AI Employee Monitoring: Legal, Ethical and Trust Limits

By Kevin Kim · Updated Oct 11, 2026

AI employee monitoring is software that collects data on how people work (activity, communications, location, video or biometrics) and uses machine learning to score productivity, flag unusual behavior or infer how employees feel. The collecting is old. The scoring and inferring is new, and that's where most of the legal and trust problems sit.

This page is for HR directors, people managers and executives who are asked to approve a monitoring tool, or who find one already running. It covers what the tools do, where the law in the EU and US draws lines, what research shows about the effect on employees, and a proportionality test you can apply before you switch anything on. For the wider picture of how HR uses AI, start with people analytics and AI. This is general information, not legal advice.

Key Facts

• The EU AI Act bans AI systems that infer the emotions of employees in the workplace, except for medical or safety reasons (AI Act, Article 5(1)(f)). The prohibitions have applied since 2 February 2025 (European Commission).
• Breaching an AI Act prohibition can cost up to EUR 35 million or 7% of worldwide annual turnover, whichever is higher for a standard company (AI Act, Article 99).
• On 23 December 2025 France's Conseil d'État cut the CNIL's fine on Amazon France Logistique for warehouse employee monitoring from EUR 32 million to EUR 15 million, while holding that keeping all indicators for 31 days breached data minimization (Conseil d'État, decision 492830).
• In APA's 2024 Work in America survey, 44% of US workers said their employer monitors them with technology, and monitored workers were more likely to feel tense or stressed (51% vs. 38%) and to plan a job search (39% vs. 21%) (American Psychological Association, 2024).
• Connecticut's expanded electronic monitoring notice rules took effect on 1 October 2026, and New York and Delaware have their own notice laws (Day Pitney).

What AI Employee Monitoring Actually Does

Monitoring tools fall into five groups. Each one feeds on a different kind of data, and each one raises a different legal flag.

In ACE terms, these tools Ingest behavioral signals, Analyze them against a baseline, and often Predict an outcome such as a performance rating or resignation risk. The Predict step is where managers tend to over-trust the output. A precise-looking score is still a guess built from proxies.

One distinction matters more than the rest. Watching an action (a badge swipe, a shipped ticket) is different from inferring a state (stress, loyalty, mood). Regulators treat the second as far more intrusive, and in the EU some forms of it are banned outright.

Where the Law Draws the Line

Laws in this area change often and differ by place, so confirm current requirements with counsel for each location where you employ people.

European Union: GDPR

The GDPR doesn't have a "monitoring law" as such. It applies its general principles to employment, and Article 88 lets each Member State add more specific rules for employee data, including safeguards for transparency and for "monitoring systems at the work place" (GDPR Article 88). So a tool acceptable in one country can need a works council agreement in another.

Three points apply broadly:

• Consent rarely works. The Article 29 Working Party's Opinion 2/2017 said consent is highly unlikely to be a valid legal basis for processing at work, because employees can't freely refuse. Employers usually have to rely on legitimate interests, which must be strictly necessary and pass a proportionality test before monitoring starts (WP29 Opinion 2/2017).
• Least intrusive means. The same opinion says processing at work should be carried out in the least intrusive manner possible, and that prevention should carry much more weight than detection.
• A DPIA is usually required. Article 35 requires a data protection impact assessment before processing that is likely to result in a high risk to people's rights and freedoms, and calls for the data protection officer's advice where one is designated (GDPR Article 35). Systematic scoring of employees will often qualify, and your national regulator may publish a list of processing that always needs one.

European Union: the AI Act

The AI Act adds two things on top of the GDPR.

First, a flat ban on workplace emotion inference. Article 5(1)(f) prohibits AI systems that infer the emotions of a person in the workplace and in education, unless the system is intended for medical or safety reasons (AI Act, Article 5). The Commission's guidelines are non-binding, but the Future of Privacy Forum's reading of them is useful for managers: hiring processes count as workplace contexts, so does a home office, physical states such as fatigue are not "emotions," and text-based inference falls outside the ban (Future of Privacy Forum). In practice: a camera tool that rates whether your support agents sound "happy" is a prohibited use. A system that detects a drowsy driver is not.

Second, high-risk status for performance monitoring. Annex III lists AI used to allocate tasks based on individual behavior or personal traits, or to monitor and evaluate the performance and behavior of workers, as high-risk (AI Act, Annex III). The Commission says the high-risk obligations for these Annex III uses now apply from 2 December 2027, after the AI Omnibus (agreed 7 May 2026) entered into force on 27 July 2026 (European Commission). That date is still ahead, so use the time to prepare. One duty to plan for: employers deploying a high-risk system must inform workers' representatives and the affected workers before putting it into use at work (AI Act, Article 26). For the wider rule set, see the EU AI Act.

What the French Amazon case teaches

The best-documented enforcement example is the CNIL's action against Amazon France Logistique over warehouse scanners that produced indicators on speed and inactivity. The fine was EUR 32 million in 2023. On appeal, the Conseil d'État reduced it to EUR 15 million. It found that real-time processing of the stow-speed, idle-time and latency indicators had a legal basis (the idle-time indicator only fires after more than ten consecutive minutes of inactivity), but it upheld the finding that keeping all the indicators undifferentiated for 31 days breached the data minimization principle (Conseil d'État, decision 492830).

Some performance monitoring survived the challenge. Over-retention did not. Decide how long each metric is needed and delete it on that schedule.

