AI Emotion Recognition 2026 – Prohibition Check, GDPR and Information Templates | AI Act Article 50.3 Word/PDF/Excel

Can a company use AI that reads people's emotions or categorises people using biometric data? From 2 August 2026, Article 50.3 of the EU AI Act imposes a specific information obligation on anyone using applicable AI systems for emotion recognition or biometric categorisation. However, certain uses are already prohibited under Article 5. This document package provides an operational workflow that starts with a prohibition check, not with writing a sign.

Quick facts: Five Swedish working documents, a Swedish user guide and an English User Guide, all in editable Word (DOCX) and corresponding searchable PDF without interactive form fields. It also includes a Swedish Excel workbook with nine tabs and 287 formulas. 7 documents in two formats + 1 XLSX = 15 customer files. Available for digital ZIP delivery after separate manual activation.

Why is a special template needed for this in 2026?

Article 50.3 of the AI Act (EU 2024/1689) addresses the user (*deployer*) of emotion recognition or biometric categorisation systems and states that people who are exposed must be informed about the use of the system. Article 50.5 requires the information to be clear, distinct and available at the latest at the first exposure. This is not the same as saying that all such systems may be used.

Article 5.1 f generally prohibits AI-based emotion inference in workplaces and educational institutions, with narrow exceptions for medical or security reasons. Article 5.1 g prohibits certain biometric categorisation to infer specially protected characteristics. Putting up a sign, purchasing a GDPR policy or collecting consent does not remove these AI prohibitions.

What situations may need to be assessed?

Example 1 – alleged measurement of employees' moods: An employer wants to analyse whether staff are "stressed", "happy" or "frustrated" based on facial expressions. The template forces a STOP check under Article 5 before any discussion about signage. Example 2 – AI camera for customer analysis: A supplier markets the system as "anonymous", but the camera processes biological characteristics and generates conclusions related to individuals. The system card collects the technology that is actually used and requires a separate GDPR and AI Act assessment.

Example 3 – public premises: The business wants to provide information to people who are exposed to an otherwise lawful AI function. Document 03 helps formulate truthful information and test that visitors are reached before the first exposure. Example 4 – changed supplier model: After an update, the system begins to infer other characteristics. The test and deviation log documents that previous decisions must be reviewed.

Choose other materials for a general AI policy, a standard camera surveillance register or a full GDPR impact assessment without connection to Article 50.3. The product is not intended for the legal basis for police biometric identification, or medically certified systems.

Exact file contents

Excel with nine tabs and 287 formulas

Excel contains Overview, System, Prohibition, GDPR, Information, Tests, Deviations, Decisions and Read me. There are 40 working rows per relevant register, with their own fields for internal system ID, function, target group, legal review, sources, version of the information, technical test evidence and responsible person. An empty customer register shows 0 registered AI systems and 0 deviations.

Separately tested: If an AI solution infers emotions in the workplace, the register gives STOP – PROHIBITION CHECK. Missing GDPR legal basis gives STOP – GDPR INCOMPLETE, an information sign without actual display evidence gives MISSING INFORMATION EVIDENCE, and an open critical deviation gives STOP – OPEN CRITICAL. Excel does not decide whether a system is lawful; even a complete administrative signal requires external manual review.

Data protection – do not confuse different regulations

According to IMY's guidance on facial recognition and GDPR, processing biometric personal data requires a concrete assessment of legal basis, necessity, purpose, security and the data subject's rights. When data is used for unambiguous identification, the special protection of GDPR under Article 9 may apply; other derived sensitive conclusions also require special analysis. In the case of a likely high risk, a data protection impact assessment under GDPR Article 35 and in some cases prior consultation under Article 36 is normally required. An AI sign never replaces GDPR information, legal basis or other applicable review.

Privacy in the workbook: Only save system ID, test ID, document references and responsibility function. Do not put facial images, voice recordings, biometric templates, personal identity numbers, medical data or actual biometric analysis results in Excel.

How to use the working templates

1. Describe the actual technology and target group, not just the supplier's product name.
2. First check for prohibitions under Article 5, especially workplace, education and inference of protected characteristics. In case of risk of prohibition: STOP and legal investigation.
3. Inventory data processing, data controller responsibility, GDPR legal basis and impact assessment.
4. If the use is assessed as lawful: adapt the information according to Article 50.3/50.5 and check actual exposure.
5. Test, document deviations, decide manually and perform a new review when the system's function or environment changes.

Frequently asked questions

Can employers measure employees' emotions with AI if they consent?

Consent does not remove the prohibitions of the AI Act. Article 5.1 f generally prohibits AI emotion inference in the workplace, with narrow medical/security-related exceptions.

Does a store need a sign if it uses AI-based emotion analysis?

If the use is otherwise lawful and the system is covered by Article 50.3, people who are exposed must be informed. But lawfulness under Article 5 and GDPR must be determined first. A sign is not a permit.

Do the requirements apply to all cameras that recognize a face?

No. Regular camera surveillance, unambiguous identification, emotion inference and biometric categorisation are different functions with different rules. The actual technology must be investigated.

Are all biometric data automatically special categories under GDPR?

No. Biometric data processed to uniquely identify a person are covered by special categories in the relevant part, and other sensitive derived data may also trigger Article 9. Always assess the purpose and processing concretely.

Can Excel issue legal approval?

No. The register marks stop points and documentation gaps. Legal responsibility, technical classification and possible contact with authorities require qualified manual review.

Are the PDF files fillable or are there Swedish templates in English?

The PDFs are searchable and printable without interactive form fields; Word is editable. The five working templates and Excel are in Swedish, while the English User Guide only contains English user instructions.

Official sources and version

EU AI Act – Article 5 (prohibited uses) · EU AI Act – Article 50 (transparency) · IMY – facial recognition and GDPR. Version 1.0 November 8, 2026. AI-assisted legal source review and technical file tests have been performed. No independent external legal, data protection expert or authority review has been performed, and no technical biometric certification has been performed. The documents do not grant permission to process personal data or conduct prohibited AI activities.