START HERE: You May Not Be Allowed to Run Your AI System At all

Most compliance content on this topic tells you how to disclose. That’s the second question.

The first question is whether your use of emotional recognition and biometric categorisation is prohibited outright. Two of the EU AI Act’s banned practices sit directly on top of this technology:

Inferring emotions in a workplace or an education setting is prohibited — with a narrow exception for medical or safety reasons. Not “disclosable.” Prohibited. This includes engagement analytics, candidate assessment, attention monitoring in classrooms, wellbeing dashboards built on facial or voice analysis: all squarely in the prohibited frame, and the exception is narrower than most people assume.

Biometric categorisation that infers race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation is prohibited. The wording is “deduce or infer”, so it catches systems whose categories let you derive one of those characteristics, not only systems that output it as a label.

The penalties are not on the same scale as the rest of the AI Act. Breaching a prohibition exposes you to fines of up to €35 million or 7% of worldwide annual turnover. The transparency duties top out at 3%.

Which means a carefully drafted disclosure for a practice you were never permitted to run doesn’t protect you. Worse, it documents the infringement.

DOES THIS APPLY TO YOU?

1. Does your AI system infer emotions, or assign people to categories, from biometric data?
Faces, voices, physiological signals. Systems that infer state from typing speed or message text alone generally fall outside, but the line matters, and it isn’t always where people assume.

2. Do you operate it, rather than merely supply it?
Article 50(3) binds the deployer — the organisation running the system in context. That’s different from Articles 50(1) and 50(2), which bind providers. If you bought the system and switched it on or integrated in your product, the duty is yours. So are obligations.

3. Are people in the EU exposed to it?
Customers in a monitored space, callers, candidates, students, staff, passers-by.

If yes to all three: complete the prohibition screen before anything else. Here’s the free assessment (no email needed).

What the EU AI Act Article 50 (3) Actually Requires

If the your AI system survives the prohibition screen, Article 50(3) requires you to inform the people exposed to the system of its operation and to process their personal data lawfully. Both halves carry weight.

“Of the operation of the system” is broader than the chatbot duty in Article 50(1). A sign saying “AI in use” doesn’t meet it. People need to understand that such a system is running, what it does in substance, when and where they’re exposed, and how to find out more.

And the second half makes data protection compliance a component of the AI Act obligation. If the processing is unlawful, you haven’t complied with Article 50(3) — whatever notices you’ve posted.

That’s where the hard questions live: whether emotional inference amounts to health data under Article 9 GDPR, and whether consent can ever be freely given by someone who can’t avoid walking through the door.

The practical difficulty is reaching people at all. Someone exposed by entering a room has no interface moment, no login, no click. The information has to find them before exposure, in a form they can absorb in seconds.

What You Get in EU AI Act Art. 50 (3) Evidence Pack:

Prohibition Screen & Applicability Assessment — The entry document, and the most important one. Screens the intended use against both Article 5 prohibitions before any disclosure question arises, then determines whether Article 50(3) applies. A prohibited use ends the exercise — and the document records that decision, which is itself the thing you want on file.

The Record — The core document. Maps every group exposed to the system, the point at which each is exposed, and how the information reaches them at or before that moment. Covers the law-enforcement exception and its three cumulative conditions. Cannot be started without a completed prohibition screen.

Information to Exposed Persons — The notice itself: drafting principles, model wording for physical signage, voice channels and scheduled interactions, plus the evidence template proving it was actually delivered to each group. Handles the layering between AI Act content and GDPR content so neither disappears when the other is revised.

Data Protection Interface — The Article 9 analysis, lawful basis, necessity and proportionality, DPIA trigger, and data subject rights where you can’t identify the person making the request. Structured to make you confront the questions most deployments avoid.

Every document follows the structure of the Commission’s own explanatory notices and templates. 35 pages. Word format, editable, plus a read-only PDF.

50+ pages. Word format, editable, plus a read-only PDF.

Start With the Free Document

Work through it. If this assessment tells you the use is prohibited, you’ve learned that before deploying rather than after. Now you have a document recording the determination and the decision you took. If it tells you the use is permitted, you’ll know which contexts are in scope, and the rest of the pack follows.

Of the three free documents on this site, this is the one most likely to change what you do.

Download the free Applicability Assessment

Who Wrote This

Drafted by a qualified lawyer working in EU AI regulation, not assembled from a template library.

Commissioning the equivalent from a law firm is 15 to 40 hours of specialist time. At prevailing rates that is €6,000 to €18,000.

What the Price Covers

€749 — the full pack, including twelve months of updates.

Article 50 moved twice in eighteen months: the marking deadline shifted under the Digital Omnibus, and the current Code of Practice on Transparency of AI-Generated Content only arrived in June 2026. When the position changes (and it will change), you get the revised documents.

After twelve months, updates continue for €300 a year (billed separately), or keep the version you have.

Part of the EU AI Act Article 50 Compliance Suite

Article 50 contains several distinct duties, falling on different parties. Many organisations hold more than one.

If your system interacts with people — a chatbot, voice assistant or agent — Article 50(1) applies to you as its provider. Get AI Chatbot & Agent Disclosure Evidence Pack.

If your system generates content — images, audio, video or text — Article 50(2) requires you to mark it as AI-generated. Get Synthetic Content Marking Evidence Pack.

If You Need More Than Documents

Pack with review — €4,500. You complete the Record, we review it and write up what is weak, what is missing, and what would not survive an enquiry.

Product assessment — from €9,000. We do the assessment and deliver the completed pack.

Authorised representative. For providers established outside the EU. On enquiry.

What This Pack Is Not (Important)

It is documentation, not advice on your particular circumstances. Given what’s at stake in this area, that distinction matters more here than on our other packs.

It does not decide the hard questions for you. Whether your system infers emotions or detects physical states, whether your categories deduce a protected characteristic, whether your consent is freely given — these turn on your specific facts. The pack structures those questions and records your reasoning. It does not supply the answer.

It is not a substitute for data protection advice. The Data Protection Interface is built to be completed with a DPO or specialist counsel, and it asks you to record it as a limitation if you complete it without one.

It does not make you compliant. If your use is prohibited, the screen will show that — and the right response is to stop, not to file the paperwork.