Who must inform people about emotion recognition — the vendor or the user of the system?

The deployer: the organisation operating the system must inform exposed natural persons under Article 50(3). The vendor's duties sit elsewhere in the Act.

Does a GDPR privacy notice satisfy Article 50(3)?

No — the regimes run in parallel. The AI Act requires informing exposed persons about the system's operation; GDPR imposes its own legal-basis and transparency requirements for the underlying processing.

Kilde › Guides › AI Act Art 50 › Emotion recognition and biometric cate…

Emotion recognition and biometric categorisation: inform the people exposed

Current to 26 August 2026 · updates land in the changelog.

Article 50(3) is the shortest of the four duties and the easiest to miss: deployers of emotion-recognition or biometric-categorisation systems must inform the natural persons exposed to them. Live since 2 August 2026, no transition.

Who it catches

The duty sits on the deployer — the organisation using the system, not the vendor who built it. Sentiment analysis on support calls, engagement scoring in retail analytics, camera systems inferring demographics or mood: if natural persons are exposed to the system's operation, they are owed the information. Vendors selling such systems face their own provider duties elsewhere in the Act; 50(3) is squarely the customer's obligation, which is why it slips through procurement unnoticed.

GDPR runs alongside, not instead

Article 50(3) states the AI Act duty and the data-protection framework applies in parallel: emotion inference and biometric processing sit among the GDPR's most sensitive categories, with their own legal-basis and transparency demands. Satisfying one regime does not discharge the other — the AI Act notice and the GDPR notice are cousins, not substitutes. (Separately: some emotion-recognition uses — workplace and education contexts — fall under the Act's prohibitions, in force since February 2025. This page covers the transparency duty for uses that remain lawful.)

What compliance looks like

Article 50(5)'s standard applies: clear, distinguishable information at the latest at first exposure, accessibly delivered. In physical spaces that means signage and placement decisions; in call flows, a scripted line; in apps, an unmissable notice at the point of exposure — plus a record of where and when notices run, because the duty is continuous, not one-time.

Related guides

Quick answers

Who must inform people about emotion recognition — the vendor or the user of the system?: The deployer: the organisation operating the system must inform exposed natural persons under Article 50(3). The vendor's duties sit elsewhere in the Act.
Does a GDPR privacy notice satisfy Article 50(3)?: No — the regimes run in parallel. The AI Act requires informing exposed persons about the system's operation; GDPR imposes its own legal-basis and transparency requirements for the underlying processing.

Ship the disclosures before enforcement finds the gap.

The AI Act Article 50 Kit: the disclosure copy library (English + 中文), the marking implementation guide with survival-test protocol, deepfake and text-labeling walkthroughs, obviousness and scope memos, the evidence log, the Code of Practice accession path — built from the regulation and the final guidelines, with pinpoint citations.

Get the kit — US$190 Free 4-page sample (PDF)

Instant download · 14-day unconditional refund · single-organisation licence · full product page

General information only — not legal advice, and no clearance opinions. Sources are Regulation (EU) 2024/1689 (Articles 50 and 99), Regulation (EU) 2026/1744, the Commission's final Article 50 guidelines of 20 July 2026 (non-binding) and our audited kit research. Marking-technology status changes fast: treat vendor announcements as live only once verified. © 2026 Kilde.

Built by Kilde's founder, a practising attorney admitted to a US state bar (not an EU or Hong Kong admission). About · Verification log · Refunds · Terms · Privacy · esau@trykilde.com