Employee Monitoring Law Planner
Sources

EU AI Act

Law. Placed at EU locations. Read 30 Sep 2026; 2 provisions cited by the planner.

What does EU AI Act require?

Deployers shall use high-risk AI systems in accordance with the IFU; assign human oversight to appropriately competent natural persons; ensure input data is relevant and sufficiently representative; monitor operation and inform the provider of risks/incidents; retain automatically generated logs for at least 6 months (longer where required); inform workers/representatives where used in the workplace; carry out a DPIA where required under GDPR; and where a deployer is a public authority, register the system in the EU database. Also cited: Art. 5, the practices listed in Article 5.

EU AI Act Art. 26Obligations of deployers of high-risk AI systems

Deployers shall use high-risk AI systems in accordance with the IFU; assign human oversight to appropriately competent natural persons; ensure input data is relevant and sufficiently representative; monitor operation and inform the provider of risks/incidents; retain automatically generated logs for at least 6 months (longer where required); inform workers/representatives where used in the workplace; carry out a DPIA where required under GDPR; and where a deployer is a public authority, register the system in the EU database.

What a reviewer asks to see: Deployer monitoring records; Logs retained at least 6 months; DPIA where applicable; Workforce information for workplace deployment
Where monitoring plans usually fall short: Deployer not following IFU; No human-oversight assignment; Logs deleted before 6 months
Source: EU AI Act, read 30 Sep 2026
EU AI Act Art. 5The practices listed in Article 5

Prohibited AI practices. Prohibits a defined set of AI practices, including subliminal/manipulative techniques causing significant harm, exploitation of vulnerabilities, social scoring by public authorities, predictive policing based solely on profiling, untargeted scraping of facial images, emotion recognition in workplace/education (except where the AI system is intended for medical or safety reasons, Art. 5(1)(f)), biometric categorisation inferring sensitive attributes, and real-time remote biometric identification (RBI) in publicly accessible spaces by law enforcement (subject to narrow exceptions).

What a reviewer asks to see: A screening record per AI system or use case stating which of the eight Article 5 practices it was checked against and the conclusion reached, dated before deployment; For a system that evaluates, scores or targets people, a documented analysis of whether the technique is subliminal, manipulative or exploits a vulnerability tied to age, disability or economic situation, and whether significant harm is a reasonably likely outcome; For a scoring or evaluation system, evidence that only data relevant to the context in which the score is applied is used, and that any unfavourable treatment that follows is proportionate to the conduct scored; For a system inferring emotion or a sensitive trait such as race, political view, union membership, religious belief or sexual orientation from biometric data, the legal basis or the narrow medical, safety or law-enforcement exception relied on, recorded before use; For a system doing real-time remote biometric identification in a public space for law enforcement, the prior judicial or independent authorisation, the named serious-crime or imminent-threat ground, and the fundamental rights assessment behind it; A record of which other Union or national law (data protection, consumer protection, non-discrimination, sector-specific rules) was checked for a borderline use, and the conclusion reached
Where monitoring plans usually fall short: No screening against the eight Article 5 practices before go-live, so a prohibited use is never actually tested against the list; A scoring or evaluation system assumed lawful because it serves a legitimate purpose, without checking that only contextually relevant data feeds it and that any detriment is proportionate; Emotion inference or biometric categorisation run in a workplace or school without first checking the narrow medical or safety exception that is the only lawful route; Real-time remote biometric identification run on an internal risk judgement alone, missing the prior authorisation and impact assessment the exception requires; The Article 5 check treated as a one-time design decision, when a change in purpose, data source or deployment context can bring a previously clear system back under the prohibition
Source: EU AI Act, read 30 Sep 2026

Open the full text on compliance.theartofservice.com

See the specimen plan run Plan your own list