Is emotion recognition legal in the workplace?

The short answer, by jurisdiction

If you operate across borders, the EU position is the binding constraint in practice. It is the strictest, it is already in force, and it carries the largest penalty.

Why the EU answer is a flat no

Article 5(1)(f) of the EU AI Act prohibits:

the placing on the market, the putting into service for this specific purpose, or the use of AI systems to infer emotions of a natural person in the areas of workplace and education institutions, except where the use of the AI system is intended to be put in place or into the market for medical or safety reasons.

Three features of that prohibition catch people out.

There is no consent route. Article 5 practices are banned outright. This is structurally different from GDPR, where you identify a lawful basis and proceed. You cannot consent your way into a prohibited practice, and an employment relationship is precisely the context where regulators are most sceptical that consent is freely given anyway.

"Workplace" is broad. It covers recruitment and hiring, physical and virtual workspaces, and remote work. Situations "related to" the workplace are also caught, so engaging a third-party training provider does not move you outside the rule.

Both vendor and deployer are liable. The Act catches placing on the market, putting into service, and use.

Penalties sit in the Act's top tier: up to €35 million or 7% of total worldwide annual turnover, whichever is higher.

What is not caught

The prohibition is narrower than the headlines suggest, and the carve-outs are real.

The ban applies to inferring emotions from biometric data. Recital 18 explicitly excludes:

• Physical states such as pain and fatigue — the recital cites fatigue detection in pilots and drivers
• Readily apparent expressions and gestures, unless used to infer emotions
• Voice characteristics alone, such as a raised voice, unless used to infer emotion
• Emotion inferred from written text, which is outside scope entirely

And critically, signals that are not biometric at all sit outside the prohibition. Whether someone switched browser tabs, how long they spent on a section, whether the window lost focus — none of this is biometric processing, and none of it infers an emotional state.

The medical and safety exception is narrow

Vendors reach for this exception often. It rarely applies.

Medical means genuine medical use, pointing toward CE-marked medical devices used therapeutically. General wellbeing monitoring does not qualify — detecting employee stress or burnout is not a medical reason, however well-intentioned.

Safety covers protecting life and health. It does not extend to protecting property, preventing fraud or securing assets.

Both require a demonstrable, explicit need, limited in time, scale and the people covered, and the data cannot be repurposed afterwards.

The UK is different — but not unregulated

The EU AI Act does not apply in the UK, and there is no equivalent statutory prohibition. That does not make emotion recognition a free-for-all.

The ICO has been notably direct on this. It has publicly warned organisations about biometric technologies that claim to detect emotional states, pointing to the weak scientific footing for inferring reliable emotional conclusions from physiological signals, and cautioning that systems failing to work as claimed create discrimination risk.

In practice a UK deployment needs: a lawful basis under UK GDPR; a condition for processing special category data if biometric data is used for identification; a Data Protection Impact Assessment; and a defensible answer on necessity and proportionality. Consent from employees remains hard to rely on for the same power-imbalance reasons.

Note also the extraterritorial catch: a UK vendor selling into the EU is a provider placing a system on the EU market, and a UK company training staff based in the EU has EU deployers in scope. "We're not in the EU" is not the end of the analysis.

What this means if you are buying

Ask one question first: does the engagement score require a camera?

If it does, and you have EU staff or students, you need to know exactly what inference is drawn from that feed before you proceed — and you should expect the vendor to warrant its Article 5 position in the contract rather than the sales deck.

If it does not, Article 5(1)(f) is not your problem. You still have GDPR obligations, you still need a DPIA for employee monitoring, and you still need to handle the cultural question of telling people you are measuring their attention. But you are not deploying a prohibited practice.

The reassuring part, covered in more detail in our guide to lawful alternatives, is that the behavioural signals were always the stronger predictor anyway. A 2024 ScienceDirect study found tab-switching to be the single strongest predictor of disengagement in online courses — better than self-regulation or satisfaction measures. The facial layer adds roughly three percentage points of classification accuracy, and carries essentially all of the legal risk.

Frequently asked questions