Large frontier developers must provide a reasonable internal process through which a covered employee may anonymously disclose information if the employee believes in good faith that it indicates the developer's activities present a specific and substantial danger to public health or safety from catastrophic risk or that the developer violated the TFAIA. The process must include monthly status updates to the disclosing employee on the investigation status and actions taken. Disclosures and responses must be shared with officers and directors at least quarterly, except that an officer or director who is the subject of a wrongdoing allegation must be excluded from receiving that disclosure.

Large frontier developers must, by January 1, 2027, establish and maintain an anonymous internal reporting process through which covered employees may report catastrophic-risk concerns, receive reasonable status updates, and have reports and updates shared with officers and directors at least quarterly (excluding any officer or director accused of wrongdoing).

Enrolled AI auditors must not prevent employees from disclosing noncompliance information to the Attorney General, the Labor Commissioner, or through the agency's misconduct-reporting mechanism, including through employment terms and conditions, and must not retaliate against employees who make such disclosures.

Developers and deployers must provide a reasonable internal process through which employees may anonymously disclose information indicating the developer or deployer has violated this article or any other law, has made false or materially misleading statements related to its risk management policy and program, or has failed to disclose known risks to employees. The process must include, at minimum, monthly updates to the disclosing employee regarding the investigation status and actions taken in response.

Developers must provide a reasonable internal process through which employees may anonymously disclose information they believe in good faith indicates the developer's activities present unreasonable critical risk, including monthly status updates to the disclosing employee on the investigation and response.

Large frontier developers must provide an anonymous internal reporting process through which employees may disclose information they have a good-faith belief reveals a substantial and specific danger to employees, public health, or safety, or a violation of this Act. The process must include monthly status updates to the disclosing employee on the investigation and actions taken.

Large frontier developers must provide a reasonable anonymous internal reporting process through which employees may disclose information they believe in good faith reveals a substantial and specific danger to employees, public health, or safety, or a violation of this Act. The process must include monthly updates to the disclosing employee on investigation status and actions taken.

Large frontier developers must provide an anonymous internal reporting process for covered employees to disclose catastrophic risk concerns or Act violations, including monthly status updates to the disclosing employee. Disclosures and responses must be shared with officers and directors on a quarterly basis, unless the officer or director is the subject of the disclosure.

Large frontier developers must provide a reasonable anonymous internal disclosure process for covered employees, including monthly status updates to the disclosing employee. Disclosures and responses must be shared with officers and directors at least quarterly, except where the disclosure alleges wrongdoing by that officer or director.

Developers must provide an anonymous internal disclosure process for employees, contractors, and subcontractors working on covered models who believe in good faith that the developer has violated any law, made false statements about its safety protocol, or failed to disclose known risks. The developer must investigate each disclosure, provide monthly updates to the disclosing person, retain all disclosures and responses for at least seven years, and share them with non-implicated officers and directors at least quarterly.

The Commissioner must implement a whistleblower protection program for employees of consumer reporting agencies who report algorithmic misuse or noncompliance.

Large developers must: (1) post notices and use other appropriate means to keep employees informed of their protections and obligations under this section, and (2) provide a reasonable internal process through which an employee may anonymously disclose information they believe in good faith indicates the developer's activities present a critical risk, with monthly updates to the disclosing employee on the status of the investigation and any actions taken in response.

Covered developers and deployers must maintain a reasonable internal process for employees to anonymously disclose suspected violations or risk misrepresentations, with at least monthly status updates to the disclosing employee on the investigation and actions taken.

Each developer-employer must provide a reasonable internal process through which an employee may anonymously disclose information if the employee believes in good faith that the information indicates a violation of this subchapter or any other law, that the developer has made false or materially misleading statements related to its safety and security protocol, or that the developer has failed to disclose known risks to employees. The process must include, at minimum, a monthly update to the disclosing employee on the status of the developer's investigation and the actions taken in response.

Large frontier developers must provide a reasonable internal process through which a covered employee may anonymously disclose information if the employee believes in good faith that it indicates the developer's activities present a specific and substantial danger to public health or safety from catastrophic risk or that the developer violated the TFAIA. The process must include monthly status updates to the disclosing employee on the investigation status and actions taken. Disclosures and responses must be shared with officers and directors at least quarterly, except that an officer or director who is the subject of a wrongdoing allegation must be excluded from receiving that disclosure.

