AI law. Must include a mechanism for submitting disclosures without revealing identity. For large frontier developers, the process must include mandatory status updates to the disclosing employee at least monthly, board-level escalation of unresolved disclosures, and protections ensuring the channel cannot be used to identify the disclosing employee.
0 enacted
5 proposed
G-03.2
Officer and director escalation Disclosures and responses through the internal reporting process must be shared with officers and directors on a regular cadence, except where the disclosure alleges wrongdoing by that officer or director.
0 enacted
2 proposed
G-03.3
Anti-retaliation prohibition and policy The organization must not retaliate against employees for making good-faith disclosures and must implement policies and contracts consistent with this prohibition. Employment contracts and NDAs may not prohibit protected disclosures.
0 enacted
23 proposed
G-03.4
Whistleblower Rights Notice Distribution Developers must post or annually distribute written notice to all covered employees of their whistleblower rights, with specific accommodation for remote workers and new employee onboarding.
0 enacted
6 proposed
Bills That Map This Requirement 23 bills
Bill
Status
Sub-Obligations
Section
Pending 2027-01-01
G-03.3
Labor Code § 2821(d)-(e)
Plain Language
Employers are prohibited from retaliating or discriminating against a health care worker who provides direct patient care in two scenarios: (1) the worker overrides or requests to override AI or technology output based on their professional judgment or to comply with applicable law (including civil rights law), or (2) the worker complies with the output of technology that the employer itself selected or approved. Workers who experience retaliation or discrimination may file a complaint with the Labor Commissioner. This creates a two-directional shield — a worker is protected both for overriding AI and for following it, provided the relevant conditions are met.
(d) An employer shall not retaliate or discriminate against a worker providing direct patient care based on both of the following: (1) The worker's override of, or request to override, the output of technology if, in the judgment of the worker acting in their scope of practice, such an override is appropriate for the patient, or as necessary to comply with applicable law, including civil rights law. (2) The worker's compliance with the output of technology if the technology was provided or approved by the worker's employer for patient care. (e) A worker who is subject to retaliation or discrimination in violation of this article has the right under this article to file a complaint with the Labor Commissioner against an employer who retaliates or discriminates against the worker.
Failed 2026-01-01
G-03.3
Lab. Code § 1530
Plain Language
Employers are prohibited from retaliating against workers in any way — including discharge, demotion, suspension, or discrimination — for exercising any right under this part. Protected activities include using or attempting to use ADS-related rights (data access, correction), filing complaints with the Labor Commissioner, cooperating in investigations, or assisting in enforcement. This is a broad anti-retaliation provision that covers both internal exercise of rights and external enforcement cooperation.
An employer shall not discharge, threaten to discharge, demote, suspend, or in any manner discriminate or retaliate against any worker for using or attempting to use their rights under this part, filing a complaint with the Labor Commissioner, alleging a violation of this part, cooperating in an investigation or prosecution of an alleged violation of this part, or any action taken by the worker to invoke or assist in any manner the enforcement of this part, or for exercising or attempting to exercise any right protected under this part.
Pending 2027-01-01
G-03.3
Lab. Code § 1526
Plain Language
Employers are prohibited from retaliating — through discharge, demotion, suspension, or any other form of discrimination — against workers who exercise their rights under this part, including filing complaints with the Labor Commissioner, alleging violations, cooperating with investigations or prosecutions, or taking any action to invoke enforcement. This is a broad anti-retaliation provision covering the full spectrum of worker activity under the bill. Unlike the frontier model whistleblower framework in G-03, this does not require an anonymous reporting mechanism — it is a pure anti-retaliation prohibition applicable to any worker exercising statutory rights.
An employer shall not discharge, threaten to discharge, demote, suspend, or in any manner discriminate or retaliate against any worker for using or attempting to use their rights under this part, filing a complaint with the Labor Commissioner, alleging a violation of this part, cooperating in an investigation or prosecution of an alleged violation of this part, or any action taken by the worker to invoke or assist in any manner the enforcement of this part, or for exercising or attempting to exercise any right protected under this part.
Pending 2026-10-01
G-03.3
Sec. 9
Plain Language
No employer, deployer, developer, labor organization, or any other person may retaliate against an applicant or employee for: filing a complaint or assisting in an investigation of violations of the automated decision provisions; objecting to or refusing to participate in activities the person reasonably believes violate the act; or exercising any rights under Sections 3 through 8. This is a broad anti-retaliation provision covering the full range of protected activities. It is independently actionable under Section 12's private right of action.
No employer, deployer, developer, labor organization or any other person shall discharge or in any manner discriminate or retaliate against, any applicant for employment or employee because such applicant or employee: (1) Filed a complaint, provided information or otherwise assisted in an investigation or proceeding concerning any alleged violation of sections 3 to 8 of this act; (2) Objected to or refused to participate in any activity that such applicant or employee reasonably believed to be in violation of sections 3 to 8 of this act; or (3) Exercised any rights granted under the provisions of sections 3 to 8 of this act.
Pending 2026-07-01
G-03.3
Iowa Code § 91F.7
Plain Language
Employers are prohibited from retaliating against employees in any way — including discharge, threats, demotion, suspension, or discrimination — for exercising rights under this chapter, filing complaints with the department, cooperating in investigations or prosecutions, or assisting with enforcement. This covers a broad range of protected activities and is not limited to internal reporting — it also protects employees who engage with external enforcement authorities.
