Emotion Recognition Under the EU AI Act: Banned, High-Risk and Transparency Rules

Overview: Three Rules, One Technology

Few technologies receive as layered a treatment in the EU AI Act as emotion recognition. The regulation does not impose a single rule but a graduated scheme spanning three instruments: an outright prohibition in two specific contexts, high-risk classification everywhere the technology remains permitted, and a transparency duty wherever it operates. The recitals explain the scepticism driving all three layers: the expression of emotions varies considerably across cultures and situations and even within a single individual, and systems inferring emotions suffer from limited reliability, lack of specificity and limited generalisability — making them prone to discriminatory outcomes and intrusions into private life, especially where a power imbalance exists. This article maps the complete rule set, the definitional boundaries that decide which rule applies, and the compliance posture each one demands.

The Definition: What Counts as Emotion Recognition

Article 3(39) defines an emotion recognition system as an AI system for the purpose of identifying or inferring emotions or intentions of natural persons on the basis of their biometric data. Every element carries weight. The basis must be biometric data — facial expressions, voice characteristics, gait, keystroke dynamics and similar body-derived signals; sentiment analysis of written text falls outside the definition because text is not biometric data. The target must be emotions or intentions: the recitals specify concepts such as happiness, sadness, anger, surprise, disgust, embarrassment, excitement, shame, contempt, satisfaction and amusement — while excluding the detection of readily apparent expressions, gestures or movements unless used to infer emotions, and excluding physical states such as pain or fatigue. That last exclusion is operationally critical: systems detecting fatigue of professional drivers or pilots for safety purposes are not emotion recognition systems under the regulation.

Layer One: The Workplace and Education Ban

Article 5(1)(f) prohibits the placing on the market, putting into service or use of AI systems to infer emotions of a natural person in the areas of workplace and education institutions, except where the system is intended to be put in place or into the market for medical or safety reasons. The prohibition has applied since February 2, 2025, and carries the regulation's heaviest penalties — up to 35 million euros or 7 percent of worldwide annual turnover. Its scope decisions matter daily: employee monitoring software inferring engagement or frustration from webcam feeds, call centre tools scoring agent emotional tone from voice, classroom attention analytics reading student faces — all are prohibited in the Union, whatever consent forms accompany them, because the legislator judged consent meaningless under the power imbalance of employment and education. The medical and safety exception is narrow and purpose-bound: a system supporting diagnosis in occupational health, or detecting acute distress for safety intervention, must genuinely serve that purpose rather than wear it as a label.

Layer Two: High-Risk Status Everywhere Else

Outside workplaces and education institutions, emotion recognition is not banned — it is high-risk. Annex III point 1(c) lists AI systems intended to be used for emotion recognition, insofar as their use is permitted under Union or national law, which pulls every permitted deployment into the full Chapter III machinery from August 2, 2026: risk management, data governance with documented examination for bias across cultures and demographics, technical documentation, logging, human oversight, accuracy and robustness evidence, conformity assessment, registration in the EU database and post-market monitoring. Two adjacent regimes overlap. In law enforcement and border contexts, polygraph-type tools occupy their own Annex III entries under points 6(b) and 7(a), and a tool inferring deception from biometric signals may trigger several classifications simultaneously. And because emotion inference processes biometric data, the GDPR applies in full, with special category protections engaging where the data reveals health or other sensitive dimensions — a parallel hurdle that has independently stopped European deployments before the AI Act existed.

Layer Three: The Transparency Duty

Article 50(3) requires deployers of an emotion recognition system or a biometric categorisation system to inform the natural persons exposed to it of the operation of the system, and to process the personal data in accordance with the applicable data protection law. The duty applies wherever the technology lawfully operates, with an exception for certain systems permitted by law for criminal offence purposes subject to safeguards. Practically, this ends silent deployment: research kiosks, automotive cabin systems studying driver emotional state in permitted configurations, retail analytics in jurisdictions where they survive data protection review — all must disclose, in a clear manner, at the latest at the time of first exposure.