Large frontier developers must, by January 1, 2027, establish and maintain an anonymous internal reporting process through which covered employees may report catastrophic-risk concerns, receive reasonable status updates, and have reports and updates shared with officers and directors at least quarterly (excluding any officer or director accused of wrongdoing).

Developers must retain all whistleblower disclosures and responses for at least 7 years and share each disclosure and response with non-conflicted officers and directors at least once every fiscal quarter.

Large frontier developers must share whistleblower disclosures and responses with officers and directors at least once each quarter, except that disclosures alleging wrongdoing by a specific officer or director must not be shared with that officer or director.

Large frontier developers must share whistleblower disclosures and responses with officers and directors at least quarterly, except where the disclosure alleges wrongdoing by that officer or director.

Large frontier developers must provide an anonymous internal reporting process for covered employees to disclose catastrophic risk concerns or Act violations, including monthly status updates to the disclosing employee. Disclosures and responses must be shared with officers and directors on a quarterly basis, unless the officer or director is the subject of the disclosure.

Large frontier developers must provide a reasonable anonymous internal disclosure process for covered employees, including monthly status updates to the disclosing employee. Disclosures and responses must be shared with officers and directors at least quarterly, except where the disclosure alleges wrongdoing by that officer or director.

Developers must provide an anonymous internal disclosure process for employees, contractors, and subcontractors working on covered models who believe in good faith that the developer has violated any law, made false statements about its safety protocol, or failed to disclose known risks. The developer must investigate each disclosure, provide monthly updates to the disclosing person, retain all disclosures and responses for at least seven years, and share them with non-implicated officers and directors at least quarterly.

Large developers must retain all disclosures and updates from the internal anonymous reporting process for at least seven years after creation. Each disclosure and update must be shared with officers and directors who do not have a conflict of interest at least once per quarter.

Frontier developers must not make, adopt, enforce, or enter into any rule, regulation, policy, or contract that prevents a covered employee from disclosing, or retaliates against a covered employee for disclosing, information to the Attorney General, a federal authority, a supervisor, or another covered employee with investigative authority, if the covered employee has reasonable cause to believe the information discloses that the developer's activities pose a specific and substantial danger to public health or safety from catastrophic risk or that the developer has violated the TFAIA. Frontier developers must not enter into contracts preventing covered employees from making disclosures protected under Labor Code § 1102.5.

Frontier developers must not adopt, enforce, or enter into any rule, policy, or contract that permits retaliation against employees for whistleblower activity or against covered employees who report catastrophic-risk concerns in good faith.

Large developers and their contractors and subcontractors must not prevent employees from disclosing — or threatening to disclose — information to the large developer or the attorney general, and must not retaliate against employees for such disclosures, when the employee has reasonable cause to believe the large developer's activities pose an unreasonable or substantial risk of critical harm. This protection applies regardless of the employer's compliance with applicable law. Employees include contractors, subcontractors, unpaid advisors involved in frontier model risk assessment, and corporate officers. An employee harmed by a violation may petition a court for temporary or preliminary injunctive relief.

Enrolled AI auditors must not prevent employees from disclosing noncompliance information to the Attorney General, the Labor Commissioner, or through the agency's misconduct-reporting mechanism, including through employment terms and conditions, and must not retaliate against employees who make such disclosures.

Employers must not discharge, threaten to discharge, demote, suspend, or in any manner discriminate or retaliate against any worker for using or attempting to use their rights under this bill, filing a complaint with the Labor Commissioner, alleging a violation, cooperating in an investigation or prosecution, assisting in enforcement, or exercising any right protected under the bill.

Developers and deployers of high-risk AI systems must not prevent employees from disclosing information to the attorney general — including through terms and conditions of employment — when the employee has reasonable cause to believe the information indicates a violation of this article. Developers and deployers must not retaliate against employees for such disclosures.

