Risk · R-161 · Human Factors & Workforce
Intrusive AI monitoring of workers
AI is used to monitor staff activity, communications or behaviour in ways that are disproportionate, opaque or beyond what the stated purpose needs.
- Severity
- High
- Audience
- Board · Heads-of · Practitioner
- Frameworks
- Annex III · Article 5(f) · Article 5 · Article 35
- Responsible AI domain
- Lifecycle stage
- Reviewed
- 2026-11-11
What it is
Employers have always monitored work to some degree. AI changes the scale and depth: it can read every message, transcribe every call, score tone and sentiment, track keystrokes and screen activity, and combine these into a judgement about each person. Tools bought for security or quality can do all of this by default. The monitoring becomes a risk when it is more than the purpose requires, when staff are not told, when it reaches into private matters, or when its outputs are used to manage people. Inferring emotion at work is prohibited outright in the EU, as covered in workplace and education emotion recognition.
How it happens
- A security or productivity tool is deployed with all its analytics switched on.
- Monitoring introduced for one purpose is reused for performance management.
- Staff are told in general terms, or not at all.
- No assessment was made of necessity and proportionality.
- Meeting and call transcription captures private conversation.
Why it matters
Monitoring of workers is processing of their personal data and must be lawful, fair, transparent and proportionate; the ICO has published specific guidance. Excessive monitoring harms wellbeing and may breach rights to privacy. Staff who feel watched disclose less, including the problems an organisation most needs to hear about.
Warning signs
- No data protection impact assessment covers the monitoring.
- Staff do not know what is collected or how it is used.
- Monitoring data is used in disciplinary or performance decisions it was not introduced for.
- Sentiment or behavioural scores are produced for individuals.
Who owns it
The executive responsible for people is accountable for how staff are monitored. The owner of each tool is accountable for its configuration. The data protection officer advises. Staff and their representatives are informed and heard.
In practice
A contact centre introduces a quality tool that scores every call for empathy and flags staff whose scores fall. The scores turn out to be lower for staff with certain accents, and they are being used in pay reviews. The same pattern generalises to any monitoring tool adopted for what it can measure before anyone asked what should be measured.
Mitigating controls
Primary controls
- Data protection impact assessment for AI Directive
- Tests necessity and proportionality of monitoring before it starts. A data protection impact assessment is completed before AI processing that is likely to result in high risk to individuals begins, and is kept current as the system changes.
- Workforce impact assessment and involvement Directive
- Involves staff in decisions on monitoring that affects them. Before AI is deployed in ways that change work, its effect on roles, skills, working conditions and monitoring of staff is assessed, with the people affected and their representatives informed and heard.
Supporting controls
- AI acceptable use policy Directive
- Defines permitted monitoring. A policy approved by top management states what AI use is permitted, what is prohibited, what every system must pass through, who is accountable, and where to take a case the policy does not settle.
- Speak-up route for AI concerns Detective
- Gives staff a route to raise concerns. Staff can raise concerns about how AI is being built or used, in confidence and without fear of reprisal, and each concern is assessed, investigated where warranted and answered.
Framework and clause references
| Framework | Clause | Title |
|---|---|---|
| EU AI Act | Annex III | High-risk AI systems Employment uses are high-risk. |
| EU AI Act | Article 5(f) | Emotion recognition in workplace and education Emotion inference at work is prohibited. |
| UK General Data Protection Regulation | Article 5 | Principles relating to processing of personal data Proportionality and transparency. |
| UK General Data Protection Regulation | Article 35 | Data protection impact assessment Monitoring of workers usually needs a DPIA. |
Sources
- EU AI Act: Regulation (EU) 2024/1689 European Union (EUR-Lex) · official text
How to cite
Axiom Verity (2026). Intrusive AI monitoring of workers. Reference Library, R-161. https://axiom-verity.com/risks/intrusive-ai-monitoring-of-workers. Reviewed 2026-11-11.
Found an error or a better source? Report a correction.