AI surveillance at work: what the AI Act truly prohibits.

What the AI Act prohibits from 2 February 2025

Article 5 of the AI Act explicitly prohibits emotion inference in the workplace. This measure came into force over a year ago, but its contours remain unclear for many businesses.

Article 5(1)(f) of the EU Regulation prohibits the placing on the market, putting into service, or use of AI systems designed to infer the emotions of a natural person in the workplace context. This prohibition covers several practices:

• Analysis of micro-facial expressions via camera or video.
• Detection of stress or fatigue through voice recognition.
• Assessment of engagement in meetings via intonation or eye movements.
• Any tool using biometric sensors to deduce an emotional state.

Exceptions are rare and strictly regulated. They mainly concern medical or safety uses, such as detecting drowsiness in professional drivers. For all other cases, the prohibition is absolute.

Market tools: who is affected by the prohibition?

Several popular tools incorporate emotion analysis features. Their status under the AI Act is now critical for employers.

Below is a non-exhaustive list of tools affected by the prohibition under Article 5:

Providers of these tools have until 2 November 2026 to comply with the transparency obligations under Article 50, but the prohibition under Article 5 already applies. Employers using these solutions risk penalties of up to €35 million or 7% of their global turnover.

The grey area of productivity monitoring

The AI Act does not prohibit productivity monitoring, but it may be classified as high-risk depending on the methods used. Explanation.

Productivity monitoring tools are not prohibited under Article 5, but they may be classified as high-risk if they fall within the scope of Annex III. This annex covers, in particular:

• AI systems used for workforce management and access to employment (point 4 of Annex III).
• Tools creating behavioural profiles of employees.
• Solutions evaluating performance in an automated manner.

Below are some market tools and their potential status under the AI Act:

For these tools, classification depends on their specific use. Basic time tracking may remain low-risk, while automated performance evaluation becomes high-risk. Employers must document their uses and assess risks on a case-by-case basis.

GDPR: the second framework to comply with for employee monitoring

The AI Act does not replace the GDPR. Employers must comply with both regulations or face cumulative penalties.

Employee monitoring is already regulated by the GDPR, particularly through:

• The principle of data minimisation (Article 5(1)(c)).
• The right of employees to be informed (Articles 13 and 14).
• The obligation to conduct a data protection impact assessment (DPIA) for high-risk processing (Article 35).
• The mandatory consultation of employee representatives (Works Council) for monitoring systems (Article L. 2312-38 of the Labour Code).

The CNIL has published specific recommendations on employee monitoring in teleworking. It states that monitoring tools must be proportionate and transparent. For example:

• Random screenshots are permitted if justified and limited.
• Real-time keyboard/mouse activity tracking is considered intrusive and should be avoided.
• Employees must be informed about monitoring systems and their purposes.

The CJEU's Barbulescu II ruling (2017) already set strict limits on monitoring employees' communications. The AI Act strengthens this framework by prohibiting certain practices and classifying others as high-risk.

How to achieve compliance with the AI Act and GDPR?

Employers must take action on several fronts to avoid penalties and protect employees' rights.

Here is a compliance checklist:

1. Audit the tools used: Identify all AI tools used for monitoring or evaluating employees. Check if they fall within the scope of Article 5 or Annex III of the AI Act.
2. Classify AI systems: For each tool, determine whether it is prohibited, high-risk, or low-risk. Document this classification.
3. Comply with GDPR obligations: Inform employees about monitoring systems, conduct a DPIA if necessary, and consult the Works Council.
4. Adapt uses: Disable prohibited features (emotion analysis) and limit high-risk uses to strictly necessary cases.
5. Train teams: Raise awareness among managers and HR about the legal limits of monitoring. Train employees on their rights.
6. Document compliance: Maintain a register of AI processing activities, retain evidence of compliance, and prepare responses in case of inspection.

Employers can rely on the AI Office's guidelines and the CNIL's recommendations to guide their approach. If in doubt, a compliance assessment can help identify risks specific to an organisation.