Employers must not discharge, retaliate against, discriminate against, or take any adverse action against a licensed or certified employee who refuses to follow a high-risk AI system's consequential decision output when the employee reasonably believed the output may cause algorithmic discrimination, notified the employer, and reasonably believed there was insufficient time to correct the action.

Employers, deployers, developers, labor organizations, and any other person must not discharge, discriminate against, or retaliate against any applicant or employee because they: (1) filed a complaint, provided information, or assisted in an investigation concerning violations of the act, (2) objected to or refused to participate in activity they reasonably believed violated the act, or (3) exercised any rights granted under the act.

Health carriers, managed care plans, and affiliated entities must not retaliate against providers for filing formal complaints, submitting testimony, or participating in external reviews concerning compliance with Chapter 432E.

Employers must not discharge, threaten to discharge, demote, suspend, or in any manner discriminate or retaliate against any employee for exercising or attempting to exercise rights under this chapter, filing a complaint alleging a violation, cooperating in an investigation or prosecution of an alleged violation, or taking any action to invoke or assist enforcement of this chapter.

Developers must not retaliate against employees who disclose to the Attorney General information the employee reasonably believes indicates the developer's activities pose unreasonable or substantial critical risk, consistent with the Illinois Whistleblower Act's anti-retaliation protections.

Frontier developers and large chatbot providers must not adopt, enforce, or enter into any rule, regulation, policy, or contract that prevents an employee from making a disclosure protected under the Illinois Whistleblower Act.

Employers must not retaliate against registered professional nurses who refuse in good faith to use or delegate AI when patient safety requires refusal.

Employers must not terminate, discipline, retaliate against, or take other adverse employment action against an employee who refuses to follow the output of an automated decision-making system when any of the following conditions is met: (1) the employee exercises independent judgment and discretion in their duties or holds a State license, certification, or accreditation; (2) the employee notifies a supervisor or manager that the output may lead to harm, illegality, or an outcome contrary to the employer's goals and the employer fails to correct it; (3) the employee is engaging in concerted activity for mutual aid and protection; (4) the employee refuses in good faith based on training, education, or experience; or (5) urgency leaves insufficient time for correction.

Frontier developers and large chatbot providers must not make, adopt, enforce, or enter into any rule, regulation, policy, or contract that prevents an employee from making a disclosure protected under the Illinois Whistleblower Act.

Employers must not retaliate against a registered professional nurse who in good faith refuses to use or delegate AI when patient safety requires refusal.

Employers must not discriminate or retaliate — including through intimidation, threats, coercion, or harassment — against any covered individual for exercising or attempting to exercise rights under this chapter, or because the individual (or someone acting at the individual's request) has filed a complaint, sought assistance, participated in a proceeding, given information, or testified regarding any right under this chapter.

Employers must not discharge, threaten to discharge, demote, suspend, or discriminate or retaliate in any manner against any worker for exercising rights under this Part, filing a complaint with Louisiana Works, cooperating in an investigation or prosecution of an alleged violation, or taking any action to invoke or assist enforcement of this Part.

Frontier developers must not adopt, enforce, or enter into any policy or contract that prevents or retaliates against a covered employee for disclosing information indicating catastrophic risk or violations of the Act to the attorney general, federal authorities, supervisors, or other authorized covered employees.

Employers must not terminate, discipline, retaliate against, or take any adverse employment action against an employee who, exercising independent professional judgment or licensure-based expertise, refuses in good faith to follow AI or ADS output that the employee reasonably believes would cause harm, provided the employee notified management and the urgency of potential harm left insufficient time for departmental correction.

Frontier developers must not adopt rules, policies, or contracts that prevent covered employees from disclosing information about catastrophic risk dangers or violations of this chapter, and must not retaliate against employees for making such disclosures to the Attorney General, federal authorities, or internal supervisors.

Employers must not terminate, discipline, retaliate against, or take any other adverse employment action against an employee who refuses to follow AI or automated decision system output, provided: (1) the employee holds independent judgment/discretion or requires licensure/certification; (2) the employee notified the employer that the output may lead to harm, illegal action, certification violation, or outcome contrary to the employer's goals, and the employer failed to adjust; (3) the employee refused in good faith with reasonable belief based on training, education, or experience that the output would cause harm; and (4) urgency prevented correction through normal channels.

