If you have been told that the EU AI Act gives you a general right to be told about every AI system watching your work, that is not what the regulation says. The AI Act creates a narrower, conditional duty: an employer that deploys a high-risk AI system at the workplace must inform workers’ representatives and the affected workers before putting that system into service or using it. That is the whole of the workplace-specific disclosure rule in Article 26(7). Everything else people attribute to the Act — a right to consent, a veto, a dashboard of every tool — comes from somewhere else, or from nowhere.
This matters because the wrong question produces the wrong request. Asking “what must my employer disclose about AI monitoring?” invites a vague answer. Asking “is this specific tool a high-risk AI system, and if so, was the Article 26(7) notice given before use?” produces a checkable one. The rest of this article is that two-step test, with the primary sources attached.
Step one: is the tool a high-risk AI system?
The Article 26(7) duty does not attach to AI monitoring in general. It attaches to high-risk AI systems. So the first question is classification, not disclosure.
Two definitions do the work. A deployer is “a natural or legal person, public authority, agency or other body using an AI system under its authority except where the AI system is used in the course of a personal non-professional activity” (Article 3(4), as reproduced in the AI Act Explorer entry for Article 26). Your employer, using a monitoring tool in the course of business, is a deployer. You, using a chatbot at home, are not.
High-risk is a defined category, not a vibe. The Act classifies systems as high-risk through Article 6 and Annex III. The category most relevant to workplace monitoring is the Annex III listing covering AI systems used in employment — for selecting, monitoring, or evaluating employees. I want to be precise about the state of the evidence here: the retrieved passages for this article did not include the verbatim Annex III text, and a law-firm summary (Latham & Watkins, “EU AI Act: Obligations for Deployers of High-Risk AI Systems”) asserts that employee monitoring is listed. Before you rely on that classification for a specific tool, read the Annex III text itself on EUR-Lex or the AI Act Explorer. The classification is the hinge of the whole duty, so it deserves a primary read rather than a summary.
What this means practically: an employer who says “the AI Act doesn’t require us to tell you about this tool” may be right — if the tool is not high-risk. The same sentence may be wrong if the tool falls within an Annex III employment category. The statement is incomplete either way, because it skips the classification question. Your job is to make the employer answer that question on the record.
Step two: what does Article 26(7) actually require?
The operative sentence is short. “Before putting into service or using a high-risk AI system at the workplace, deployers who are employers shall inform workers’ representatives and the affected workers that they will be subject to the use of the high-risk AI system” (Article 26(7), AI Act Service Desk).
Read the elements carefully, because each one limits the duty:
- “Before putting into service or using” — the notice must come ahead of use, not after a rollout memo.
- “high-risk AI system” — the classification gate from step one.
- “workers’ representatives and the affected workers” — both audiences, not one or the other.
- “that they will be subject to the use” — the content is notice of subjection to the system, not a full technical explainer.
The next sentence adds a qualifier that matters for anyone in a country with strong works-council traditions: the information “shall be provided, where applicable, in accordance with the rules and procedures laid down in Union and national law and practice on information of workers and their representatives” (Article 26(7)). In practice, that means the AI Act notice does not replace your national information-and-consultation rules; it operates alongside them. If your country requires a works council to be consulted on monitoring technology, that procedure still governs how the notice is delivered.
When does this duty bite?
Not yet, for most Annex III systems. The AI Act Explorer entry for Article 26 states that the deployer obligations for high-risk systems under Annex III come into force on 2 December 2027, and on 2 August 2028 for Annex I systems, per Article 113(c) (AI Act Explorer, Article 26). That is the date to put in your calendar for the Article 26(7) notice. It is not a reason to wait: the classification question can be asked now, and the answer will determine whether the notice is owed later.
What Article 26 requires beyond the notice
The notice is one of several deployer duties, and the others are useful leverage because they are concrete and checkable. All from Article 26:
- Human oversight. Deployers “shall assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support” (Article 26(2)). Ask who that person is for the monitoring tool, and what training they received.
- Log retention. Deployers must keep automatically generated logs “for a period appropriate to the intended purpose of the high-risk AI system, of at least six months, unless provided otherwise in applicable Union or national law” (Article 26(6)). If your employer cannot say where those logs are and how long they are kept, that is a specific gap to raise.
- Monitoring and incident reporting. Deployers must monitor the system’s operation and, where they have reason to consider its use may present a risk, inform the provider and the relevant market surveillance authority and suspend use (Article 26(5)).
These are not disclosure rights in the sense of “show me the file.” They are duties the employer owes, and each one gives you a factual question with a yes-or-no answer.
The duty people confuse with Article 26(7): Article 50(3)
Article 50 contains separate transparency obligations, and one of them is directly relevant to workplace monitoring — but only for a narrow set of tools. “Deployers of an emotion recognition system or a biometric categorisation system shall inform the natural persons exposed thereto of the operation of the system” (Article 50(3), AI Act Service Desk). The Commission’s FAQ clarifies that this applies “regardless of whether the persons are exposed to such systems in real-time or they are operated ex-post” (European Commission, FAQ on Article 50 transparency obligations).
