EU AI Act · Art. 50(3)
Notify people subject to emotion recognition or biometric categorisation
Inform exposed people that the system is operating, and process personal data under applicable EU data-protection law (GDPR, EUDPR, Law Enforcement Directive). Law-enforcement carve-outs may apply.
By the Shieldra Compliance Team · Last updated 2026-07-29
What do you actually have to do?
Inform exposed people that the system is operating, and process personal data under applicable EU data-protection law (GDPR, EUDPR, Law Enforcement Directive). Law-enforcement carve-outs may apply.
Statutory basis: Art. 50(3) — https://artificialintelligenceact.eu/article/50/
When does it apply?
- 2026-08-02 — applies from 2 August 2026
Does ISO 42001 or NIST AI RMF cover this duty?
Requirement-level mappings from Shieldra's crosswalk pack (v2026.07.30). Partial mappings contribute evidence but deliberately do not count as coverage.
| Mapped requirement | Strength | Why (and what’s missing) |
|---|
| ISO/IEC 42001 A.8 | Partial | Informing exposed persons that the system operates fits A.8 information duties; lawful biometric-data processing under GDPR requires separate work. |
| NIST AI RMF MEASURE-2.8 | Partial | Notifying exposed persons that the system operates is transparency work 2.8 examines but does not mandate. |
| NIST AI RMF MEASURE-2.10 | Partial | Privacy-risk examination of emotion and biometric data supports, but does not establish, lawful processing under EU data-protection law. |
Disclaimer
Compliance guidance, not legal advice. Confirm obligations with counsel. Pack verified 2026-07-29.
Frequently asked questions
What does "Notify people subject to emotion recognition or biometric categorisation" require?
Inform exposed people that the system is operating, and process personal data under applicable EU data-protection law (GDPR, EUDPR, Law Enforcement Directive). Law-enforcement carve-outs may apply.
When does this obligation apply?
applies from 2 August 2026
Who does this obligation apply to?
The deployer role under the EU AI Act. Statutory basis: Art. 50(3).