Developers and their contractors or subcontractors must not prevent employees from disclosing information to the attorney general or any public body when the employee reasonably believes the developer is out of compliance or that any AI model poses unreasonable critical-harm risk, must not retaliate against employees for such disclosures, and must not make false or materially misleading statements about their safety and security protocol.

The Commissioner must implement a whistleblower protection program for employees of consumer reporting agencies who report algorithmic misuse or noncompliance.

Large developers must not discharge, threaten, or otherwise discriminate against an employee regarding compensation, terms, conditions, location, or privileges of employment because the employee reports or is about to report to a federal or state authority information indicating the developer's activities pose a critical risk. The protection applies unless the employee knows the report is false. An employee alleging retaliation may bring a civil action within 90 days seeking injunctive relief, actual damages, reasonable attorney fees, witness fees, court costs, reinstatement, back wages, and full reinstatement of fringe benefits and seniority rights. The employee must show by clear and convincing evidence that the protected report was made or about to be made.

Employers must not retaliate against a worker for refusing to follow the output of an automated decision system when the worker has a reasonable, good-faith belief that following the output would cause harm or discrimination or would violate a law or regulation.

Employers must not discharge, threaten to discharge, demote, suspend, or in any manner discriminate or retaliate against any worker for exercising or attempting to exercise their rights under this act, including filing a complaint with the commissioner, alleging a violation, cooperating in an investigation, or taking any action to enforce their rights.

Employers must not discharge, threaten to discharge, demote, suspend, or in any manner discriminate or retaliate against any worker for exercising or attempting to exercise rights under this act, including filing complaints, cooperating in investigations, or invoking enforcement provisions.

Employers must not discharge, demote, suspend, or otherwise retaliate against any worker for exercising or attempting to exercise rights under this chapter, including filing complaints, cooperating in investigations, or taking any action to enforce these rights.

Employers must not retaliate against a worker for refusing to follow the output of an automated decision system when the worker has a reasonable, good-faith belief that doing so would cause harm, discrimination, or a legal violation.

Employers must not discharge, threaten, demote, suspend, or in any manner discriminate or retaliate against any worker for exercising or attempting to exercise their rights under the act, including filing complaints, cooperating in investigations, or invoking enforcement mechanisms.

Employers must not discharge, retaliate against, discriminate against, or take any adverse action against employees or former employees for exercising rights under the bill, including requesting performance data, declining excessive hours, or filing a civil action. Adverse action within ninety days of protected activity creates a rebuttable presumption of retaliation.

Employers and public entities must not take adverse employment or benefit actions in retaliation against anyone who discloses, complains to a state agency about, or otherwise exercises rights under this act.

Employers and public entities must not discharge or retaliate against an employee who, exercising independent professional judgment or a licensed role, refuses in good faith to follow an AI output the employee reasonably believes will cause harm, illegality, or licensure jeopardy, subject to notice or urgency conditions.

Food delivery platforms must not retaliate against delivery workers for exercising rights under the act, including filing complaints, participating in investigations, or refusing to engage in unsafe or unlawful conduct.

Employers must not discharge, threaten to discharge, demote, suspend, discriminate against, or retaliate against any worker for exercising rights under this article, filing a complaint, cooperating in an investigation, or invoking enforcement.

Employers must not retaliate against any employee for exercising data access rights under § 1013 or filing a complaint about any violation of Article 35-A. A rebuttable presumption of unlawful retaliation applies to any adverse action taken within 90 days of such a request or complaint.

Covered developers and deployers must not prevent employees from disclosing suspected violations to the Attorney General and must not retaliate against employees for making such disclosures.

Employers must not retaliate against individuals who allege a violation of this section, consistent with the protections of Labor Law § 215 and any other applicable law.

Developers and deployers must not discriminate or retaliate against any individual — including by denying or threatening to deny equal enjoyment of goods, services, or opportunities — because the individual exercised any right, refused to waive any right, raised a concern about a consequential action, or assisted in any investigation or proceeding under this article. Developers and deployers must not discharge, demote, suspend, threaten, harass, or otherwise discriminate or retaliate against any individual for raising a concern, reporting or attempting to report a violation, or cooperating in any investigation or proceeding.

