Hidden harm, delayed response: What AI whistleblowing cases reveal about oversight gaps

AI capabilities are advancing faster than the governance structures designed to oversee them. This creates what our research terms a "Harm Frontier" – a persistent gap between what AI systems can technologically do and what organisational governance can detect, prevent, or remedy. Harms that emerge in this gap tend to be structurally invisible to existing oversight mechanisms. 

The problem is that this gap is nearly impossible to measure through conventional assurance. Organisations self-assess, self-audit, and self-report. Whistleblowing cases break through that opacity. Each case reveals a moment where governance failed, and an individual decided the cost of silence was greater than the cost of speaking up. When analysed systematically, these cases reveal what governance consistently misses – and how organisational responses to whistleblowers signal the true severity of what was hidden.

This session presents a new framework for reading whistleblowing cases as governance diagnostics, alongside survey findings from cyber security professionals on their direct experiences with AI harm and the discussion on what shapes their willingness to report.

• Introduce the Harm Frontier and demonstrate how AI whistleblowing cases make the gap between AI capability and governance capacity visible and measurable.
• Present patterns from documented cases showing what governance missed, for how long, and what organisational responses reveal about actual harm severity.
• Share survey findings on whether cyber security professionals encounter AI harm in practice and what factors drive or inhibit their decision to report.

Part 1:​The Harm Frontier: the gap governance doesn't know about

What the Harm Frontier is, why traditional oversight mechanisms (such as audits, compliance reviews, risk registers) were not built to catch AI harms, and why the gap between AI capability and governance capacity is widening.

Part 2:​Whistleblowing cases as governance signals

Analysis of documented AI whistleblowing cases showing temporal lags between harm onset and disclosure often measured in years. A key insight: organisations don't retaliate randomly. When an organisation aggressively suppresses a disclosure, it is signalling that the exposure is threatening making the pattern of concealment and retaliation a more honest indicator of harm severity than any self-report or assessment.

Part 3. What cyber security professionals experience in practice

Survey findings on practitioners' direct encounters with AI-related harm, and the factors (organisational pressure, personal cost, unclear channels, professional norms) that shape their intention to report. Theoretical perspective: the discussion of the "mum" effect and "deaf" effect and it’s manifestation in cyber security.

Part 4. Reading the signals in your own organisation

This part presents practical strategies for professionals and organisations grounded in the previous theoretical research. The goal is to encourage responsible and safe disclosure by ensuring that professionals who see genuine AI-related harm know how to act on it safely, effectively, and with protection.