An employer shall not discharge, threaten to discharge, demote, suspend, or in any manner discriminate or retaliate against any employee for using or attempting to exercise the employee's rights under this chapter, filing a complaint with the department alleging a violation of this chapter, cooperating in an investigation or prosecution of an alleged violation of this chapter, or taking any action to invoke or assist in any manner the enforcement of this chapter.
Pending 2026-01-01
G-03.3
Section 25
Plain Language
Employees are protected from termination, discipline, retaliation, or other adverse employment action when they refuse to follow an ADMS output, provided all five conditions are met: (1) the employee exercises independent professional judgment or holds state licensure/certification; (2) the employee has notified a supervisor that the output may cause harm, illegality, or counterproductive outcomes and the employer failed to correct it; (3) the employee is engaging in concerted activity for mutual aid and protection; (4) the refusal is made in good faith based on professional training, education, or experience; and (5) urgency prevents waiting for the employer to correct the output. All five conditions must be satisfied — this is a conjunctive test, not a list of alternative triggers.
An employee shall be protected from termination, disciplinary action, retaliation, or other adverse employment action for refusing to follow the output of an automated decision-making system if: (1) the employee exercises independent judgment and discretion in the employee's duties, or the employee's duties require State licensure, certification, or accreditation; (2) the employee notifies a supervisor or manager that the system's output may, in the employee's professional opinion, lead to harm, illegality, or an outcome contrary to the employer's goals, and the employer fails to correct the output; (3) the employee is engaging in concerted activity for the purpose of mutual aid and protection; (4) the employee refuses to follow the output in good faith based on training, education, or experience; and (5) due to urgency, there is insufficient time for correction.
Pending 2026-07-01
G-03.3
IC 22-5-10.4-14
Plain Language
Employers are prohibited from retaliating — including through intimidation, threats, coercion, or harassment — against any covered individual who exercises rights under this chapter, files a complaint (internally or to government), seeks assistance on worker privacy concerns, participates in proceedings, provides information, or testifies. The anti-retaliation protection extends to individuals acting at the covered individual's request and covers prospective witnesses ('is about to give' or 'is about to testify'). Violations carry enhanced statutory damages ($5,000–$100,000 per violation).
Sec. 14. An employer may not discriminate or retaliate, including through intimidation, threats, coercion, or harassment, against any covered individual: (1) for exercising or attempting to exercise any right provided under this chapter; or (2) because the covered individual or another individual acting at the request of the covered individual has: (A) filed a written or oral complaint to the employer or a federal, state, or local government entity of a violation of this chapter; (B) sought assistance or intervention with respect to a worker privacy related concern from the employer, a federal, state, or local government, or a worker representative; (C) instituted, caused to be instituted, or otherwise participated in any inquiry or proceeding under this chapter; (D) given, or is about to give, any information in connection with any inquiry or proceeding relating to any right provided under this chapter; or (E) testified, or is about to testify, in any inquiry or proceeding relating to any right provided under this chapter.
Pending 2026-08-01
G-03.3
R.S. 23:977
Plain Language
Employers are prohibited from retaliating — through discharge, demotion, suspension, discrimination, or any other adverse action — against workers who exercise any right under this Part, file complaints with Louisiana Works, cooperate in investigations or prosecutions, or otherwise assist enforcement. This is a broad anti-retaliation provision covering every worker right established by the statute, including data access, appeal, and complaint-filing rights.
An employer shall not discharge, threaten to discharge, demote, suspend, or discriminate or retaliate, in any manner, against any worker for using or attempting to exercise his rights pursuant to this Part, filing a complaint with Louisiana Works alleging a violation of this Part, cooperating in an investigation or prosecution of an alleged violation of this Part, or any action taken by the worker to invoke or assist in any manner for the enforcement of this Part, or for exercising or attempting to exercise any right protected pursuant to this Part.
Pending 2025-01-14
G-03.3
Ch. 149B § 6(a)
Plain Language
Employees who refuse to follow AI or automated decision system outputs are protected from retaliation if four conditions are met: (1) the employee holds independent professional judgment or their role requires state licensure/certification; (2) the employee notified their employer that the output could lead to harm, illegality, or violation of licensing requirements, and the employer failed to adjust; (3) the employee's refusal was in good faith based on professional knowledge or reasonable belief of harm; and (4) the urgency of the potential harm made it impractical to wait for department corrective action. This is a conditional anti-retaliation protection specific to AI output refusal by professionals and licensed workers.
a) An employee shall be protected from termination, disciplinary action, retaliation, or other adverse employment action for refusing to follow the output of an artificial intelligence system, automated decision system, algorithm, or other similar technology if the following conditions are met: i) The employee holds independent judgment and discretion in executing their work duties, or the work duties to be performed by the employee require licensure or certification by the commonwealth as a condition of employment, independent accreditation by the employer; ii) The employee has notified asupervisor, manager, or their employer that the output from the artificial intelligence system, automated decision system, algorithm, or other similar technology may, in the employee's professional opinion and/or educational or work related- experience, lead to harm of a natural person, damage to physical property, an illegal action, an action contrary to the licensure or certification requirements of the Federal government, commonwealth, or an applicable private licensing or certifying authority, or an outcome contrary to the goal of the employer, and the employer refused or otherwise failed to adjust the output; iii) The employee has refused to follow the output in good faith and with the knowledge or reasonable belief, based upon training, education, or experience, that the output would cause harm or have an adverse impact; and iv) Due to the urgency of the potential harm or adverse impact, there is not enough time for the output to be corrected through department action.