Who Must Act, and How

1. Vendors of affect-sensing technology: segment your market map by rule — Union workplace and education sales are closed except for the medical and safety niche; remaining segments require a full high-risk compliance build and honest accuracy evidence across demographic groups
2. Employers and education providers: audit procured software for emotion inference features, including those buried in HR analytics, proctoring and productivity suites; features in scope of the ban must be disabled for EU operations, and contractual representations from vendors are worth obtaining in writing
3. Deployers in permitted contexts: implement the disclosure duty, verify the provider's conformity documentation, and run the GDPR analysis in parallel — AI Act permission does not create a data protection lawful basis
4. All parties: document boundary determinations — fatigue versus emotion, readily apparent expression versus inference, medical purpose versus marketing claim — because these distinctions decide which of three very different rules governs the system

Concrete Examples

Example one: a European logistics firm pilots cameras scoring warehouse worker stress from facial expressions to optimise shift planning. Workplace emotion inference — prohibited since February 2025, regardless of worker consent or anonymisation claims at the scoring stage.

Example two: a vehicle manufacturer ships a drowsiness detection system monitoring eyelid closure and head position of drivers. Detection of a physical state for safety — outside the emotion recognition definition entirely, though product safety law and data protection law still apply.

Example three: a market research company operates an opt-in lab where consenting panellists' facial responses to advertisements are analysed. Not workplace or education, so not banned; it is an emotion recognition system requiring high-risk compliance from August 2026, Article 50(3) disclosure, and a GDPR basis — explicit consent being the realistic candidate.

Action Before August 2, 2026

The ban already binds; the remaining deadline concerns permitted deployments. Providers serving permitted niches should treat the coming months as their conformity assessment window: accuracy claims in this field face deep scientific scepticism, which the documentation must answer with validation studies spanning cultures, ages and conditions of capture rather than vendor benchmarks. Deployers should complete procurement audits before enforcement attention arrives — emotion recognition is among the most publicly scrutinised AI categories, and complaints from works councils, parents and civil society organisations are a foreseeable trigger for the first inspection wave. The deeper strategic note: the regulation has rendered emotional surveillance commercially radioactive in its largest historical markets. Companies building on affect inference should reassess whether the product thesis survives in a legal environment that treats the technology's core claim — that inner states can be reliably read from outer signals — as scientifically unproven and socially hazardous.

Boundary Questions That Will Define Enforcement

Several interpretive frontiers remain genuinely open, and early enforcement will settle them. The reach of workplace is one: does the ban cover candidate interviews conducted before employment begins, gig platforms whose workers are not employees, or volunteer settings? The recitals frame the prohibition around power imbalance, which argues for breadth, and prudent vendors are treating recruitment interviews as inside the ban's gravitational field. The medical and safety exception is another: occupational health monitoring shades into productivity monitoring with unsettling ease, and the documented intended purpose — not the marketing language — will decide which side a system falls on. A third frontier is the line between inferring emotions and detecting readily apparent expressions: a system that counts smiles arguably detects an expression, but the moment that count feeds a conclusion about satisfaction or engagement, it is being used to infer an emotional state. Organisations should resolve these questions conservatively in their classification memos and revisit them as Commission guidelines on prohibited practices and Board doctrine accumulate. In a category where the legislator has already signalled deep distrust, the benefit of the doubt will rarely run in the operator's favour — and the cost of guessing wrong is measured in percentages of global turnover. Until the case law arrives, the safest operating assumption is simple: if a system reads bodies to conclude anything about inner states, treat it as regulated, document the analysis, and let the classification memo, not the product roadmap, make the final call.

This article is for informational purposes only and does not constitute legal advice. Regulatory requirements change frequently — verify current rules with official sources. Built by Sawai Gyoseishoshi Office, Hiroshima, Japan.