The EU AI Act and engagement analytics

What Article 5(1)(f) actually says

The EU AI Act divides AI systems into risk tiers. Most regulated systems are "high-risk" — permitted, but subject to conformity assessment, documentation and human oversight obligations. A much smaller set of practices sits in a different category entirely: prohibited. These are not permitted under any conditions save narrow statutory carve-outs.

Article 5(1)(f) prohibits:

the placing on the market, the putting into service for this specific purpose, or the use of AI systems to infer emotions of a natural person in the areas of workplace and education institutions, except where the use of the AI system is intended to be put in place or into the market for medical or safety reasons.

Three things about that sentence matter more than anything else in this guide.

First, it covers the whole commercial chain. Placing on the market, putting into service, and use. The vendor who sells it and the employer who deploys it are both in scope.

Second, "workplace" and "education institutions" are read broadly. Guidance treats the workplace as including recruitment and hiring, physical and virtual workspaces, and remote work. Education institutions covers all types and levels, including admissions. Situations "related to" these contexts are also caught — a training session delivered by a third-party provider to a company's employees does not escape by virtue of the provider not being the employer.

Third, there is no consent gateway. This is where most organisations get it wrong. Article 5 is a prohibition, not a permission subject to safeguards. Employee consent, works council agreement, a legitimate interest assessment, an opt-in checkbox — none of these make a prohibited practice lawful. That is a different mental model from GDPR, and the difference is expensive.

The four-part test

For the prohibition to bite, all four elements must be present. If any one is absent, Article 5(1)(f) does not apply — though other law, notably GDPR, still will.

The third element is where the analysis usually turns, and it is worth being precise. The Commission has clarified that the prohibition should be read alongside the Article 3(39) definition of an "emotion recognition system", and thereby limited to inferences based on biometric data. An engagement score derived from whether a learner switched browser tabs is not derived from biometric data. An engagement score derived from their facial expression is.

What is explicitly excluded

Recital 18 does real work here. It carves several things out of the definition of emotion inference:

• Physical states such as pain and fatigue. The recital gives the example of systems used to detect fatigue in professional pilots or drivers to prevent accidents.
• Readily apparent expressions, gestures and movements — "basic facial expressions, such as a frown or a smile, or gestures such as the movement of hands, arms or head" — unless they are used to infer emotions. The qualifier is doing the heavy lifting: observing a smile is fine, concluding "this person is happy" from it is not.
• Voice characteristics alone, such as a raised voice or whispering, unless used to infer an emotional state.
• Emotion inferred from written text, which falls outside scope entirely.

The practical read: the Act is not concerned with observation as such. It is concerned with the inferential leap from biometric signal to emotional state in two specific, power-imbalanced contexts.

The medical and safety exception

There is one carve-out, and it is narrower than most vendors imply.

Medical is construed to mean genuine medical use — guidance points toward CE-marked medical devices used for therapeutic purposes. General wellbeing monitoring does not qualify. Detecting employee stress or burnout, however sincerely motivated, is not a medical reason.

Safety is limited to protecting life and health. It does not extend to protecting property, preventing fraud, or securing assets.

Both limbs require a demonstrable, explicit need, and are expected to be limited in time, scale and the people covered. Data gathered under the exception cannot then be repurposed — GDPR purpose limitation continues to apply.

If you are being sold an emotion recognition tool for workplace training on the basis that it "supports learner wellbeing", that is not the safety exception. It is a marketing claim wearing a legal costume.

Penalties and dates

The prohibitions were the first part of the Act to apply, ahead of the high-risk obligations. There is no grace period still running. Anything in production today in an EU workplace or education setting is already subject to the rule.

What this means for engagement analytics

Engagement analytics is not one technology. It is a family of approaches with very different legal profiles, and they are routinely marketed as if they were interchangeable. They are not.

The row in bold is the one most of this market is built on. Facial expression analysis producing a seven-emotion probability vector, deployed into a corporate LMS or a university VLE, is a textbook description of the prohibited practice in a textbook description of the prohibited context.

That is worth sitting with if you are currently evaluating vendors. Several well-known products in this category cannot lawfully be deployed for EU workplace or education training, regardless of how the contract is drafted or what the consent flow looks like.

The compliant path

Here is the part the law firm write-ups tend to leave out: you can still measure engagement. The prohibition is narrow and specific, and the most predictive signals were never the biometric ones.

That is not a consolation prize. It is what the research actually shows. A 2024 ScienceDirect study found that "cyberloafing" — tab-switching away from the learning content — was the single strongest predictor of disengagement in online courses, outperforming self-regulation and satisfaction measures. Adding facial expression to behavioural signals improves classification accuracy from roughly 91.5% to 94.6%. Real, but marginal, and it is the increment that carries all of the legal risk.

So the compliant architecture looks like this:

• Behavioural telemetry as the primary signal. Page Visibility API, focus and blur events, dwell time per section, scroll depth, interaction latency, session abandonment. Native browser APIs. No camera. No biometric processing.
• Content-level rather than person-level reporting. Aggregate to the section, module or slide. "60% of learners disengage at slide 14" needs no personal data at all. This also sidesteps most of the GDPR analysis, because there is no personal data to process.
• No emotional inference. Report attention and disengagement risk, not emotional states. The distinction is not cosmetic — it is the operative element of the prohibition.
• Facial analysis reserved for contexts where it is lawful. Market research, advertising and media testing, consumer UX studies, and genuine medical or safety applications are all outside the workplace and education prohibition.

What is still unresolved

Anyone claiming total certainty here is overselling. Three questions are genuinely open:

Secondary functionality. The Commission guidelines do not resolve whether a system whose primary purpose is not emotion inference, but which has emotion inference as a secondary capability, is caught. The worked example in the literature is a proctoring system that monitors students during an exam and also happens to identify emotions. Until this is settled, a conservative reading is prudent.

Mood detection. The boundary between an emotion (in scope) and a mood or physical state (out of scope) is not crisply drawn. Recital 18 acknowledges "a thin line" between emotions and states like pain or fatigue.

Attention and engagement specifically. Neither is named in the recital. Where engagement is inferred from biometric data, the analysis is genuinely uncertain. Where it is derived from behavioural signals, it is not — which is a strong argument for choosing behavioural architectures on risk grounds alone.

A buyer's checklist

Take this to your next vendor call.

1. Does the engagement score require camera access? If yes, everything below matters. If no, you are in much simpler territory.
2. What exactly is inferred from the camera feed? Ask for the output schema. "Engagement index" can mean very different things.
3. Is any inference about emotional state produced, stored or transmitted? Including as an intermediate value you never see.
4. Where does inference run? Client-side processing is better for GDPR, but it does not cure an Article 5 problem. A prohibited practice is prohibited wherever the computation happens.
5. Can the product run in a behavioural-only mode? If so, get the configuration in the contract, not the sales deck.
6. Will the vendor warrant Article 5(1)(f) compliance for your specific deployment context? A vendor confident in its position will. Reluctance is informative.
7. Is reporting available at content level rather than individual level? Aggregate reporting reduces both legal and cultural risk.
8. What is the DPIA position? Any engagement monitoring of employees or students will need one regardless of the AI Act analysis.

If you want the shorter version of this: the EU has not banned measuring engagement. It has banned inferring how people feel from their bodies at work and at school. Those are different things, and the second one was never where the signal was strongest anyway.

Frequently asked questions