Pending 2026-01-01
G-03.3
Sec. 11(1)
Plain Language
Large developers may not retaliate — through discharge, threats, or any discrimination in compensation, terms, conditions, location, or privileges of employment — against an employee who reports or is about to report to a federal or state authority that the developer's activities pose a critical risk. The protection extends to reports made verbally or in writing and covers actions taken by individuals on behalf of the employee. The employee definition is broad, including contractors, subcontractors, unpaid advisors involved in risk assessment, and corporate officers. The only exception is if the employee knows the report is false.
(1) A large developer shall not discharge, threaten, or otherwise discriminate against an employee regarding the employee's compensation, terms, conditions, location, or privileges of employment because the employee, or an individual acting on behalf of the employee, reports or is about to report to an appropriate federal or state authority, verbally or in writing, information that indicates that the large developer's activities pose a critical risk, unless the employee knows that the report is false.
Pending 2026-01-01
G-03.1G-03.2G-03.4
Sec. 11(5)-(6)
Plain Language
Large developers must: (1) post notices and use other appropriate means to keep employees informed of their whistleblower protections and obligations; (2) maintain a reasonable anonymous internal reporting channel through which employees can disclose information about critical risks in good faith; and (3) provide monthly status updates to disclosing employees on the investigation and any responsive actions. Disclosures and updates must be retained for at least 7 years and shared with non-conflicted officers and directors at least quarterly. The notice obligation is ongoing — not a one-time posting — and the internal process must be functional and accessible, not merely documented.
(5) A large developer shall do both of the following: (a) Post notices and use other appropriate means to keep the large developer's employees informed of the employees' protections and obligations under this section. (b) Provide a reasonable internal process through which both of the following occur: (i) An employee may anonymously disclose information to the large developer if the employee believes in good faith that the information indicates the large developer's activities present a critical risk. (ii) A monthly update is given to the employee under subparagraph (i) regarding the status of the large developer's investigation of the disclosure and any actions taken by the large developer in response to the disclosure. (6) A large developer shall maintain the disclosures and updates provided under subsection (5)(b) for not less than 7 years after the date when the disclosure or update was created. Each disclosure and update must be shared with the officers and directors of the large developer who do not have a conflict of interest not less than once per quarter.
Pending 2026-08-01
G-03.3
Minn. Stat. § 181.9924, subd. 1(c)
Plain Language
Employers are prohibited from retaliating against workers who refuse to follow the output of an automated decision system when the worker has a reasonable, good-faith belief that following the output would cause harm, discrimination, or a legal violation. This creates a specific whistleblower-like protection for workers who exercise independent judgment to override AI outputs they believe to be harmful or unlawful.
(c) An employer must not retaliate against a worker in any way for refusing to follow the output of an automated decision system when the worker has a reasonable, good-faith belief that doing so would cause harm or discrimination or otherwise violate a law or regulation.
Pending 2026-08-01
G-03.3
Minn. Stat. § 181.9927, subd. 1
Plain Language
Employers are broadly prohibited from retaliating against any worker for exercising any rights under the automated decision systems provisions, including filing complaints, alleging violations, cooperating in investigations, or taking any action to invoke or enforce their rights. This anti-retaliation protection covers all statutory rights — pre-use notice, access, correction, appeal, and enforcement complaint — and protects both successful and attempted exercises of those rights.
Subdivision 1. Retaliation. An employer must not discharge, threaten to discharge, demote, suspend, or in any manner discriminate or retaliate against any worker for using or attempting to use the worker's rights under this section and sections 181.9922 to 181.9926, including but not limited to filing a complaint with the commissioner of labor and industry, alleging a violation, cooperating in an investigation or prosecution of an alleged violation, taking any action to invoke or assist in enforcing these rights, or exercising or attempting to exercise any of these rights.
Pending 2026-09-01
G-03.3
§ 181.9924, Subd. 1(c)
Plain Language
Employers are prohibited from retaliating against any worker who refuses to follow the output of an automated decision system based on a reasonable, good-faith belief that following the output would cause harm, discrimination, or a legal violation. This protects frontline workers and supervisors who override ADS recommendations when they believe compliance would be unlawful or harmful — a form of whistleblower protection specific to the ADS context.
(c) An employer must not retaliate against a worker in any way for refusing to follow the output of an automated decision system when the worker has a reasonable, good-faith belief that doing so would cause harm or discrimination or otherwise violate a law or regulation.
Pending 2026-09-01
G-03.3
§ 181.9927, Subd. 1
Plain Language
Employers are broadly prohibited from retaliating — through discharge, demotion, suspension, discrimination, or any other adverse action — against workers who exercise or attempt to exercise any rights under the ADS statute. Protected activities include filing complaints with the commissioner, alleging violations, cooperating in investigations, and invoking or assisting in enforcing the statute's rights. This is a comprehensive anti-retaliation provision covering the full scope of worker activity under the statute.
