Deployers of emotion recognition or biometric categorisation must inform exposed persons
Download: JSON · MarkdownUnder EU AI Act, Article 50(3)
What this label means
- Verified
- — a named reviewer opened the official source and confirmed the record; the date and the reviewer are shown.
- Pending review
- — linked to the official source and in the queue for a reviewer to confirm.
- Source-linked
- — linked to the official source, not yet confirmed by a reviewer.
On this page 9 sections
In brief
Deployers of emotion recognition or biometric categorisation must inform exposed persons is a legal requirement under the EU AI Act in the European Union (Article 50(3)). It applies from 2 August 2026. The record carries 2 evidence examples and mappings to 2 frameworks.
- Instrument
- EU AI Act
- Jurisdiction
- European Union
- Nature
- Legal requirement
- Source reference
- Article 50(3)
- Applies from
- 2 August 2026
- Who it binds
- Deployer / user organisation, Public authority / government body
- Evidence examples
- 2
- Framework mappings
- ISO/IEC 42001:2023, NIST AI Risk Management Framework 1.0
- Controls that meet it
- 3
- Official source
- Open official text
- Verification
- Verified against the official source 26 Sep 2026
What does it require?
A deployer of an emotion recognition system or a biometric categorisation system must inform the natural persons exposed to it that the system is operating and must process their personal data in line with the GDPR, the Law Enforcement Directive and the EU institutions data protection regulation. Systems permitted by law to detect, prevent or investigate criminal offences are excepted, subject to safeguards. Use in workplaces and schools is separately banned by Article 5 except for medical or safety reasons.
Practical action
Place a visible notice at the point of capture and confirm a lawful basis for the biometric processing before switch-on.
Who does it apply to?
Deployers of emotion recognition or biometric categorisation systems that are not prohibited under Article 5.
Applies from:
Which controls meet this duty?
Satisfies: the control, operated properly, does the work the duty asks for. Supports: it contributes but the duty needs more. Each control page lists every other duty it serves, so work done once can be counted once.
-
satisfiesProcessProduct owner · at launch and on material changeAI interaction and use disclosure notices
Serves 18 recorded duties · evidence: AI interaction or use notice, Notice catalogue, Notice wording approval
Notice to persons exposed to the system.
-
supportsProcessAI governance lead · once per ai systemProhibited and unacceptable-use screening gate
Serves 7 recorded duties · evidence: Prohibited-use screening record, Screening list and escalation procedure
Confirms the use is not banned by Article 5.
-
supportsProcessData protection officer · once per ai systemPrivacy and data-protection controls for AI
Serves 13 recorded duties · evidence: Data protection impact assessment for an AI system, AI data-flow and legal-basis record, Privacy notice section on AI use
Lawful basis and safeguards for biometric data.
Templates that cover this duty
Generated from the records. Free · no account · links emailed to your work address. This duty is cited in each file with its source reference and a link back here.
- EU AI Act Role and Risk Classifier
Checklist · XLSX · v4
- AI Agent Registry and Permission Matrix
Register · XLSX and DOCX · v6
- EU AI Act Article 50 Transparency Kit
Kit · DOCX and XLSX · v44
- ISO/IEC 42001 Gap Assessment and Statement of Applicability
Assessment · XLSX · v3
What evidence would a reviewer expect?
| Evidence | Type | Notes |
|---|---|---|
| Exposure notice and signage | document | |
| Lawful-basis record for biometric processing | record |
Framework mappings
Original editorial crosswalks. They cite clause numbers only and reproduce no standard text; confidence reflects how direct the mapping is.
See every European Union duty mapped this way →
| Framework | Reference | Note | Confidence |
|---|---|---|---|
| ISO/IEC 42001:2023 | Annex A.8.5 | Information for interested parties. | medium |
| NIST AI RMF 1.0 | GOVERN 5.1, MEASURE 2.10 | Communication and privacy risk. | medium |
Frequently asked questions
Is this a legal requirement?
Yes. It is a legal requirement under EU AI Act (Article 50(3)).
Who must comply with this obligation?
Deployers of emotion recognition or biometric categorisation systems that are not prohibited under Article 5.
When does this obligation apply?
It applies from 2 August 2026.
What evidence shows compliance?
A reviewer would expect: Exposure notice and signage; Lawful-basis record for biometric processing.
Which frameworks map to this obligation?
It is mapped to ISO/IEC 42001:2023 Annex A.8.5, NIST AI Risk Management Framework 1.0 GOVERN 5.1, MEASURE 2.10. These are editorial crosswalks with a stated confidence, not official mappings.
Which controls satisfy this obligation?
Prohibited and unacceptable-use screening gate; Privacy and data-protection controls for AI; AI interaction and use disclosure notices.
What should an organisation do in practice?
Place a visible notice at the point of capture and confirm a lawful basis for the biometric processing before switch-on.
Cite this record
AIPolicyTracker (2026). “Deployers of emotion recognition or biometric categorisation must inform exposed persons (EU AI Act)” [AIPT-OBL-0040, verified 26 September 2026]. https://aipolicytracker.org/id/AIPT-OBL-0040 (accessed 8 November 2026). Data licensed CC BY 4.0.
Permanent id AIPT-OBL-0040: it never changes or gets reused, and its address keeps working if this page moves.
Cite the official text alongside it: Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence, Official Journal of the European Union, https://eur-lex.europa.eu/eli/reg/2024/1689/oj.
BibTeX
@misc{aipolicytracker2026_deployersofemotionrecogn,
author = {{AIPolicyTracker}},
title = {{Deployers of emotion recognition or biometric categorisation must inform exposed persons (EU AI Act)}},
year = {2026},
howpublished = {\url{https://aipolicytracker.org/obligations/eu-ai-act-art-50-3-emotion-recognition-notice}},
url = {https://aipolicytracker.org/obligations/eu-ai-act-art-50-3-emotion-recognition-notice},
urldate = {2026-11-08},
note = {Data licensed CC BY 4.0. Accessed 8 November 2026}
}
Change history
No change to this record's tracked fields has been recorded since 15 October 2026, when field-level history began.
Similar obligations in other instruments
- Employers must inform workers and their representatives before using high-risk AI at work — EU AI Act, European Union
- Disclose AI interaction and label synthetic content — EU AI Act, European Union
- Deployers must tell natural persons that a high-risk AI system is used in decisions about them — EU AI Act, European Union
- Deployers must disclose deepfakes and AI-generated text published on matters of public interest — EU AI Act, European Union
- Providers of generative AI must mark synthetic output as artificially generated in a machine-readable way — EU AI Act, European Union
- Deployers must explain individual decisions taken with high-risk AI on request — EU AI Act, European Union
- Frontier developers must publish a transparency report before deploying a new frontier model — California SB 53, California (United States)
- Provide deployers with clear instructions for use — EU AI Act, European Union
Disclaimer: informational only, not legal advice. Verify every claim against the linked official sources and consult a qualified lawyer before acting.