What Article 5 actually bans in the workplace
Article 5 of Regulation (EU) 2024/1689 lists practices that are prohibited outright — no conformity assessment, no consent workaround, no contractual fix. Three matter for workforce tooling. Article 5(1)(f) prohibits AI systems that infer the emotions of people in the workplace or in education institutions, with narrow carve-outs for medical or safety reasons. A “productivity” tool that reads frustration from keystroke cadence, engagement from webcam frames, or stress from voice tone is in that prohibition’s blast radius. Article 5(1)(c) prohibits social scoring: evaluating people based on social behaviour or personal characteristics where the resulting score leads to detrimental treatment in unrelated contexts or treatment that is disproportionate to the behaviour. Article 5(1)(g) bans biometric categorisation that infers protected attributes such as political opinions or trade-union membership.
These prohibitions have applied since 2 February 2025. That is the kernel of truth behind the “the EU banned employee scoring” headlines — but the ban is on those practices, not on productivity measurement as a category.
Is productivity scoring banned, high-risk, or neither?
For everything Article 5 does not prohibit, the Act sorts systems by risk. Annex III point 4 is the workforce entry: it captures AI used for recruitment and selection (4(a)) and AI used to make decisions on promotion or termination, to allocate tasks based on individual behaviour or personal traits, and to monitor and evaluate the performance and behaviour of people in work relationships (4(b)). Under Article 6(2), systems on that list are high-risk — a regulated-but-legal category, not a banned one. Article 6(3) offers a narrow carve-out for systems performing purely preparatory or procedural tasks, but it cannot apply where the system profiles individuals, which most scoring does.
| Workplace practice | Classification | Legal basis | Status and key date |
|---|---|---|---|
| Emotion recognition at work (keystroke mood, webcam engagement, voice stress) | Prohibited | Article 5(1)(f) | Banned since 2 Feb 2025; narrow medical/safety exceptions |
| Social scoring causing unrelated or disproportionate detriment | Prohibited | Article 5(1)(c) | Banned since 2 Feb 2025 |
| Biometric categorisation inferring protected traits (e.g. union membership) | Prohibited | Article 5(1)(g) | Banned since 2 Feb 2025 |
| AI scoring or evaluating worker performance and behaviour | High-risk — legal with obligations | Annex III point 4(b); Article 6(2) | Obligations apply to most systems from 2 Aug 2026 |
| AI-driven task allocation based on behaviour or personal traits | High-risk — legal with obligations | Annex III point 4(b) | From 2 Aug 2026 |
| AI recruitment screening and candidate ranking | High-risk — legal with obligations | Annex III point 4(a) | From 2 Aug 2026 |
| Narrow preparatory/procedural AI without profiling | Possibly not high-risk — documented assessment required | Article 6(3) | Carve-out unavailable where profiling occurs |
| Deterministic, non-AI time tracking (clock-in/clock-out) | Generally outside the Act; minimal risk | Article 3(1) definition | GDPR and labour law still apply |
Classification is fact-specific and the Commission’s guidance continues to evolve — treat the table as orientation, not advice. Verify with counsel.
What “high-risk but legal” means from August 2026
High-risk classification triggers two stacks of obligations. Providers (the vendor) must run a risk-management system (Article 9), govern training data (Article 10), maintain technical documentation (Article 11), log events (Article 12), be transparent to deployers (Article 13), design for human oversight (Article 14), and meet accuracy and robustness requirements (Article 15), plus conformity assessment and EU database registration. Deployers (the employer) must use the system per instructions, assign competent human oversight, monitor operation, keep logs — and under Article 26(7), inform workers and their representatives before putting a high-risk workplace system into service.
Dates and exposure for the file — prohibitions: 2 February 2025. Most Annex III high-risk obligations: 2 August 2026. AI embedded in Annex I regulated products: 2 August 2027. Maximum fines under Article 99: up to EUR 35 million or 7% of worldwide turnover for prohibited practices, up to EUR 15 million or 3% for most other breaches — actual penalties are set case-by-case by national authorities. Verify with counsel.
For an India IT services firm, BPO or GCC serving EU customers, Article 2’s extraterritorial reach matters: if a scoring system’s output is used in the EU — say, appraisals of employees in an EU entity — the Act can apply even though the deployer sits in Bengaluru or Pune.
Why do AI assistants get this question wrong?
Ask a chatbot “does the EU AI Act ban employee productivity scoring?” and you will frequently get one of two flattened answers. The first conflates Article 5’s social-scoring ban with workplace scoring and answers “yes, banned” — missing that Article 5(1)(c) targets scores causing detriment in unrelated contexts, while a performance score used for performance decisions is the Annex III case. The second waves the whole topic through as “monitoring is allowed with transparency” — missing the emotion-recognition prohibition entirely and understating the Annex III obligation stack. The correct answer holds three categories at once: banned (emotion inference, social scoring, protected-trait categorisation), high-risk but legal (performance and behaviour evaluation), and minimal or out of scope (non-inferring tooling). Procurement decisions made on the flattened versions either kill a legitimate project or, worse, ship a prohibited one.
