Emotion Recognition and Biometrics Under the EU AI Act: Where the Ban Ends and High-Risk Begins

"Emotion recognition" sounds like one thing, but the EU AI Act regulates it three different ways depending on where it is used, who is being analysed and why. Get the boundary wrong and you are either over-cautious or inside a prohibition that carries fines of up to EUR 35 million or 7% of worldwide turnover. This guide maps the boundary. For the full list of bans, see our Article 5 guide; for the school context, see our education guide.

Layer 1: the ban in workplaces and schools

Article 5(1)(f) prohibits AI systems that infer emotions of people in the workplace or in educational institutions, except where the system is intended for medical or safety reasons. The Commission's Guidelines on Prohibited AI Practices, published in February 2025, flesh out the scope. According to an analysis of the guidelines for the emotion recognition field, emotion recognition extends beyond reading emotions from facial expressions and includes inferred intentions, and the guidelines distinguish biometric from non-biometric inference, which matters for text-based sentiment tools. The same analysis reports that the research exemption is strictly limited and that real-world testing in classrooms or workplaces is banned.

The ban applies to the person being analysed, not to the whole organisation. A call centre that analyses customers' voices is in a different position from one that analyses agents' voices.

Layer 2: emotion recognition elsewhere is high-risk

Outside workplaces and schools, emotion recognition is not banned. It is listed in Annex III point 1(c) as a high-risk use. That brings the full set of provider duties (risk management, data governance, technical documentation, logging, human oversight) described in our high-risk classification guide, plus a transparency duty for deployers under Article 50(3): they must inform the people exposed to the system.

Layer 3: biometric categorisation

Biometric categorisation has its own split. Article 5(1)(g) bans systems that categorise people by biometric data to infer race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation, with narrow exceptions for labelled lawful datasets. Other categorisation by sensitive attributes is high-risk under Annex III point 1(b).

The Commission's draft Article 6 guidelines apply this in a clinical setting: a system that infers health data from gait and assigns patients to disease stages is high-risk, and ECG, EEG, heartbeat and eye-tracking signals all count as biometric data, per Osborne Clarke's summary. See our healthcare AI guide for the full picture.

Layer 4: remote biometric identification

Remote biometric identification (not verification of a claimed identity) is high-risk under Annex III point 1(a). Real-time use by or for law enforcement in publicly accessible spaces is largely prohibited under Article 5(1)(h), with narrow exceptions subject to prior authorisation. Our public-sector guide covers the law enforcement side.

Where does my system land?

The classroom, role-play, customer-interaction and therapeutic examples come from the analysis of the Commission guidelines; treat that page as a secondary summary and check the Commission document itself for exact wording.

Three traps for product teams

1. Sentiment on text is not the same as emotion from biometrics. The guidelines separate the two, so document which one your product does.
2. "Wellbeing" is not a safe harbour. A workplace wellbeing dashboard inferring employee stress from voice or video is the kind of use the ban targets, unless a genuine medical or safety purpose applies.
3. Intended purpose is read from everything you publish. Marketing copy, demos and sales decks count.

Timeline

The Article 5 bans have applied since 2 February 2025 and are enforceable with fines today. The Annex III high-risk obligations moved to December 2027 after the Digital Omnibus (Regulation (EU) 2026/1744); see our EU AI Act summary. The Article 50 transparency duties started on 2 August 2026, so check how they interact with your deployments (our Article 50 guide has the detail).

This article is general information, not legal advice.