Subdivision 1. Retaliation. An employer must not discharge, threaten to discharge, demote, suspend, or in any manner discriminate or retaliate against any worker for using or attempting to use the worker's rights under this section and sections 181.9922 to 181.9926, including but not limited to filing a complaint with the commissioner of labor and industry, alleging a violation, cooperating in an investigation or prosecution of an alleged violation, taking any action to invoke or assist in enforcing these rights, or exercising or attempting to exercise any of these rights.
Failed 2027-01-01
G-03.3
Sec. 7(2)-(4)
Plain Language
Frontier developers and large chatbot providers are prohibited from retaliating against employees who report potential public safety dangers or violations of the act to the Attorney General, federal authorities, or authorized internal personnel. The anti-retaliation protection extends to employees who testify or participate in investigations. Employers cannot require employees or applicants to waive these protections as a condition of employment — any such waiver is void and unenforceable. Note that the scope of the 'employee' definition is limited to individuals employed by large frontier developers or large chatbot providers, even though subsections (2)-(4) refer more broadly to 'frontier developer or large chatbot provider.'
(2) A frontier developer or large chatbot provider shall not take adverse action against or otherwise penalize an employee for disclosing information to the Attorney General, a federal authority, a person with authority over the employee, or another employee who has authority to investigate, discover, or correct the reported issue, if the employee has reasonable cause to believe that the information discloses either of the following: (a) The frontier developer's or large chatbot provider's activities pose a specific and substantial danger to the public health or safety or to the health or safety of a minor; or (b) The frontier developer or large chatbot provider has violated the Transparency in Artificial Intelligence Risk Management Act. (3) A frontier developer or large chatbot provider shall not require an employee or applicant to waive or limit any protection granted under this section as a condition of continued employment or of applying for or receiving an offer of employment. Any agreement to waive any right or protection under the act is against the public policy of this state and is void and unenforceable. (4) A frontier developer or large chatbot provider shall not retaliate, discriminate or take adverse action against an employee or applicant because the employee or applicant testifies, assists, or participates in an investigation, proceeding, or action concerning a violation of the Transparency in Artificial Intelligence Risk Management Act.
Failed 2027-01-01
G-03.1G-03.2
Sec. 7(5)(a)-(b)
Plain Language
Large frontier developers must establish an internal anonymous reporting process for employees who believe in good faith that the developer's activities pose a specific and substantial threat to public health or safety (including the safety of minors) or that the developer has violated the act. The process must provide monthly status updates to the disclosing employee on the investigation and response. Disclosures and responses must be shared with officers and directors at least quarterly — except that if a disclosure alleges wrongdoing by a specific officer or director, that person is excluded from receiving the report.
(5)(a) A large frontier developer shall provide a reasonable internal process through which an employee may anonymously disclose information to the large frontier developer if the employee believes in good faith that the information indicates that the large frontier developer's activities (i) pose a specific and substantial threat to the public health or safety or to the health or safety of a minor or (b) that the large frontier developer or large chatbot provider has violated the Transparency in Artificial Intelligence Risk Management Act. Such internal process shall include providing a monthly update to the person who made the disclosure regarding the status of the large frontier developer's investigation of the disclosure and the actions taken by the large frontier developer in response to the disclosure. Except as provided in subdivision (ii) of this subsection, the disclosures and responses of the process required by this subdivision shall be shared with officers and directors of the large frontier developer at least once each quarter. (b) If an employee has alleged wrongdoing by an officer or director of the large frontier developer in a disclosure or response, subdivision (a) of this subsection shall not apply with respect to that officer or director.
Failed 2027-01-01
G-03.3
Sec. 7(6)
Plain Language
Employees or applicants who suffer retaliation for protected whistleblower activity may bring a civil action in district court within one year of the violation or its discovery, whichever is later. Successful plaintiffs may recover temporary or permanent injunctive relief, general and special damages, and reasonable attorney's fees and costs. This is the only private right of action in the act — it is limited to whistleblower retaliation claims and does not extend to general violations of the act.
(6) Upon violation of this section, an aggrieved employee or applicant may, in addition to any other available remedy, institute a civil action within one year after the date of the alleged violation or the discovery of the alleged violation, whichever is later. The employee or applicant shall file an action directly in the district court of the county where such alleged violation occurred. The district court shall file and try such case as any other civil action, and any successful complainant shall be entitled to appropriate relief, including temporary or permanent injunctive relief, general and special damages, and reasonable attorney's fees and court costs.
Plain Language
Employees who exercise independent judgment or hold state licensure/certification may not be discharged or retaliated against for refusing to follow AI system outputs, provided they act in good faith based on professional opinion or work experience and either: (1) notified the employer that the output is likely to cause harm, illegality, or licensure jeopardy, and the employer refused to adjust without a written explanation; or (2) refused the output due to urgency when there was not enough time for the employer to correct it. This functions as a professional judgment override and whistleblower protection — licensed professionals and employees with discretionary authority have a protected right to refuse AI outputs they reasonably believe would cause harm.
