Emotion Recognition AI and the EU AI Act

Emotion recognition AI — systems that infer emotional states from facial expressions, voice tone, physiological signals, or behavioural patterns — is one of the most controversial AI categories. Independent scientific evaluation has cast significant doubt on the accuracy of facial-expression emotion recognition. Civil society and academic groups have raised fundamental-rights concerns. The European Parliament pushed for an outright ban during the legislative process, while industry argued for a more limited regulatory approach.

The result is a layered regime in the EU AI Act: emotion recognition is prohibited outright in two specific contexts (workplaces and education), high-risk in most other contexts, and subject to transparency obligations in all but a narrow law-enforcement case. This article explains each layer in detail.

The Article 3(39) Definition

The regulation defines an emotion recognition system narrowly:

'Emotion recognition system' means an AI system for the purpose of identifying or inferring emotions or intentions of natural persons on the basis of their biometric data.

Three elements matter:

1. "Identifying or inferring emotions or intentions" — the system's purpose is to determine emotional or intentional states
2. "Of natural persons" — applies to humans, not animals or fictional characters
3. "On the basis of their biometric data" — the input is biometric data: facial expressions, voice tone, physiological signals, gait, etc.

This last element is significant. Recital 18 clarifies:

The notion refers to emotions or intentions such as happiness, sadness, anger, surprise, disgust, embarrassment, excitement, shame, contempt, satisfaction and amusement. It does not include physical states, such as pain or fatigue, including, for example, systems used in detecting the state of fatigue of professional pilots or drivers for the purpose of preventing accidents. This does also not include the mere detection of readily apparent expressions, gestures or movements, unless they are used for identifying or inferring emotions.

Note the mechanism carefully. Recital 18 removes pain and fatigue detection from the definition in Article 3(39) altogether, so such systems never reach Article 5(1)(f) at all. That is distinct from the Article 5(1)(f) exception, which applies to systems that are emotion recognition systems but are intended to be put in place or on the market for medical or safety reasons.

The "biometric data" element of the definition also puts text-based sentiment analysis outside scope: inferring emotional tone from written text involves no biometric input. That conclusion follows from Article 3(39) itself rather than from anything Recital 18 says. Sentiment analysis of social media posts, customer reviews, or chat transcripts is therefore not regulated as an emotion recognition system under the EU AI Act (though it may still face GDPR and other obligations).

The Article 5(1)(f) Prohibition

Article 5(1)(f) prohibits emotion recognition AI in two specific contexts:

the placing on the market, the putting into service for this specific purpose, or the use of AI systems to infer emotions of a natural person in the areas of workplace and education institutions, except where the use of the AI system is intended to be put in place or into the market for medical or safety reasons;

Workplace Coverage

"Workplace" is broadly construed. It covers:

• Office environments (in-person and remote work)
• Manufacturing floors, warehouses, and service-industry premises
• Customer-facing roles (call centres, retail floors) where employee emotions are monitored
• Gig-economy platforms where worker emotions are tracked
• HR-driven engagement-monitoring software
• Performance-evaluation tools that use emotion inference

The prohibition applies whether the system is deployed by the employer or by a third-party platform serving employers. A SaaS tool sold to managers to "measure team engagement" through facial-expression analysis is prohibited, even if the SaaS provider does not directly operate within an employer's workplace.

Education Coverage

"Educational institutions" includes:

• Schools at all levels (primary, secondary, tertiary)
• Vocational training providers
• Online learning platforms used by educational institutions
• Universities

Use of emotion recognition in remote-proctoring software, attention-monitoring during online classes, or engagement-scoring during examinations is all captured by the prohibition.

Why the Limited Scope?

The Parliament's original position was a broader ban. The final compromise narrowed the prohibition to workplaces and education on the rationale that these contexts involve power imbalances that make consent meaningless and that emotion-recognition use in these areas raises particular fundamental-rights concerns. Other contexts — marketing, security, healthcare — remain permitted, though heavily regulated.

The Medical and Safety Carve-Out

The Article 5(1)(f) carve-out for medical or safety reasons is narrow, and two distinct routes need to be kept apart. First, Recital 18 places pure physical-state detection — pain and fatigue, including professional pilot and driver fatigue monitoring — outside the Article 3(39) definition entirely, so Article 5(1)(f) never applies to it. Second, for systems that do infer emotions within the meaning of Article 3(39), the carve-out permits workplace and education use where the system is intended to be put in place or on the market for medical or safety reasons. By implication:

Medical use cases (permitted under the carve-out):

• Detecting signs of medical distress in students or workers
• Monitoring for medical conditions (depression detection in clinical care, autism spectrum support tools)
• Therapy-support tools used by qualified clinicians

Safety use cases — the standard examples mostly never reach the carve-out at all, because detecting a physical state is not emotion recognition in the first place:

• Driver fatigue and alertness monitoring in commercial transport
• Operator alertness in heavy-machinery or hazardous-process control
• Pilot fatigue monitoring in aviation
• Maritime-watch alertness in shipping

Where a system does infer emotions rather than physical states — detecting acute panic or distress on a hazardous site so that a safety response can be triggered, for instance — the safety limb of the carve-out is the operative route.

