By the Shadow AI Policy team
If your contact-centre, sales-coaching, or meeting platform scores how stressed or happy your employees sound, it is already illegal in the EU and becomes illegal in California on 1 January 2027.
This post explains exactly which law bans what, where emotion-scoring features hide inside common workplace tools, how to decide whether your current setup is compliant, and what your acceptable use policy needs to say to close the gap.
Don't wait for the California deadline to audit your tools — the EU prohibition has been in force since 2 February 2025, and any EU-based employee or contractor covered by the AI Act is already in scope. Pull your contact-centre and sales-coaching vendor contracts now, find the sentiment features, and turn them off or get written confirmation they're disabled.
By the Shadow AI Policy team
The prohibition isn't buried in guidance or a future delegated act. Regulation (EU) 2024/1689, Article 5(1)(f) — part of the EU AI Act — bans placing on the market, putting into service, or using AI systems that infer the emotions of natural persons in the workplace or in educational settings. The only exceptions are systems deployed for medical or safety reasons. Chapter II, which contains Article 5, has applied since 2 February 2025 — that date is already eight months in your past.
The scope is broad by design. It covers employers, vendors, and any entity deploying such a system in an EU workplace context. It doesn't matter whether the AI system is built in the EU or licensed from a US vendor — if employees are in the EU, the prohibition applies to how the tool is used with them. Non-compliance with Article 5 prohibitions sits at the top tier of AI Act penalties: up to €35 million or 7% of global annual turnover, whichever is higher.
This is not an addition from an Omnibus revision or a later amending regulation. It was in the original text of Regulation (EU) 2024/1689 as passed and published in the Official Journal.
California AB 1883 (Stats. 2026, ch. 853), codified as Labor Code § 1581, prohibits any employer from using a workplace surveillance tool that uses AI to recognise, infer, or predict an individual employee's emotional state, or to collect neural data. The effective date is 1 January 2027 — still ahead, but less than three months away as of today. Check the AI regulation compliance deadlines tracker for the confirmed effective date alongside other California and federal AI obligations.
Section 1581(b) carves out use "to ensure safety" — worded more narrowly than the EU's "medical or safety reasons" carve-out. The civil penalty is up to $500 per violation under § 1582(d). At a company with 200 customer-service agents using a non-compliant sentiment tool on every shift, "per violation" can compound fast depending on how a court or regulator interprets the unit of violation.
California employers should also note that § 1581 applies to any employer with employees in California, not just California-incorporated companies. If your contact centre has agents anywhere in the state, you're in scope.
Neither law names specific products, so the compliance work is on you. Emotion-scoring features tend to appear under softer marketing language. Look for these in your current stack:
The critical distinction — and one that is currently untested in both jurisdictions — is between scoring a person's emotional state versus scoring a conversation's emotional tone or a customer's sentiment. A feature that labels the customer as frustrated is different from a feature that flags the agent as anxious. Where exactly that line falls in live products, and how regulators will draw it, has not been decided by any court or regulator in the EU or California as of today. If a feature could plausibly be read as inferring an employee's internal emotional state — even as a byproduct of conversation analysis — treat it as in-scope until there is clearer guidance.
Tools worth checking immediately include any platform with call-recording and AI analysis. See the workplace risk profiles for Zoom AI Companion, Fireflies.ai, and Salesforce Einstein for feature-level detail on what each tool's published documentation says about sentiment and emotion features.
Use this three-question test for each AI feature in your stack. If you answer "yes" to question 1 and "no" to question 3, the feature is prohibited and must be disabled before it is used in the relevant jurisdiction.
| Question | What to check | If YES | If NO |
|---|---|---|---|
| 1. Does the feature infer an employee's emotional state? | Read the vendor's feature description. Does it label the employee (not just the conversation or the customer) with a mood, stress level, sentiment, or emotional score? | Move to Q2 | Not in scope — stop here |
| 2. Is it on by default, or enabled in your current plan? | Check admin settings and your vendor contract. Many sentiment features are bundled into enterprise tiers and enabled unless you opt out. | You are actively using a prohibited feature — move to Q3 urgently | Confirm in writing with vendor that it is off and cannot be re-enabled without your action |
| 3. Does a safety or medical exception honestly apply? | EU: "medical or safety reasons" (Art. 5(1)(f)). California: "to ensure safety" (§ 1581(b)). Ask: would this use survive regulatory scrutiny as a genuine safety measure, or is it primarily a performance management or coaching tool? | Document the safety rationale in writing before continuing use | Feature is prohibited. Disable it and get written confirmation from vendor. |
Your AI acceptable use policy needs an explicit prohibited-uses clause covering emotion recognition. Don't rely on a general "no unauthorized AI tools" clause — that won't tell a hiring manager or IT admin that the agent sentiment dashboard in your CCaaS platform is off-limits. Write it out. The AI acceptable use policy template contains a prohibited-uses section you can adapt directly.