10. No employer or public entity shall discharge, or otherwise retaliate against an employee with respect to any terms and conditions of work, because the employee refused to follow the output of an AEDS, ABSDS, or other artificial intelligence system, automated decision system, algorithm, or other similar technology, if the following conditions are met: a. the employee holds independent judgment and discretion in executing their work duties, or the work duties performed by the employee require licensure or certification by the State as a condition of employment, or independent accreditation by the employer or public entity; and b. (1) the employee has notified a supervisor, manager, or other agent of the employer or public entity that the employee has made, in good faith and with the knowledge or reasonable belief based upon professional opinion or educational or work related experience, a determination that the output from the AEDS, ABSDS, or other artificial intelligence system, automated decision system, algorithm, or other similar technology is likely to result in harm to an employee, service beneficiary, or other individual, damage to physical property, an illegal action, or an action contrary to the licensure or certification requirements of the federal government, the State, or other applicable private licensing or certifying authority which may result in a revocation or suspension of the employee's licensure or certification, but the employer or public entity, refused or otherwise failed to adjust the output without providing a reasonable written explanation documenting its reasons for not making an adjustment; or (2) the employee has refused to follow the output in good faith and with the knowledge or reasonable belief, based upon professional opinion or educational or work-related experience that the output would cause harm or have an adverse impact, and due to the urgency of the potential harm or adverse impact, there is not enough time for the output to be corrected through action of the employer or public entity.
Plain Language
Employers, public entities, vendors, and contractors may not retaliate against employees, applicants, or service beneficiaries for disclosing violations of the act, filing complaints with state agencies, or exercising any rights provided under the act. This is a comprehensive anti-retaliation provision covering both internal and external disclosures as well as the exercise of individual rights.
No employer or public entity, vendor, or contractor acting on behalf of the employer or public entity shall: l. Make an employment-related decision which adversely affects an employee or applicant for employment, or an action which adversely affects a service beneficiary, in retaliation against the employee, applicant, or beneficiary for disclosing, or filing a complaint with a State agency, for a violation by the employer or public entity of any provision of this act, or taking an adverse action in retaliation against the employee, applicant or service beneficiary for exercising any rights provided by this act.
Pending 2025-09-02
G-03.3
Gen. Bus. Law § 1422(1)-(2)
Plain Language
Large developers, their contractors, and subcontractors must not prevent or retaliate against employees who disclose or threaten to disclose information to the developer itself or to the Attorney General indicating that the developer's activities pose an unreasonable or substantial risk of critical harm. The protection applies even if the employer is in full compliance with applicable law — the standard is the employee's reasonable cause to believe a risk exists, not actual noncompliance. 'Employee' is defined broadly to include contractors, subcontractors, unpaid advisors involved in critical harm risk work, and corporate officers. Employees harmed by retaliation may petition a court for temporary or preliminary injunctive relief. Note that the Attorney General also has enforcement authority with penalties up to $10,000 per employee per violation.
A large developer or a contractor or subcontractor of a large developer shall not prevent an employee from disclosing, or threatening to disclose, or retaliate against an employee for disclosing or threatening to disclose, information to the large developer or the attorney general, if the employee has reasonable cause to believe that the large developer's activities pose an unreasonable or substantial risk of critical harm, regardless of the employer's compliance with applicable law. 2. An employee harmed by a violation of this section may petition a court for appropriate temporary or preliminary injunctive relief.
Pending 2025-09-02
G-03.4
Gen. Bus. Law § 1422(3)
Plain Language
Large developers must provide written notice to all employees of their whistleblower protections, rights, and obligations under this article. The notice must be provided within 90 days of the act's effective date (or 90 days of becoming a large developer), at the start of each new employee's employment, and by conspicuous physical posting in well-lighted, easily accessible areas frequented by employees. The statute does not specifically address remote workers or electronic distribution, which may require supplemental compliance measures for distributed workforces.
A large developer shall inform employees of their protections, rights and obligations under this article within ninety days of the effective date of this article or of becoming a large developer, whichever is later, upon commencement of employment, and by posting a notice thereof. Such notice shall be posted conspicuously in easily accessible and well-lighted places customarily frequented by employees.
Pending 2026-06-09
G-03.1G-03.3
Civ. Rights Law § 86-b(1)–(2), (4)–(5)
Plain Language
Developers and deployers of high-risk AI systems must not prevent employees — including former employees and independent contractors — from disclosing suspected violations to the Attorney General, including through employment terms or NDAs, and must not retaliate against employees who make such disclosures. Each developer and deployer must also provide an anonymous internal reporting process for employees who believe the entity has violated Article 8-A, any other law, or has made false or misleading statements about its risk management program. The internal process must include at least monthly status updates to the disclosing employee. Employees harmed by retaliation may petition a court for relief under Labor Law § 740(5), and nothing in this section limits protections under that law.
1. Developers and/or deployers of high-risk AI systems shall not: (a) prevent any of their employees from disclosing information to the attorney general, including through terms and conditions of employment or seeking to enforce terms and conditions of employment, if the employee has reasonable cause to believe the information indicates a violation of this article; or (b) retaliate against an employee for disclosing information to the attorney general pursuant to this section. 2. An employee harmed by a violation of this article may petition a court for appropriate relief as provided in subdivision five of section seven hundred forty of the labor law. 4. Each developer and deployer shall provide a reasonable internal process through which an employee may anonymously disclose information to the developer or deployer if the employee believes in good faith that the information indicates that the developer or deployer has violated any provision of this article or any other law, or has made false or materially misleading statements related to its risk management policy and program, or failed to disclose known risks to employees, including, at a minimum, a monthly update to the person who made the disclosure regarding the status of the developer's or deployer's investigation of the disclosure and the actions taken by the developer or deployer in response to the disclosure. 5. This section does not limit protections provided to employees under section seven hundred forty of the labor law.
