Conversation intelligence in the EU: the AI Act and emotion recognition

Many conversation intelligence tools promise to read how a call felt: stress in a rep's voice, frustration in a customer's tone, an "emotion score" per call. In the EU, the AI Act draws a hard line around exactly that kind of feature when it is pointed at your own staff. This article explains what the AI Act says about emotion recognition, where the line sits for call analytics, and what to ask before you buy.

The AI Act in brief

The AI Act (Regulation (EU) 2024/1689) regulates AI systems by risk. A short list of practices is prohibited outright, some uses are classed as high-risk with strict obligations, and some systems carry transparency duties.

The timeline matters for buyers:

The Annex III date was moved from 2 August 2026 by Regulation (EU) 2026/1744, the Digital Omnibus on AI, which entered into force in July 2026. The prohibitions were not postponed. They already apply.

What the prohibition says

Article 5(1)(f) prohibits placing on the market, putting into service or using AI systems to infer the emotions of a natural person in the areas of workplace and education institutions. There is one exception: systems intended for medical or safety reasons.

For a sales, service or collections team, the workplace part is the one that counts. A tool that infers your reps' emotions from their calls falls inside the ban. Breaching Article 5 can lead to fines of up to EUR 35 million or 7% of worldwide annual turnover, whichever is higher (Article 99(3)).

The ban applies to the deployer, not only the vendor. If your organisation switches on an emotion feature for agents, your organisation is using a prohibited system, whatever the contract with the vendor says.

What counts as emotion recognition

The AI Act defines an emotion recognition system in Article 3(39) as an AI system for identifying or inferring emotions or intentions of natural persons on the basis of their biometric data. Biometric data, in Article 3(34), is personal data resulting from specific technical processing relating to a person's physical, physiological or behavioural characteristics.

Recital 18 adds detail:

• Emotions include things like happiness, sadness, anger, surprise, embarrassment, excitement, shame, contempt, satisfaction and amusement.
• Physical states such as pain or fatigue are not emotions.
• The mere detection of readily apparent expressions, gestures or movements is not emotion recognition, unless it is used to infer emotions.

The Commission guidelines

In February 2025 the European Commission published Guidelines on prohibited AI practices. They are non-binding, and the final word on interpretation rests with the Court of Justice of the EU, but they show how the Commission reads the ban. Three points are useful for call analytics:

1. Staff, not customers. The workplace prohibition protects workers. Using voice analysis in a call centre to track customers' emotions falls outside Article 5(1)(f). Tracking employees' emotions from their voice does not.
2. Biometric data is the trigger. The guidelines read the ban together with the definition in Article 3(39). Inferring emotions from voice, facial images or similar signals is in scope. On the Commission's reading, inferring emotions from written text is not, because it is not based on biometric data.
3. Fatigue is not an emotion. Detecting tiredness for safety reasons is treated differently from inferring feelings.

Voice versus transcript

This is where call analytics products differ most.

Two cautions apply. First, the line around text is a reading of non-binding guidelines, so a careful vendor should be clear about what it does and does not take from the audio. Second, a score built from the transcript is still personal data about your staff. It needs a lawful basis, transparency and proportionate use, as our guide to recording sales calls under the GDPR explains.

High-risk categories to watch

Even without emotion recognition, some call analytics uses may come close to Annex III point 4, on employment and workers' management. It covers AI systems intended to be used to make decisions affecting terms of work-related relationships, promotion or termination, to allocate tasks based on individual behaviour or personal traits, or to monitor and evaluate the performance and behaviour of workers.

Whether a given tool is high-risk depends on its intended purpose and how you use it. A system that ranks reps and feeds dismissal decisions is very different from one that answers a yes/no question about whether a disclosure was read out. From 2 December 2027, high-risk systems bring obligations for deployers too, including human oversight and, under Article 26(7), informing workers' representatives and affected workers before the system is used at work.

National law can add to this. In the Netherlands, Article 27(1)(l) of the Wet op de ondernemingsraden gives the works council a consent right over arrangements for systems aimed at or suitable for monitoring the presence, behaviour or performance of staff. Call analytics will often qualify.

Transparency

Transparency runs through both laws. Under the GDPR, callers and staff must be told that calls are recorded and analysed, and why. Under Article 50(3) of the AI Act, deployers of an emotion recognition system must inform the people exposed to it. If your tool does no emotion recognition, that specific duty does not arise, but your privacy notice and staff information should still describe what is analysed and how scores are produced.

Checklist for buyers of conversation intelligence

Ask your vendor, and get the answers in writing:

• Does the product infer emotion or tone from audio? If yes, can it be switched off completely for staff, and is it off by default?
• Does it create voiceprints or any other biometric template of speakers?
• Where do scores come from? The transcript only, or acoustic features of the voice?
• Can every score be explained? Look for reasons or quotes from the call, not a single opaque number.
• What is the intended purpose? Coaching and quality checks, or ranking and decisions about people? This shapes the high-risk question.
• Where is data processed and stored, and are AI models used with zero data retention? Is call data used to train models?
• Is there a DPA that lists sub-processors and their locations?
• How are access rights limited so that managers only see the teams they are responsible for?

On your side, update your record of processing, run a DPIA where needed, consult the works council if national law requires it, and tell staff plainly what is measured. For quality checks that avoid opaque scoring, see call QA with yes/no checks.

How VOIX helps

VOIX does not analyse emotion or tone from audio and does not create voiceprints. Every score, including sentiment and agreeableness, is produced from the transcript, with an explanation you can read. Checks answer your plain-language yes/no questions, and every answer is backed by the words from the call. VOIX is hosted in the EU, uses AI models with zero data retention, never uses call data to train models, and includes a DPA on every plan. See how compliance and QA teams use it on the compliance and QA page.

This article is general information, not legal advice. Check the rules that apply to your organisation with your legal adviser or data protection officer.

New to a term? See the glossary.

VOIX for compliance and quality assuranceEvery call checked against your script and the rules.