Your contact centre is probably not running a prohibited practice

Article 5(1)(f) prohibits AI systems used “to infer emotions of a natural person in the areas of workplace and education institutions,” with a carve-out for medical and safety purposes. Read alone, that catches everything.

But “emotion recognition system” is a defined term. Article 3(39) defines it as a system for inferring emotions “on the basis of their biometric data.”The European Commission’s guidelines on prohibited practices confirm the prohibition is limited accordingly.

So the question is not does it detect emotion. The question is what does it read:

• Voice characteristics, facial expression, physiological signal — biometric. In scope.
• The words in a transcript, a survey answer, a ticket — not biometric. Out of scope.

A system that scores the sentence “this is unacceptable” as angry is doing text analysis. A system that reaches the same conclusion from the speaker’s pitch and pace is doing emotion recognition as the Act defines it. Same output, different legal universe.

The clearest example is NICE, whose documentation states it twice, unprompted:

“Frustration cues are not influenced by voice characteristics, such as tone, volume, and speed.”

The same sentence appears again for sentiment scores. That is not an accident of phrasing. A vendor does not write that line unless someone asked the question. The feature was also renamed away from “Real-Time Voice Emotion Detection” to “transcript-based”, which is a compliance decision wearing a product-naming costume.

The pattern held across the market. Freshworks documents “sentiment expressed within the text.” Salesforce classifies “the sentiment of text.” Genesys places its sentiment markers in the transcript. Zendesk’s Tone Shift does not infer emotion about anyone, it rewrites the agent’s own draft.

Not one confirmed prohibited practice.One feature reads a genuine biometric signal: Sprinklr documents “Voice Tonality for Customer Satisfaction Analysis.” But every sentence on that page is about the customer, not the agent, which makes it an Article 50(3) duty to inform the people exposed rather than an Article 5 prohibition. Whose voice is being read decides which law applies.

Verint, Qualtrics, Workday Peakon, Microsoft Viva and SAP SuccessFactors all point at employees. None of their pages states what signal the analysis runs on. That single missing fact is what decides whether the feature is ordinary HR analytics or a prohibited practice.

We are not going to guess it, and neither should you. Put it to the vendor in writing:

Does this feature infer emotional or affective state from biometric data, meaning voice characteristics such as tone, pitch or pace, facial expression, or physiological signal? Or does it operate only on text, such as transcripts, survey responses and written comments? If any biometric signal is used, confirm whether it is applied to employees.

A vendor that cannot answer that in one sentence has told you something. Keep the reply: under Article 26 you carry your own obligations as a deployer, and a written answer from the provider is the cheapest evidence you will ever collect.

It does not mean employee sentiment analysis is fine. It means Article 5 of the AI Act is probably not your problem, which is different. Three things remain live:

• GDPR did not go anywhere. Monitoring employee mood, by any signal, engages data protection law that has been enforced against workplace surveillance for years. It is the older and in practice more likely exposure.
• Article 50(3) still applies to any emotion recognition or biometric categorisation you do run. People exposed to it have to be told it is operating.
• Works councils and staff trust are not legal questions and do not care how the Act defines a term.

And one honest caveat about our own reading. The article text says “infer emotions” without repeating the biometric qualifier; it arrives through the Article 3(39) definition and the Commission’s guidelines, which are not binding on a court. A regulator or judge could read it more widely than the Commission does. Everything above is “likely outside scope under current guidance”, not “safe”, and none of it is legal advice.

Every classification above is recorded on the finding with the sentence it rests on, the page it came from, and the date we read it. Where a page did not settle the question we recorded that instead of filling the gap.

Browse the heatmap for the underlying findings, or read the methodology, including the August 2026 audit in which we re-checked every stored quotation and published what did not hold.