Deployers of emotion recognition or biometric categorisation must inform exposed persons
Context fileUnder EU AI Act, Article 50(3)
What does it require?
A deployer of an emotion recognition system or a biometric categorisation system must inform the natural persons exposed to it that the system is operating and must process their personal data in line with the GDPR, the Law Enforcement Directive and the EU institutions data protection regulation. Systems permitted by law to detect, prevent or investigate criminal offences are excepted, subject to safeguards. Use in workplaces and schools is separately banned by Article 5 except for medical or safety reasons.
Practical action
Place a visible notice at the point of capture and confirm a lawful basis for the biometric processing before switch-on.
Who does it apply to?
Deployers of emotion recognition or biometric categorisation systems that are not prohibited under Article 5.
Applies from:
Which controls meet this duty?
Satisfies: the control, operated properly, does the work the duty asks for. Supports: it contributes but the duty needs more. Each control page lists every other duty it serves, so work done once can be counted once.
-
satisfiesProcessProduct owner · at launch and on material changeAI interaction and use disclosure notices
Serves 17 recorded duties · evidence: AI interaction or use notice, Notice catalogue, Notice wording approval
Notice to persons exposed to the system.
-
supportsProcessData protection officer · once per ai systemPrivacy and data-protection controls for AI
Serves 13 recorded duties · evidence: Data protection impact assessment for an AI system, AI data-flow and legal-basis record, Privacy notice section on AI use
Lawful basis and safeguards for biometric data.
-
supportsProcessAI governance lead · once per ai systemProhibited and unacceptable-use screening gate
Serves 7 recorded duties · evidence: Prohibited-use screening record, Screening list and escalation procedure
Confirms the use is not banned by Article 5.
What evidence would a reviewer expect?
| Evidence | Type | Notes |
|---|---|---|
| Exposure notice and signage | document | |
| Lawful-basis record for biometric processing | record |
Framework mappings
Original editorial crosswalks. They cite clause numbers only and reproduce no standard text; confidence reflects how direct the mapping is.
See every European Union duty mapped this way →
| Framework | Reference | Note | Confidence |
|---|---|---|---|
| ISO/IEC 42001:2023 | Annex A.8.5 | Information for interested parties. | medium |
| NIST AI RMF 1.0 | GOVERN 5.1, MEASURE 2.10 | Communication and privacy risk. | medium |
Cite this record
AIPolicyTracker (2026). “Deployers of emotion recognition or biometric categorisation must inform exposed persons (EU AI Act)”. https://aipolicytracker.org/obligations/eu-ai-act-art-50-3-emotion-recognition-notice (accessed 24 September 2026). Data licensed CC BY 4.0.
Cite the official text alongside it: Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence, Official Journal of the European Union, https://eur-lex.europa.eu/eli/reg/2024/1689/oj.
Similar obligations in other instruments
- Provide deployers with clear instructions for use — EU AI Act, European Union
- Employers must inform workers and their representatives before using high-risk AI at work — EU AI Act, European Union
- Disclose AI interaction and label synthetic content — EU AI Act, European Union
- Providers of generative AI must mark synthetic output as artificially generated in a machine-readable way — EU AI Act, European Union
- Deployers must disclose deepfakes and AI-generated text published on matters of public interest — EU AI Act, European Union
- Deployers must explain individual decisions taken with high-risk AI on request — EU AI Act, European Union
- Deployers must tell natural persons that a high-risk AI system is used in decisions about them — EU AI Act, European Union
- Notify individuals about the use of personal data in AI recommendations and decisions — PDPC AI advisory guidelines, Singapore
Informational only, not legal advice. Verify every claim against the linked official sources and consult qualified counsel before acting.