Pending 2026-06-09
G-03.4
Civ. Rights Law § 86-b(3)
Plain Language
Developers and deployers must provide clear notice to all employees working on high-risk AI systems of their rights and responsibilities under Article 8-A, including the right of contractor and subcontractor employees to use the developer's internal disclosure process. A presumption of compliance attaches if the entity either (a) continuously posts the notice in all workplaces, provides it to new employees, and periodically distributes it to remote workers, or (b) provides written notice annually and obtains acknowledgment from all employees.
3. Developers and deployers of high-risk AI systems shall provide a clear notice to all of their employees working on such AI systems of their rights and responsibilities under this article, including the right of employees of contractors and subcontractors to use the developer's internal process for making protected disclosures pursuant to subdivision four of this section. A developer or deployer is presumed to be in compliance with the requirements of this subdivision if the developer or deployer does either of the following: (a) at all times post and display within all workplaces maintained by the developer or deployer a notice to all employees of their rights and responsibilities under this article, ensure that all new employees receive equivalent notice, and ensure that employees who work remotely periodically receive an equivalent notice; or (b) no less frequently than once every year, provide written notice to all employees of their rights and responsibilities under this article and ensure that the notice is received and acknowledged by all of those employees.
Pending 2027-01-01
G-03.3
Civil Rights Law § 109(1)
Plain Language
Developers and deployers are prohibited from retaliating against any individual — whether a consumer, employee, or other person — for exercising rights under the act, refusing to waive those rights, raising concerns about algorithmic consequential actions, reporting violations, or cooperating with investigations. Retaliation includes both service-level retaliation (denying or threatening to deny equal access to goods and services) and employment-level retaliation (discharge, demotion, suspension, threats, harassment). The anti-retaliation protection is unusually broad: it covers not just employees (as in typical whistleblower statutes) but any individual who interacts with a covered algorithm, including consumers who complain about algorithmic decisions.
1. A developer or deployer may not: (a) discriminate or retaliate against an individual (including by denying or threatening to deny the equal enjoyment of goods, services, or other activities or opportunities in relation to a consequential action) because the individual exercised any right, refused to waive any such right, raised a concern about a consequential action under this article, or assisted in any investigation or proceeding under this article; or (b) directly or indirectly, discharge, demote, suspend, threaten, harass, or otherwise discriminate or retaliate against an individual for raising a concern, reporting or attempting to report a violation of this article, or cooperating in any investigation or proceeding under this article.
Pending 2026-01-01
G-03.3
Civ. Rights Law § 86-b(1)
Plain Language
Developers and deployers of high-risk AI systems may not prevent employees — including former employees and independent contractors — from disclosing information to the Attorney General when the employee reasonably believes the information indicates a violation of the New York AI Act. Employers may not enforce employment terms that would restrict such disclosures, and may not retaliate against employees who make them. Harmed employees may petition a court for relief under Labor Law § 740(5).
Developers and/or deployers of high-risk AI systems shall not:
(a) prevent any of their employees from disclosing information to the attorney general, including through terms and conditions of employment or seeking to enforce terms and conditions of employment, if the employee has reasonable cause to believe the information indicates a violation of this article; or
(b) retaliate against an employee for disclosing information to the attorney general pursuant to this section.
Pending 2026-01-01
G-03.4
Civ. Rights Law § 86-b(3)
Plain Language
Developers and deployers must notify all employees working on high-risk AI systems of their rights under the Act, including the right of contractor and subcontractor employees to use the developer's internal disclosure process. Compliance is presumed if the entity either (a) continuously posts workplace notices, provides equivalent notice to new employees, and periodically notifies remote employees, or (b) provides annual written notice received and acknowledged by all employees. The two options are alternative safe harbors for demonstrating compliance.
Developers and deployers of high-risk AI systems shall provide a clear notice to all of their employees working on such AI systems of their rights and responsibilities under this article, including the right of employees of contractors and subcontractors to use the developer's internal process for making protected disclosures pursuant to subdivision four of this section. A developer or deployer is presumed to be in compliance with the requirements of this subdivision if the developer or deployer does either of the following:
(a) at all times post and display within all workplaces maintained by the developer or deployer a notice to all employees of their rights and responsibilities under this article, ensure that all new employees receive equivalent notice, and ensure that employees who work remotely periodically receive an equivalent notice; or
(b) no less frequently than once every year, provide written notice to all employees of their rights and responsibilities under this article and ensure that the notice is received and acknowledged by all of those employees.
Pending 2026-01-01
G-03.1
Civ. Rights Law § 86-b(4)
Plain Language
Every developer and deployer must establish a reasonable internal process enabling employees to anonymously report suspected violations of the Act, false or misleading risk management statements, or failure to disclose known risks. The process must include at least monthly status updates to the disclosing employee on the investigation and any responsive actions taken. The scope of covered disclosures is broad — it covers violations of any provision of the Act, any other law, or misleading risk management statements.
