Under Article 50(3), deployers of AI systems for emotion recognition or biometric categorisation must inform the natural persons exposed to the system about the operation of the system, in accordance with Union and national law on data protection and other applicable law. The duty is a deployer duty, distinct from the provider duties in Article 50(1) and (2), and it applies from 2 August 2026, subject to the exception for systems authorised by law for law enforcement purposes that Article 50 provides.
Which systems face Article 50(3)?
Article 50(3) applies to deployers of AI systems intended to identify or infer the emotions or intentions of natural persons on the basis of their biometric data, known as emotion recognition systems, and to deployers of AI systems that categorise natural persons on the basis of their biometric data, known as biometric categorisation systems. The definitions in Article 3 should be checked for the system in question, because the duty turns on the system's intended function, not on a general label. A system that analyses voice, face, or other biometric signals to infer emotion, or that assigns a person to a category on the basis of biometric data, should be assessed under this paragraph, even where it is described as analytics, wellbeing, or safety monitoring. The deployer should record the function, the biometric data used, and the paragraph considered, for each deployment.
Who must be informed, and about what?
The deployer must inform the natural persons exposed to the system about its operation. Exposed persons are those whose biometric data are processed by the system in the deployment context, including workers, visitors, customers, or other people present where the system operates. The information should explain, in clear and accessible terms, that the system is in operation, what it does, what biometric data it uses, and the consequences of exposure, in accordance with the applicable data protection and other legal requirements. The information should be given in a way that reaches the exposed person before or at the time of exposure, in the place and form where exposure occurs, not only in a policy document that the person may never see. A notice that is present only on a website, while exposure occurs in a physical space, does not inform the exposed person in the context where it matters.
For the broader regulatory framework, see Transparency duties for AI.
How does Article 50(3) relate to data protection law?
Article 50(3) requires information to be given in accordance with applicable Union and national law, including data protection law. That means the deployer must also meet the information, lawfulness, and other requirements of the General Data Protection Regulation and any other applicable law for the biometric processing, and must not treat Article 50(3) disclosure as a substitute for a data protection assessment or a lawful basis. Emotion recognition and biometric categorisation involve sensitive processing that raises distinct data protection and fundamental rights questions, and the deployer should record how those questions were assessed, including any data protection impact assessment, and how the Article 50(3) notice fits with the data protection information given. The two information duties should be coordinated, so that the exposed person receives a coherent explanation rather than two disconnected notices.
What exception applies for law enforcement?
Article 50(3) provides an exception for AI systems authorised by law to detect, prevent, investigate or prosecute criminal offences, subject to appropriate safeguards for the rights and freedoms of third parties. The exception should be checked against the consolidated text, including its scope and safeguards, and should not be assumed from a security or law enforcement purpose alone. A deployer relying on the exception should record the legal authorisation, the safeguards in place, and the review date, and should ensure that the exception is applied only to the system and deployment it covers. Where a system is used for both law enforcement and other purposes, the exception should be applied only to the law enforcement use, and the disclosure duty should be met for the other uses.
How should deployers implement the duty in a workplace or public space?
Implementation depends on the deployment context. In a workplace, the deployer should inform workers through the channels that reach them, consult worker representatives where required, and record the information given and the consultation carried out. In a public or customer-facing space, the deployer should use signage and other notices at the point of exposure, in the languages and formats the exposed people need, and should consider accessibility for people who cannot read a sign or who use assistive technology. The deployer should test that the notice is noticed and understood, record the test, and revisit the notice when the system, the space, or the exposed population changes. A notice that is technically present but practically invisible, because of its size, placement, or language, does not inform the exposed person.
Continue with Article 50 interaction disclosure.
What does this guide not decide?
This guide does not decide whether a particular system is an emotion recognition or biometric categorisation system, whether a person has been adequately informed, or whether the law enforcement exception applies. It does not assess a notice, a data protection assessment, or a workplace consultation. Those questions depend on the system's function, the deployment context, the people exposed, and the consolidated legal text together with data protection and other applicable law. A deployer should confirm its position with a competent authority or legal adviser, test its notice with exposed people, and keep the assessment and the notice under review.
Frequently asked questions
Is Article 50(3) a provider or deployer duty?
It is a deployer duty. Deployers of emotion recognition and biometric categorisation systems must inform the natural persons exposed to the system about its operation. Providers have separate duties under Article 50(1) and (2), and both layers can be relevant to one product chain.
Must workers be told about emotion recognition at work?
Yes, in outline. Workers exposed to an emotion recognition or biometric categorisation system must be informed about its operation, in accordance with data protection and other applicable law, through channels that reach them, with consultation where required. The notice should be given before or at exposure, in the workplace context.
Does Article 50(3) replace data protection information?
No. Article 50(3) information must be given in accordance with applicable law, including data protection law. The deployer must meet both sets of information requirements in a coordinated way, and must assess lawfulness, necessity and safeguards for the biometric processing separately.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689 ↗AI Act Service Desk Article 50 ↗European Commission AI Act overview ↗