Proctoring and emotion recognition

Since 2 February 2025, Article 5 has prohibited providers from marketing or putting into service for that purpose, and educational deployers from using, AI that infers emotions in education institutions. Relevant national market-surveillance authorities enforce the prohibition. An older system cannot escape it through the transition rules.¹

The prohibition has medical and safety exceptions, but Commission guidance interprets them narrowly. Therapeutic use should involve a CE-marked medical device. Safety means protecting life and health, not property against theft or fraud, and a permitted use must be necessary, proportionate and limited in duration, people and scale. General monitoring of stress, wellbeing, motivation or learning satisfaction remains prohibited.²

A system does not fall within this prohibition merely because it detects pain, fatigue, expressions, gestures or movement. The distinction is whether it uses such signals to infer an emotion or intention. AI that monitors and detects prohibited behaviour during tests is separately listed as high-risk proctoring, with its main safeguards postponed until 2 December 2027.¹³

Where emotion recognition is lawfully used under an exception, Article 50 has required the educational deployer since 2 August 2026 to inform exposed people that the system is operating and to comply with applicable data-protection law. The relevant national market-surveillance authority enforces the AI Act notice duty, while the national data-protection authority enforces GDPR requirements.⁴

From 2 December 2027, Articles 14 and 16 require the provider of high-risk proctoring AI to design it so outputs can be interpreted, rejected or reversed. Article 26 requires the educational institution deploying it to assign oversight to competent, trained and authorised people with adequate support. The relevant national market-surveillance authority enforces both duties.¹

For action now, Article 85 permits a student, worker or representative to complain about prohibited emotion recognition or a missing Article 50 notice, but identifying the relevant authority and procedure depends on the Member State; those routes were not catalogued and may not yet be straightforward. Article 86 formally requires the institution as deployer, on request, to explain covered AI’s role and main elements in a significantly adverse cheating or assessment decision. The authority enforces it, but the Act sets no request format, deadline or appeal route, and operation before December 2027 remains unresolved.¹

GDPR Article 22 may already restrict a solely automated cheating or assessment decision with legal or similarly significant effects. Since 25 May 2018, the controller has had to observe that restriction and any applicable safeguards, enforced by national data-protection authorities and courts.⁵

Where this stops

No EU-wide AI Act source was located requiring human review of every proctoring flag before a sanction. GDPR may help only when its automation and effects thresholds are met. Examination appeals and alternatives remain matters for national or institutional procedures.¹⁵