What is not permitted under the carve-out:

• Productivity monitoring framed as "wellness"
• "Stress detection" used for performance evaluation
• Engagement-scoring of students for attention assessment

The line is the genuine purpose. A system whose primary effect is to support employee or student health, with no productivity- or evaluation-related output, can lean on the carve-out. A system whose primary effect is performance-related, with health framing added later, cannot.

Annex III, Point 1(c) — High-Risk Outside the Prohibition

Outside the workplace and education contexts, emotion recognition is permitted but high-risk under Annex III, point 1(c). This applies to:

• Marketing research using emotion recognition
• Customer-service quality assessment using emotion analysis
• Security-screening contexts (airports, public events) where emotion is treated as a risk indicator
• Entertainment applications using emotion-driven personalisation
• Clinical research deploying emotion recognition outside the carve-out

The full Articles 8–15 high-risk regime applies:

• Risk management (Article 9) — must address the well-documented accuracy and bias limitations of emotion recognition
• Data governance (Article 10) — training data must be representative of the populations the system will be used on
• Technical documentation (Article 11) — per Annex IV
• Record-keeping (Article 12) — automatic event logging
• Transparency to deployers (Article 13) — including disclosure of accuracy, intended populations, and known limitations
• Human oversight (Article 14) — clear path for human review of inferences
• Accuracy and robustness (Article 15) — including validation against diverse populations
• Conformity assessment (Article 43) — emotion recognition sits in point 1 of Annex III, so under Article 43(1) the internal-control procedure (Annex VI) is available only where the provider has applied harmonised standards or, where applicable, common specifications; otherwise the Annex VII procedure with the involvement of a notified body is mandatory. No AI Act harmonised standard has yet been cited in the Official Journal, so providers should currently plan for the notified-body route
• CE marking (Article 48)
• EU database registration (Article 49)

Article 50 Transparency Obligations

Article 50(3) imposes transparency obligations on deployers of emotion recognition systems, regardless of whether the system is high-risk:

Deployers of an emotion recognition system or a biometric categorisation system shall inform the natural persons exposed thereto of the operation of the system, and shall process the personal data in accordance with Regulations (EU) 2016/679 and (EU) 2018/1725 and Directive (EU) 2016/680, as applicable. This obligation shall not apply to AI systems used for biometric categorisation and emotion recognition, which are permitted by law to detect, prevent or investigate criminal offences, subject to appropriate safeguards for the rights and freedoms of third parties, and in accordance with Union law.

This is a layered obligation: information to the affected person, plus GDPR or LED compliance for the data processing.

The transparency obligation admits one statutory exemption. Under the second sentence of Article 50(3), it does not apply to emotion recognition or biometric categorisation systems that are permitted by law to detect, prevent or investigate criminal offences, subject to appropriate safeguards for the rights and freedoms of third parties and in accordance with Union law. Outside that law-enforcement carve-out the duty stands, including for deployments relying on the Article 5(1)(f) medical or safety exception. A workplace system that infers acute emotional distress for safety reasons must still be disclosed to the workers exposed to it, though their employment context may already provide that disclosure. A pure fatigue- or drowsiness-detection system is a different case: as Recital 18 makes clear, it falls outside the emotion-recognition definition entirely, so Article 50(3) does not attach to it at all.

GDPR Article 9 — The Biometric-Data Restriction

Emotion recognition processes biometric data, which is subject to GDPR Article 9. The processing of biometric data for the purpose of uniquely identifying a natural person is prohibited under Article 9(1), with the Article 9(2) exceptions.

Emotion recognition often does not aim at unique identification (it aims at categorising emotional states), and there is ongoing legal debate about whether GDPR Article 9 applies to it. The most cautious position — taken by several EU data protection authorities — is that emotion recognition does fall under Article 9, requiring an explicit consent or other Article 9(2) basis. EDPB Guidelines 3/2019 on video devices in fact point the other way: paragraph 80 states that where the purpose is to distinguish one category of people from another but not to uniquely identify anyone, the processing does not fall under Article 9. Article 9 can still bite where the emotion inference itself reveals a special category — for example where the system deduces health data (Guidelines 3/2019, paragraph 64) or draws on physiological signals such as heart rate or skin conductance.

In practice, deployers should assume Article 9 applies and design accordingly. Explicit consent is the most defensible basis for most non-medical contexts. Medical deployments may rely on Article 9(2)(h) — preventive or occupational medicine, assessment of the working capacity of the employee, medical diagnosis, or the provision of health or social care, subject to the professional-secrecy conditions in Article 9(3) — or on Article 9(2)(i) (public interest in the area of public health) where appropriate. Article 9(2)(h) is not a general "health and safety" ground, and will not carry an ordinary industrial or transport safety deployment.

Accuracy and Reliability Concerns

A significant body of independent research has questioned the scientific validity of facial-expression-based emotion recognition. The Association for Psychological Science's 2019 review (Barrett et al.) found that human emotion cannot reliably be inferred from facial expressions across cultures and contexts. Subsequent research has confirmed limited generalisation, cultural and demographic bias, and substantial false-positive and false-negative rates in production systems.