Each developer and deployer shall provide a reasonable internal process through which an employee may anonymously disclose information to the developer or deployer if the employee believes in good faith that the information indicates that the developer or deployer has violated any provision of this article or any other law, or has made false or materially misleading statements related to its risk management policy and program, or failed to disclose known risks to employees, including, at a minimum, a monthly update to the person who made the disclosure regarding the status of the developer's or deployer's investigation of the disclosure and the actions taken by the developer or deployer in response to the disclosure.
Passed 2025-06-25
G-03.3
Gen. Bus. Law § 1422(1)-(2)
Plain Language
Large developers, their contractors, and subcontractors may not prevent employees from disclosing — or threaten or retaliate against employees for disclosing — information about activities they reasonably believe pose an unreasonable or substantial risk of critical harm. Protected disclosures may be made internally to the large developer or externally to the Attorney General. The anti-retaliation protection applies regardless of whether the employer is otherwise in compliance with applicable law. 'Employee' is defined broadly to include contractors, subcontractors, unpaid advisors involved in critical harm risk work, and corporate officers. Employees harmed by retaliation may independently petition a court for temporary or preliminary injunctive relief.
A large developer or a contractor or subcontractor of a large developer shall not prevent an employee from disclosing, or threatening to disclose, or retaliate against an employee for disclosing or threatening to disclose, information to the large developer or the attorney general, if the employee has reasonable cause to believe that the large developer's activities pose an unreasonable or substantial risk of critical harm, regardless of the employer's compliance with applicable law. 2. An employee harmed by a violation of this section may petition a court for appropriate temporary or preliminary injunctive relief.
Passed 2025-06-25
G-03.4
Gen. Bus. Law § 1422(3)
Plain Language
Large developers must notify all employees of their whistleblower protections, rights, and obligations within 90 days of the statute's effective date (or within 90 days of first qualifying as a large developer, whichever is later). New employees must be notified upon hire. A physical notice must also be posted conspicuously in well-lighted, easily accessible locations customarily frequented by employees. The statute does not specify a separate accommodation for remote workers, which may create practical compliance questions for distributed workforces.
A large developer shall inform employees of their protections, rights and obligations under this article within ninety days of the effective date of this article or of becoming a large developer, whichever is later, upon commencement of employment, and by posting a notice thereof. Such notice shall be posted conspicuously in easily accessible and well-lighted places customarily frequented by employees.
Pending
G-03.3
§ 28-5.2-3(a)
Plain Language
Employees who exercise independent professional judgment, or whose duties require state licensure/certification, are protected from termination, discipline, or other adverse action for refusing to follow AI/ADS outputs if they believe in good faith the output would cause harm. Protection requires meeting at least one of four conditions: (1) the employee holds independent judgment or is licensed/certified; (2) the employee notified management that the output may cause harm and the employer failed to adjust it; (3) the employee refused in good faith with a reasonable belief of harm; or (4) the urgency of potential harm left no time for correction through normal channels. This is a conditional anti-retaliation right — it does not protect blanket refusal to use AI tools, but specifically protects good-faith professional override of AI outputs the employee believes would cause harm.
(a) An employee shall be protected from termination, disciplinary action, retaliation, or other adverse employment action for refusing to follow the output of an artificial intelligence system, automated decision system, algorithm, or other similar technology if the following conditions are met: (1) The employee holds independent judgment and discretion in executing their work duties, or the work duties to be performed by the employee require licensure or certification by the state, as a condition of employment, or independent accreditation by the employer; (2) The employee has notified a supervisor, manager, or their employer that the output from the artificial intelligence system, automated decision system, algorithm, or other similar technology may, in their professional opinion and/or educational or work related- experience, lead to the harm of a natural person, damage to physical property, an illegal action, an action contrary to the licensure or certification requirements of the federal government, state, or an applicable private licensing or certifying authority, or an outcome contrary to the goal of the employer, and the employer refused or otherwise failed to adjust the output; (3) The employee has refused to follow the output in good faith and with the knowledge or reasonable belief, based upon training, education, or experience, that the output would cause harm or have an adverse impact; or (4) Due to the urgency of the potential harm or adverse impact, there is not enough time for the output to be corrected through department action.
Pending
G-03.3
§ 28-5.2-4(a)-(b)
Plain Language
Two broad anti-retaliation protections apply: (1) employees may not be penalized in any way for seeking their rights under this chapter, and (2) employers who discharge or discriminate against employees for filing complaints with the attorney general or other agency, assisting in investigations, instituting proceedings, or testifying (or preparing to testify) in proceedings related to this chapter are subject to penalties under Title 28. This covers the full spectrum of retaliation — from filing an initial complaint through testifying at a hearing — and applies to all rights created by the chapter, not just the AI-output-refusal protection in § 28-5.2-3.
(a) No employee shall be penalized by an employer in any way as a result of any action on the part of an employee to seek their rights under the provisions of this chapter. (b) Any employer who discharges or in any other manner discriminates against any employee because such employee has made a complaint to the attorney general or any other department, agency, or person, or assists in any investigation under this chapter, or has instituted, or caused to be instituted any proceeding under or related to this chapter, or has testified or is about to testify in any such proceedings, commits a violation of this section and shall be subject to penalties as provided in title 28.