Two things follow. First, Article 50(3) is not a general workplace monitoring rule; it covers emotion recognition and biometric categorisation specifically. A productivity-analytics tool that does neither is not caught by it. Second, Article 50 applies from 2 August 2026 (same Commission FAQ), which is earlier than the Article 26(7) date. So if your workplace uses emotion recognition or biometric categorisation, the notice duty may already be live, independent of whether the tool is high-risk.
This is the distinction most workplace conversations get wrong. Article 26(7) is a high-risk-system notice that arrives with the high-risk regime. Article 50(3) is a modality-specific notice that arrives earlier. They can both apply to the same tool, or only one, or neither.
What the Act does not give you
Be clear about the limits, because overclaiming will get your request dismissed. The AI Act’s Article 26(7) duty is a notice duty. It does not create a right to consent to, object to, or veto high-risk AI monitoring. It does not give workers’ representatives a co-determination right over deployment. It does not require the employer to publish a technical explainer of the system’s logic. Those things may exist under other instruments — national labour law, works-council statutes, the GDPR — but they do not come from Article 26(7), and citing the AI Act for them weakens the parts of your request that are grounded.
The GDPR is the other instrument people reach for, and it is genuinely relevant: Article 26(9) requires deployers to use the information provided under Article 13 to comply with their data protection impact assessment obligation under GDPR Article 35. But the AI Act does not itself restate GDPR Articles 13–15, and this article does not attempt to map them. If your question is about access to your personal data, that is a GDPR question with its own procedure.
A request you can send today
This is a low-risk way to test compliance without asserting an entitlement the Act does not grant. Send it in writing, keep a copy, and address it to whoever owns the tool — your manager, HR, or the works council if you have one.
I am writing to ask about [name of tool], which I understand is used to monitor or evaluate work. I have three questions:
- Has the tool been classified as a high-risk AI system under Article 6 and Annex III of Regulation (EU) 2024/1689? If so, please identify the Annex III category relied on. If not, please state the basis for that conclusion.
- If it is high-risk, has the Article 26(7) notice been given to workers’ representatives and affected workers before use? Please provide the notice in writing.
- If the tool performs emotion recognition or biometric categorisation, has the Article 50(3) notice been given to exposed persons? Please provide it in writing.
I am asking so that I can understand the basis on which the tool is used. I am not asserting a right to consent or veto under the AI Act.
The last sentence is deliberate. It signals that you know the difference between a notice duty and a consent right, which makes it harder to dismiss the request as misinformed. If the answer to question 1 is “not high-risk,” ask for the reasoning in writing. If the answer is “high-risk,” the notice should exist, and the date it was given is checkable against the 2 December 2027 commencement.
What to do with the answer
If the employer confirms high-risk classification and produces a notice, you have what the Act requires. If it confirms high-risk classification and cannot produce a notice, that is a concrete gap to raise with workers’ representatives and, where your national law provides for it, with the labour inspectorate or the market surveillance authority designated under Article 70. If it denies high-risk classification, the useful next step is to read the Annex III text yourself and compare it to the tool’s documented purpose — the instructions for use that the provider must supply under Article 13 are the natural document to request.
The point of this procedure is not to win an argument. It is to convert a vague worry about being monitored into a documented question with a dated answer. That answer is what you need for the next conversation — with your works council, your lawyer, or your employer — and it is the only thing the AI Act actually entitles you to ask for at this stage.
Frequently asked questions
Does the AI Act require my employer to tell me about every AI tool used at work?
No. The workplace-specific duty in Article 26(7) applies only to high-risk AI systems, and it requires notice to workers’ representatives and affected workers before use. Other AI tools may be subject to different obligations, but there is no general workplace AI disclosure rule in the Act.
Is the Article 26(7) notice already in force?
For high-risk systems under Annex III, the deployer obligations come into force on 2 December 2027, per Article 113(c) as stated by the AI Act Explorer. Article 50(3) notices for emotion recognition and biometric categorisation apply from 2 August 2026.
Can I refuse to be monitored under the AI Act?
The AI Act does not create a right to refuse or veto high-risk AI monitoring. Any such right would come from national labour law, a works-council agreement, or another instrument, not from Article 26(7).
What is the difference between Article 26(7) and Article 50(3)?
Article 26(7) is a notice to workers’ representatives and affected workers before a high-risk AI system is used at the workplace. Article 50(3) is a notice to natural persons exposed to an emotion recognition or biometric categorisation system, regardless of whether exposure is real-time or ex-post. They cover different tools and have different commencement dates.
Where can I read the primary text?
The AI Act Service Desk publishes the consolidated text of Article 26 and Article 50. The AI Act Explorer provides the same articles with cross-references and commencement dates. For Annex III, read the text on EUR-Lex directly rather than relying on summaries.