A minimal clause looks like this:
Prohibited use — employee emotion recognition: No AI system may be used to infer, predict, or score the emotional state, stress level, mood, or affective condition of any employee or contractor. This applies regardless of whether the feature is marketed as sentiment analysis, wellbeing monitoring, agent coaching, or similar. Features that score customer or conversation sentiment are permitted only where the output cannot be attributed to or used to infer an individual employee's emotional state. The [designated owner role] is responsible for confirming, in writing on a quarterly basis, that all licensed tools with sentiment or emotion features have those features disabled for employee-facing use.
Name a real owner — typically the Head of IT, the HRIS lead, or the Chief People Officer, depending on your structure. "The company" owning compliance is not ownership. The person named should have admin access to the relevant platforms and authority to contact vendors for written confirmation of feature status.
Hypothetical example (illustrative only): Imagine a 150-person SaaS company running a cloud contact centre for customer support. Their CCaaS vendor includes an agent sentiment module enabled by default in the enterprise tier. Under this policy clause, the IT lead would need to log into the admin console, disable the agent sentiment dashboard, and request written confirmation from the vendor that the feature is off — before 2 February 2025 for EU-based agents (already past) and before 1 January 2027 for California agents. That confirmation becomes part of the company's compliance record.
For a broader view of how to structure shadow AI governance beyond this specific prohibition, see our guide on what shadow AI is and why it creates compliance risk. If you want a policy kit built around your company's size, industry, and jurisdictions, generate a tailored policy kit that includes the prohibited-uses section pre-populated for EU and California requirements.
About Shadow AI Policy: We build AI acceptable use policy tools for HR and operations teams at 50–500 person companies. We publish guides on shadow AI, acceptable use policies, and AI governance, updated as regulations and AI tools change.
The EU AI Act Article 5(1)(f) permits emotion inference for "medical or safety reasons" — a slightly broader carve-out that could, in principle, cover occupational health monitoring with appropriate safeguards. California Labor Code § 1581(b) uses the narrower phrase "to ensure safety," which points more directly at physical safety in industrial or hazardous-work contexts. Neither jurisdiction has published formal guidance on exactly where the line sits, so if you're relying on a safety exception, document the specific safety rationale in writing, keep it tied to an identified hazard, and don't use it to cover general performance coaching or wellbeing dashboards.
Yes. The EU AI Act applies based on where the AI system is used and who is affected, not where the vendor is incorporated. If your US-headquartered CCaaS vendor's emotion-scoring feature is being used on employees located in the EU, the prohibition in Article 5(1)(f) applies to your use of it. The vendor's location is irrelevant to your compliance obligation as the deploying employer — though it may affect the vendor's own obligations under the AI Act's provider rules.
Possibly, but don't assume so without checking the feature in detail. If the output is a score attached to the conversation as a whole or to the customer, and it's not used to evaluate or flag the individual agent, you're in better shape. If the dashboard shows each agent's sentiment score, flags agents as stressed, or feeds into agent performance metrics, you're likely inferring the employee's emotional state regardless of how the vendor labels the feature. The line between conversation-level and person-level inference is untested in both jurisdictions — treat anything that could be read as attributable to an individual employee as in-scope until regulators or courts say otherwise.
Update your AI acceptable use policy first — that's the fastest and most direct fix. You don't necessarily need to amend individual employment contracts, but if your existing contracts or staff handbooks reference the company's right to use monitoring or analytics tools, review that language to make sure it doesn't appear to authorize a practice that is now prohibited by law. In the EU, you may also need to update any Works Council agreements or GDPR records of processing activities that previously covered sentiment analysis tools.
Free tool: See the AI regulation deadline tracker → Each compliance date marked as verified, or not, against the enacted text.
Tailored to your industry and the AI tools your team uses. Free preview, then $149/mo to keep it current as the rules and vendor terms change — or $79 for a one-time snapshot.
Generate my policy kit →Writing policies for several clients? MSPs, IT consultancies and fractional CISOs keep a roster of client kits that refresh monthly, under their own branding. See partner plans →