Pending 2026-02-06
G-03.3
§ 28-5.2-3(a)
Plain Language
Employees who exercise independent judgment, hold licensure or certification, or have employer accreditation are protected from retaliation for refusing to follow AI or ADS outputs in good faith when they believe the output could harm a person, damage property, violate law, conflict with professional licensing requirements, or be contrary to the employer's goals. To invoke protection, the employee must generally have first notified the employer and the employer must have refused to adjust the output — or, in urgent situations, the employee may refuse without waiting for departmental correction. This is a professional-judgment-based AI override protection, not a general whistleblower right — it is limited to employees with discretion, licensure, or accreditation.
(a) An employee shall be protected from termination, disciplinary action, retaliation, or other adverse employment action for refusing to follow the output of an artificial intelligence system, automated decision system, algorithm, or other similar technology if the following conditions are met: (1) The employee holds independent judgment and discretion in executing their work duties, or the work duties to be performed by the employee require licensure or certification by the state, as a condition of employment, or independent accreditation by the employer; (2) The employee has notified a supervisor, manager, or their employer that the output from the artificial intelligence system, automated decision system, algorithm, or other similar technology may, in their professional opinion and/or educational or work related- experience, lead to the harm of a natural person, damage to physical property, an illegal action, an action contrary to the licensure or certification requirements of the federal government, state, or an applicable private licensing or certifying authority, or an outcome contrary to the goal of the employer, and the employer refused or otherwise failed to adjust the output; (3) The employee has refused to follow the output in good faith and with the knowledge or reasonable belief, based upon training, education, or experience, that the output would cause harm or have an adverse impact; or (4) Due to the urgency of the potential harm or adverse impact, there is not enough time for the output to be corrected through department action.
Pending 2025-07-01
G-03.3
21 V.S.A. § 495q(k)
Plain Language
Employers are prohibited from discharging or retaliating in any manner against employees who exercise or attempt to exercise their rights under this section — including data access, data correction, and complaint-filing rights. The existing Vermont fair employment anti-retaliation provisions under 21 V.S.A. § 495(a)(8) also apply, providing additional protections and remedies for retaliation claims.
(k) Retaliation prohibited. An employer shall not discharge or in any other manner retaliate against an employee who exercises or attempts to exercise the employee's rights under this section. The provisions against retaliation set forth in subdivision 495(a)(8) of this subchapter shall apply to this section.
Pending 2025-07-01
G-03.3
9 V.S.A. § 4193d(a)
Plain Language
Developer-employers and deployer-employers may not prevent employees — including former employees and independent contractors — from disclosing information to the Attorney General if the employee reasonably believes the information indicates a violation of this subchapter. They also may not retaliate against employees for making such disclosures. Employment terms, NDAs, and conditions of employment cannot be used to block protected disclosures. The protected disclosure channel is specifically to the Attorney General, not an internal process.
(a) Developer-employers and deployer-employers of automated decision systems used in consequential decisions shall not: (1) prevent an employee from disclosing information to the Attorney General, including through terms and conditions of employment or seeking to enforce terms and conditions of employment, if the employee has reasonable cause to believe the information indicates a violation of this subchapter; or (2) retaliate against an employee for disclosing information to the Attorney General pursuant to subdivision (1) of this subsection.
Pending 2025-07-01
G-03.4
9 V.S.A. § 4193d(b)
Plain Language
Developer-employers and deployer-employers must provide clear notice to all employees working on automated decision systems of their rights and responsibilities under this subchapter, including the right of contractor and subcontractor employees to use the developer's internal disclosure process. A safe harbor presumption of compliance applies if the employer either (1) continuously posts workplace notices, onboards new employees with equivalent notice, and periodically notifies remote workers, or (2) provides annual written notice received and acknowledged by all employees.
(b) Developer-employers and deployer-employers of automated decision systems used in consequential decisions shall provide a clear notice to all employees working on automated decision systems of their rights and responsibilities under this subchapter, including the right of employees of contractors and subcontractors to use the developer's internal process for making protected disclosures pursuant to subsection (c) of this section. A developer-employer or deployer-employer is presumed to be in compliance with the requirements of this subsection if the developer-employer or deployer-employer does either of the following: (1) at all times: (A) posts and displays within all workplaces maintained by the developer-employer or deployer-employer a notice to all employees of their rights and responsibilities under this subchapter; (B) ensures that all new employees receive equivalent notice; and (C) ensures that employees who work remotely periodically receive an equivalent notice; or (2) not less frequently than once every year, provides written notice to all employees of their rights and responsibilities under this subchapter and ensures that the notice is received and acknowledged by all of those employees.
Pending 2025-07-01
G-03.1
9 V.S.A. § 4193d(c)
Plain Language
Each developer-employer must maintain a reasonable internal anonymous disclosure channel for employees who believe in good faith that the developer has violated this subchapter or any other law, made false or misleading safety/security statements, or failed to disclose known risks. The process must include at minimum monthly status updates to the disclosing employee on the investigation and any responsive actions. Note this obligation falls on developer-employers only — deployer-employers are not separately required to maintain an internal anonymous process.
(c) Each developer-employer shall provide a reasonable internal process through which an employee may anonymously disclose information to the developer if the employee believes in good faith that the information indicates that the developer has violated any provision of this subchapter or any other law, or has made false or materially misleading statements related to its safety and security protocol, or failed to disclose known risks to employees, including, at a minimum, a monthly update to the person who made the disclosure regarding the status of the developer's investigation of the disclosure and the actions taken by the developer in response to the disclosure.