Employers must not discriminate, retaliate, or take adverse action against employees who exercise data access rights under § 1013 or file complaints about violations of the article. A rebuttable presumption of unlawful retaliation applies if adverse action occurs within 90 days of the employee's protected activity.

Employers and vendors must not retaliate against any employee or candidate who opposes, discloses, or threatens to disclose suspected violations of this article, participates in investigations, refuses to participate in violative practices, or exercises or informs others of their rights. Retaliation is established under a contributing-factor standard. Employees need not cite a specific statutory provision to trigger protection.

Employers must not retaliate against any individual who alleges a violation of the surveillance-wages prohibition, consistent with the anti-retaliation protections of Labor Law § 215.

Employers must not take adverse action against an employee based on the employee's opposition to or good-faith refusal to submit to a practice the employee believes violates the electronic monitoring requirements. Employers must not take adverse employment action against an employee based on data collected via continuous incremental time-tracking tools, except in cases of egregious misconduct. Employers must not take adverse employment action against an employee based on data collected via electronic monitoring if the data measures performance against a standard that was not previously, clearly, and unmistakably disclosed to the employee and all similarly situated employees, or if the data was collected without proper notice.

Employers must not terminate, discipline, retaliate against, or take any other adverse employment action against an employee for refusing to follow the output of an AI system, ADS, algorithm, or similar technology, provided: (1) the employee holds independent judgment and discretion in their duties, or is state-licensed or certified, or independently accredited by the employer; (2) the employee has notified a supervisor, manager, or the employer that the output may lead to harm to a natural person, property damage, an illegal action, a violation of licensure/certification requirements, or an outcome contrary to the employer's goal, and the employer failed to adjust the output; (3) the employee refused in good faith based on training, education, or experience that the output would cause harm; or (4) due to urgency, there is insufficient time for the output to be corrected through department action.

Employers must not penalize, discharge, or discriminate against any employee for seeking their rights under this chapter, filing a complaint with the attorney general or any other agency, assisting in any investigation under this chapter, instituting or causing to be instituted any proceeding under this chapter, or testifying or being about to testify in any such proceeding. Violations are subject to penalties as provided in Title 28.

Employers involved in developing, deploying, or using AI must not retaliate against employees or independent contractors (current or former) for reporting AI security vulnerabilities or AI violations, or conduct reasonably believed to be one, to regulators, the Attorney General, Congress, or internally, and may not use contracts, NDAs, or mandatory arbitration agreements to waive these anti-retaliation rights.

Developers and deployers must not retaliate against individuals for exercising rights under the Act, raising concerns, or assisting investigations, and must not discharge, demote, suspend, threaten, harass, or otherwise discriminate against employees or individuals for reporting or attempting to report violations of the Act.

Employers must not discriminate or retaliate against any covered individual for exercising rights under the Act, filing complaints about ADS violations, seeking assistance, participating in proceedings, or providing testimony related to the Act.

Employers must not discharge, demote, suspend, threaten, blacklist, harass, or otherwise discriminate against any employee or independent contractor for reporting AI security vulnerabilities or AI violations to regulators, law enforcement, Congress, or internal supervisors, or for participating in related investigations or proceedings.

Employers must not include in any contract, agreement, policy, or condition of employment (including independent contractor agreements) any provision that waives or alters the covered individual's whistleblower rights under this Act, including mandatory arbitration, mediation, or other ADR clauses.

Covered entities must not take any adverse employment action against a health care professional because the professional overrides an AI/CDSS output consistent with Section 101 requirements.

Covered entities must not discriminate or retaliate against any individual for exercising rights under the Act, filing complaints about possible violations, seeking assistance on AI/CDSS-related concerns, participating in proceedings, providing testimony or information, or discussing possible violations with co-workers.

Developers and deployers must not discriminate or retaliate against individuals who exercise rights under this Act, refuse to waive such rights, raise concerns about consequential actions, or assist in investigations. Service differentials are permitted only if necessary and directly related to the value provided by the algorithm.

