First of if you're friend's current status is H1, he will invalidate that by using and EAD.
AC21 can be invoked once your I485 application has been pending for 180 days or longer, which according to your information is the case. I am also assuming that your friend has an approved I140.
What are the risks? I don't know. It seems as if BCIS (typical) hasn't issued clear guidelines on AC21. The prevailing wisdom on this forum is that as long as the job is in a similar category and pays the proferred wage indicated on the labor certificate the applicant should be ok. The one item discussed was what if the previous employer tries to revoke the I140. I am not aware of any consensus as to what would happen.
What steps does he need to do? Two schools of thoughts. One is to proactively inform BCIS that the applicant switched jobs. The second is to wait for an RFE (assuming it comes) and then invoke AC21 in the reply. Personaly, I wouldn't volunteer any information to BCIS unless it was helpful (i.e. if I got an RFE for my I485 for employment, I would probably send proof of special registration since they may ask later).
rgds,
sadiq
p.s. not legal advice. For peace of mind your friend may wish to consult a lawyer with extensive experience in this area.