United States

There's no single federal monitoring statute for private employers, so the rules come from states and from general labor law.

• New York. Civil Rights Law section 52-c, in effect since 7 May 2022, requires covered private employers to give written notice of electronic monitoring at hiring, get the employee's acknowledgment, and post the notice. The Attorney General enforces it, and there's no private right of action (Outten & Golden).
• Connecticut. The long-standing notice law was expanded as of 1 October 2026: written notice must name the specific locations where monitoring may occur, be posted where it happens, and employees hired from that date need a plain-language statement of activities that may be monitored without prior notice. Monitoring without notice is allowed only in narrow cases, such as reasonable grounds to believe an employee is breaking the law. Civil penalties run up to $500, $1,000 and $3,000 for a first, second and later offense (Day Pitney).
• Delaware. An employer may not monitor an employee's phone calls, email or internet use unless it gives notice, either as a daily electronic notice or a one-time acknowledged notice. The civil penalty is $100 per violation (Delaware Code, Title 19, section 705).
• Federal labor law. The NLRB General Counsel's memo GC 23-02, "Electronic Monitoring and Algorithmic Management of Employees Interfering with the Exercise of Section 7 Rights," was among the memos rescinded on 14 February 2025 by the Acting General Counsel (Littler). So it's no longer agency guidance. But the right of employees to act together hasn't gone away, and a tool that flags union talk or group complaints is a risk you shouldn't take on.

These are notice laws. They don't ban monitoring, they require disclosure. That's the minimum, not the standard to aim for.

What the Research Says About Trust

The best large-scale US data comes from the American Psychological Association's 2024 Work in America survey, which is correlational: the report itself says it can't show that monitoring causes the sentiments it measures. Within that limit, the pattern is hard to ignore (APA, 2024):

• 44% of workers said their employer monitors them with technology, down from 51% in 2023 and 53% in 2022. Prevalence was higher among manual workers (55%) than office workers (44%).
• 35% said they worry their employer uses technology to spy on them during work hours.
• Workers who knew they were monitored were more likely to feel tense or stressed on a typical workday (51% vs. 38%), to feel micromanaged (47% vs. 23%), and to plan to look for a new job within a year (39% vs. 21%).

The same report shows monitoring isn't uniformly resented. Among monitored workers, 69% said it helps protect their safety, and 61% said it helps them stay focused. And the gap by context is large. Among workers with high psychological safety, 36% said monitoring makes them feel their employer doesn't trust them; among workers with low psychological safety, the figure was 65%. For "invasion of my privacy" it was 31% versus 58%.

Two points follow. Monitoring lands on top of whatever trust already exists. Where people feel safe, it reads as a tool; where they don't, it reads as proof. And purpose matters. Safety was the most accepted use in the data, which matches the AI Act's medical and safety exception.

Real Examples by HR Function

For scheduling and workload data, see AI workforce scheduling, and for how scoring feeds reviews and ratings, see AI in performance management.

A Proportionality Test: How to Decide Step by Step

Run this before you buy, and again before any new feature goes live.

1. Name the problem in one sentence. "We need to stop customer data leaving the network" is a purpose. "We want to know what people are doing" isn't.
2. Ask whether a lighter control solves it. Access permissions, data-loss controls and clear targets often do the job without watching anyone. Regulators expect you to have considered this.
3. Pick the narrowest data. Collect the minimum fields, from the minimum group, for the minimum hours. Exclude off-shift time, personal devices and personal accounts by default.
4. Set the retention before launch. The French case turned on retention. Write down how long each metric is needed, and automate deletion.
5. Do the assessment. In the EU, complete the DPIA and consult the DPO. Elsewhere, write the equivalent short risk review. Include a line on bias: monitoring scores can penalize people with disabilities, caring duties or part-time hours.
6. Consult before deployment. Where the law requires it, involve works councils or employee representatives. Where it doesn't, do it anyway: a short conversation with a sample of the affected team will surface problems a vendor demo won't.
7. Give notice that is specific. Tell people what is collected, why, who sees it, how long it's kept and what decisions it can feed. Meet the strictest state or country notice rule that applies to you, then use that wording everywhere.
8. Keep humans in the decision. No discipline, rating or termination should rest on a monitoring score alone. A named manager reviews the evidence and can explain the decision. The human-in-the-loop page covers the design, and human oversight in HR AI applies it to HR.
9. Write it into policy. Add monitoring to your AI use policy and to the employee handbook, with an owner.
10. Review on a schedule. Check each metric twice a year: is anyone using it, did it change a decision, and would you still defend it if it were published?

Common Pitfalls

• Buying the "engagement" or "sentiment" module without a legal check. If it infers emotion from faces or voices of EU-based staff, it can be unlawful however the vendor markets it.
• Treating notice as permission. In the US, notice satisfies several state laws. It doesn't make a disproportionate practice fair, and it doesn't protect you from a discrimination claim.
• Using activity as a stand-in for output. Keystrokes reward looking busy.
• Keeping everything "just in case." Over-retention was the finding that stuck in the Amazon France case.
• Ignoring who feels it most. In the APA data, prevalence was highest among manual workers (55%), and front-line workers were less positive about it than upper management (47% vs. 77% said it improves their workplace experience).
• Letting a score make the call. A ranking that no one can explain isn't evidence.
• Hiding it. Monitoring people don't know about is hard to defend under any of the laws above. If you can't announce it, you probably shouldn't run it. The way personal data is handled around it is covered in employee data privacy and AI.