Developers and deployers must not discharge, demote, suspend, threaten, harass, or otherwise retaliate against any individual for reporting or attempting to report a violation of this Act, or for cooperating in any investigation or proceeding.

Deployers and developers must not discharge, demote, suspend, threaten, harass, or otherwise retaliate against any individual for raising concerns about, reporting, or cooperating in enforcement proceedings regarding violations of this Act.

Developers must not require employees or prospective employees to execute or renew NDA, confidentiality, or nondisparagement provisions that conceal noncompliance with this chapter. Any such provision is void and unenforceable.

Employers must not discharge or in any other manner retaliate against an employee who exercises or attempts to exercise their rights under this section, including rights to notice, data access, data correction, and complaint filing. The existing anti-retaliation provisions of 21 V.S.A. § 495(a)(8) apply.

Developer-employers and deployer-employers must not prevent employees from disclosing information to the Attorney General — including through terms and conditions of employment or enforcement of employment terms — if the employee has reasonable cause to believe the information indicates a violation of this subchapter. They must not retaliate against employees for making such disclosures.

Employers must not discharge or retaliate against any employee who exercises or attempts to exercise rights under this chapter.

Employers must not retaliate, discharge, or take adverse action against employees for filing complaints, instituting proceedings, testifying, or exercising any right under this chapter.

Frontier developers must provide clear notice to all covered employees of their whistleblower rights and responsibilities by either: (1) posting and displaying notice at all times within any workplace, ensuring new covered employees receive equivalent notice, and ensuring remote covered employees periodically receive equivalent notice; or (2) providing written notice at least once per year to each covered employee and ensuring the notice is received and acknowledged.

Frontier developers must provide all covered employees with clear notice of their whistleblower rights — via permanent workplace posting and new-hire distribution, with periodic notices for remote workers, or via at least annual written notice with acknowledgment.

Large developers must inform employees of their protections, rights, and obligations under the RAISE Act within 90 days of the effective date or of becoming a large developer (whichever is later), upon commencement of employment, and by posting a conspicuous notice in easily accessible and well-lighted places customarily frequented by employees.

Developers and deployers of high-risk AI systems must provide clear notice to all employees working on such AI systems of their rights and responsibilities under this article, including the right of contractor and subcontractor employees to use the internal disclosure process. Compliance is presumed if the developer or deployer either (1) posts and displays notices in all workplaces, provides equivalent notice to new employees, and periodically provides equivalent notice to remote employees, or (2) provides written notice at least annually to all employees and ensures it is received and acknowledged.

Frontier developers must provide clear notice of whistleblower rights to all covered employees by (1) posting and displaying the notice at all times in every workplace, ensuring remote and new employees receive equivalent notice, and (2) providing annual written notice to each covered employee, acknowledged by the employee.

Frontier developers must provide clear notice of whistleblower rights to all covered employees, either by posting workplace notices at all times (with accommodations for new and remote employees) or by providing annual written notice acknowledged by all covered employees.

Developers must provide clear notice to all employees working on covered models and derivatives of their whistleblower rights and responsibilities, including contractor and subcontractor employees' right to use the internal disclosure process. Compliance is presumed if the developer posts notice in all workplaces and ensures remote and new employees receive equivalent notice, or annually provides written notice acknowledged by all employees.

Large developers must: (1) post notices and use other appropriate means to keep employees informed of their protections and obligations under this section, and (2) provide a reasonable internal process through which an employee may anonymously disclose information they believe in good faith indicates the developer's activities present a critical risk, with monthly updates to the disclosing employee on the status of the investigation and any actions taken in response.

Covered developers and deployers must provide clear notice to employees of their whistleblower rights, satisfied either by continuous workplace posting (with equivalent notice to new and remote employees) or by annual acknowledged written notice.

Developer-employers and deployer-employers must provide clear notice to all employees working on automated decision systems of their rights and responsibilities under this subchapter, including the right of employees of contractors and subcontractors to use the developer's internal anonymous disclosure process. Compliance is presumed if the employer either (1) continuously posts workplace notices, ensures new employees receive notice, and periodically notifies remote workers, or (2) at least annually provides written notice to all employees and ensures receipt and acknowledgment.