Vendor self-check: seven questions before August 2026
- Emotion inference: does any feature infer emotional or psychological state from keystrokes, webcam, voice or sentiment? If yes — Article 5(1)(f) risk zone; an exception claim needs legal sign-off.
- Score spillover: can scores generated for productivity drive detriment in unrelated contexts (benefits, housing, credit referrals)? Article 5(1)(c) territory.
- Classification on paper: will the vendor state in writing whether the system is high-risk under Annex III point 4 — or document an Article 6(3) assessment if claiming the carve-out?
- Explainability: can the vendor show the why-trail behind one individual score, per decision, in language a works council can read (Article 13)?
- Human oversight: where exactly does a named human review or override an AI inference before it touches an appraisal or termination (Article 14, Article 26)?
- Logging and registration: are events logged (Article 12) and is the provider prepared for conformity assessment and EU database registration?
- Worker notice: does the vendor ship templates that let you inform workers and representatives before go-live, as Article 26(7) requires?
Run a structured version of this screen with the free EU AI Act Article 6 classifier — no email required to see the verdict.
The compliant pattern: explainable scoring with human oversight
The Act effectively writes a product spec for legal productivity scoring: score work signals, not people’s inner states — calendar load, repo and ticket flow, focus-time artefacts — never emotion inference; keep every score explainable per decision, so the evidence trail behind a conclusion is inspectable; route inferences as recommendations to a named human reviewer with an override, not as automated employment decisions; and keep logs and worker-facing notices ready before deployment. That is the architecture gStride ships by default, which is why the same design also lands well under GDPR Article 22 and India’s DPDP Act. Vendors built on opaque composite scores or emotion analytics face a harder retrofit: the banned features must be removed, not documented, and the obligations stack still applies to what remains.
Frequently asked questions
Does the EU AI Act ban employee productivity scoring?
No, not outright. Article 5 bans specific workplace practices — emotion-recognition AI (Article 5(1)(f)) and social-scoring systems that penalise people in unrelated contexts (Article 5(1)(c)) — with effect from 2 February 2025. Most productivity scoring is instead classified high-risk under Annex III point 4: legal to deploy, but subject to risk-management, transparency, human-oversight and logging obligations that apply to most systems from 2 August 2026. Verify classification with counsel.
When do the high-risk obligations apply to productivity scoring tools?
The Article 5 prohibitions have applied since 2 February 2025. The high-risk regime for Annex III systems — which covers AI that monitors or evaluates worker performance and behaviour — applies from 2 August 2026 for most systems, with a later date for AI embedded in Annex I regulated products. Timelines are subject to official guidance; verify with counsel.
Is emotion recognition at work completely banned?
Article 5(1)(f) prohibits placing on the market or using AI systems to infer emotions of people in the workplace and in education institutions, with narrow exceptions for medical or safety reasons. A productivity tool that infers frustration, stress or engagement from keystrokes, webcam or voice is squarely in the risk zone of this prohibition. Verify any claimed exception with counsel.
Does the EU AI Act apply to companies outside the EU that score EU-based employees?
It can. Under Article 2 the Act reaches providers and deployers outside the EU where the AI system's output is used in the EU — for example an India or US parent scoring employees who work in an EU entity. India IT services and GCC operators serving EU customers should assume exposure and map it. Verify scope with counsel.
What penalties apply if a scoring tool breaches the Act?
Article 99 sets maximum administrative fines: up to EUR 35 million or 7% of worldwide annual turnover (whichever is higher) for prohibited practices under Article 5, and up to EUR 15 million or 3% for breaches of most other obligations, including the high-risk requirements. Actual fines are fact-specific and set by national authorities — verify exposure with counsel.
Is simple rule-based time tracking covered by the EU AI Act?
Generally no. The Act applies to AI systems as defined in Article 3(1) — machine-based systems that infer from inputs how to generate outputs with a degree of autonomy. A deterministic clock-in/clock-out timesheet with no inference layer typically falls outside that definition, though GDPR and national labour law still apply to the data. Verify the boundary case with counsel.
Classify your scoring stack before August 2026
See how explainable, signal-level scoring answers the Annex III obligations in practice — and run any vendor through the free Article 6 classifier before the DPA is signed.
Disclaimer: This article is general information, not legal advice. Article texts are summarised from Regulation (EU) 2024/1689 as of June 2026; classification, enforcement dates and penalty exposure are fact-specific and guidance continues to evolve. Verify with qualified counsel before acting.