For high-risk emotion-recognition systems, this scientific debate has compliance implications:

• Risk management (Article 9) must address accuracy limitations and the possibility of systematic bias against demographic groups
• Data governance (Article 10) must include representative training data across genders, ethnicities, ages, and cultural contexts
• Accuracy disclosures (Article 13 and 15) must reflect honest performance metrics — likely substantially below the marketing claims of many vendors
• Human oversight (Article 14) must allow trained reviewers to override AI-generated emotion inferences

In practice, deploying a high-risk emotion-recognition system that meets the regulation's substantive requirements is genuinely hard. Many vendors will struggle to demonstrate accuracy across diverse populations. Buyers should ask for cross-demographic accuracy data and independent evaluations.

Specific Deployment Scenarios

Customer-Service Call Centre Emotion Analytics

AI that analyses customer voice tone in real time during calls:

• Classification: high-risk under Annex III, point 1(c) (if customers are being analysed). If used to monitor agent emotions during calls, prohibited under Article 5(1)(f).
• Compliance: full Article 8–15 regime if customer-facing; full prohibition if agent-facing. GDPR Article 9 in both cases.

Marketing Research with Webcam-Based Emotion Coding

Studies that use webcam-based emotion coding of participants watching advertisements:

• Classification: high-risk under Annex III, point 1(c)
• Compliance: full Article 8–15 regime; explicit consent under GDPR; clear Article 50 disclosure

Driver Fatigue Detection in Commercial Vehicles

Safety system that detects driver drowsiness or distraction in trucks or buses:

• Classification: fatigue and drowsiness are physical states excluded from the Article 3(39) definition by Recital 18, so the system sits outside the Article 5(1)(f) prohibition entirely rather than relying on the carve-out. Annex III, point 2 is a poor fit — it targets safety components in the management and operation of road traffic, meaning traffic infrastructure rather than in-vehicle equipment. The realistic high-risk route is Article 6(1) with Annex I, Section A, as a safety component of a product covered by EU vehicle type-approval legislation.
• Compliance: full Article 8–15 regime if high-risk under Article 6(1); Article 50(3) does not attach, because the system is not an emotion recognition system; GDPR still governs the biometric processing, with Article 9 in play where the output amounts to health data

Online Proctoring with Facial Expression Monitoring

Proctoring software that analyses student facial expressions during exams:

• Classification: prohibited under Article 5(1)(f) (educational institution context). Even gaze tracking that does not infer emotions can fall under Annex III, point 3 (education).
• Compliance: redesign or do not deploy. Replace with non-emotion-recognition proctoring approaches.

Employee Engagement Surveys with Voice Analysis

Internal tool that analyses employee voice tone during team meetings:

• Classification: prohibited under Article 5(1)(f). The wellness framing does not save the deployment if its purpose includes engagement/performance assessment.
• Compliance: do not deploy. Replace with traditional survey methods or anonymous self-reporting.

Clinical Depression Screening with Voice Analysis

Clinical research tool used by qualified clinicians to assist depression diagnosis:

• Classification: medical use case; carve-out from Article 5(1)(f) likely applies. High-risk under Annex III, point 1(c) outside workplace/education. Potentially also a medical device under MDR.
• Compliance: full Article 8–15 regime; MDR conformity assessment if a medical device; GDPR Article 9(2)(h); clinical-evaluation evidence

Compliance Checklist for Emotion Recognition Deployments

1. Define the deployment context precisely. Workplace? Education? Marketing? Safety? Healthcare?
2. Check the Article 5(1)(f) prohibition. Workplace and education contexts trigger the ban unless the medical or safety carve-out genuinely applies.
3. If permitted, classify the system. Emotion recognition outside the prohibited contexts is high-risk under Annex III, point 1(c).
4. Plan the Article 8–15 compliance. Pay special attention to risk management (Article 9) and accuracy (Article 15) given the scientific debate over emotion recognition.
5. Implement Article 50(3) transparency. Inform affected individuals.
6. Establish a GDPR Article 9 basis. Explicit consent is the safest for non-medical use cases.
7. Document the accuracy assessment. Maintain cross-demographic accuracy data; if your training data does not support the claimed accuracy across populations, your Article 15 compliance is at risk.
8. Train deployers and operators. Article 4 AI literacy applies; people interpreting emotion-recognition outputs must understand the system's limitations.
9. Provide a human-review path. Article 14 oversight requires that meaningful human review is available for decisions affecting individuals.

Conclusion

Emotion recognition AI is one of the most regulated AI categories in the EU, with prohibitions in workplaces and education, high-risk classification elsewhere, transparency obligations subject only to a narrow law-enforcement exemption, and overlapping GDPR Article 9 restrictions. The scientific debate over emotion-recognition accuracy adds substantive compliance risk on top of formal requirements.

For organisations considering emotion-recognition deployments, the practical question is often not "how do we comply" but "is this the right tool for the problem we are trying to solve." Where the answer remains yes, the compliance path is detailed but tractable.

For broader context on the prohibited-practices regime, see prohibited AI practices under the EU AI Act. For the related biometric categorisation regime, see biometric AI compliance.