Imagine an employer using artificial intelligence to analyse an employee’s facial expressions, eye movements and voice during an investigation. The software generates a credibility score, supposedly identifying whether the employee is concealing information.
Now imagine police using a different AI-assisted system to evaluate physiological responses during a criminal investigation. Both technologies might be marketed as lie detectors, but European law does not necessarily treat them the same way.
Under the European Union’s Artificial Intelligence Act, certain workplace emotion-recognition systems are prohibited, while AI-powered polygraph and similar tools used by law enforcement are identified as high-risk applications. The distinction is set out in different parts of Regulation (EU) 2024/1689 and depends on the technology’s purpose, operating environment and the information it processes.
The central legal distinction is not whether a machine claims to detect deception. It is what the system actually does, whose information it analyses and where the technology is intended to operate.
For polygraph examiners, technology providers and employers, understanding this distinction is essential before adopting automated credibility-assessment systems.
What the EU AI Act Actually Prohibits
The AI Act entered into force on August 1, 2024, introducing a risk-based regulatory framework for artificial intelligence.
Its first restrictions on prohibited AI practices began applying on February 2, 2025.
Among them is a specific rule concerning emotion recognition in workplaces and educational institutions.
Under Article 5(1)(f) of the EU AI Act, placing certain AI systems on the market, putting them into service for the prohibited purpose or using them to infer a person’s emotions in these settings is prohibited, subject to an exception for medical or safety reasons.
The provision does not apply to every technology that records an employee’s face, voice or physiological activity.
Instead, the system’s intended purpose and processing functions are central to determining whether the prohibition applies.
Emotion recognition includes inferences about intentions
Article 3(39) defines an emotion-recognition system as artificial intelligence intended to identify or infer emotions or intentions from biometric data.
That definition has potentially significant implications for automated deception assessment.
A camera that simply records an interview is performing a different function from software that interprets facial movements to produce conclusions about an interviewee’s emotional state.
Similarly, a system that detects physiological measurements without interpreting them as emotions or intentions is not necessarily performing the same function as one that classifies a person’s supposed honesty.
A vendor offering software that claims to infer deceptive intent from facial movements, vocal characteristics or other biometric data therefore needs to examine the system’s legal classification carefully.
Calling the technology behavioural analytics or an interview assistant does not resolve the question.
The relevant evidence lies in what data the software processes and what conclusions it is designed to produce.
Recruitment and Workplace Investigations Are Both Relevant
The workplace restriction is not limited to monitoring existing employees during normal working hours.
European Commission guidance interprets workplace settings broadly, including recruitment and selection processes.
Consider an organisation conducting remote interviews with job applicants.
The employer introduces software that tracks facial expressions and voice characteristics, generating assessments of confidence, anxiety or apparent sincerity.
If the system qualifies as emotion-recognition AI under the Act, the fact that it operates during recruitment rather than after employment does not automatically remove it from the workplace prohibition.
The same concern applies when an organisation proposes automated emotional analysis during disciplinary interviews.
A conventional interview recording may help preserve an accurate record of what was said.
AI software that processes biometric signals to infer an employee’s intentions introduces a different legal issue.
Employee consent does not automatically resolve the prohibition
An employer may believe that obtaining a signed agreement allows it to use otherwise restricted emotion-recognition technology.
That assumption is unsafe.
The AI Act’s Article 5 prohibition does not contain a general exception allowing prohibited workplace emotion recognition merely because an employee agrees to participate.
The medical and safety exception is also not a general permission to conduct credibility screening.
An employer cannot assume that describing an investigation as an exercise in workplace safety makes every form of emotional inference permissible.
The intended purpose and the applicable legal requirements need to be assessed.
Separate data-protection and employment-law obligations may apply even when the particular AI Act prohibition does not.
Why Police Polygraphs Receive a Different Classification
The AI Act’s treatment of law-enforcement technology reveals another side of the regulatory framework.
Instead of categorically prohibiting every AI-based polygraph application, the legislation identifies certain uses as high-risk.
Annex III of the AI Act specifically includes AI systems intended for use by or on behalf of law-enforcement authorities as polygraphs or similar tools.
It also identifies comparable applications used by competent authorities in migration, asylum and border-control management.
This creates an important legal separation between prohibited applications and those subject to high-risk requirements.
| Application | EU AI Act treatment | Important distinction |
|---|---|---|
| AI inferring employee emotions from biometric data | Prohibited in workplace settings, subject to the statutory exception | Employee agreement does not create a general exemption |
| AI used by law enforcement as a polygraph or similar tool | Listed as high-risk | Classification does not independently authorise its use |
| Conventional polygraph without a qualifying AI system | Not automatically covered by the AI Act’s AI-system rules | Other national laws and evidence rules may still apply |
The classification reflects the risks associated with decisions that can affect individual rights.
A system used during a criminal investigation may influence how authorities evaluate a person’s statements or other evidence.
Such uses create concerns about accuracy, accountability, discrimination, transparency and the ability to challenge conclusions.
However, being listed as high-risk does not establish that a particular AI lie detector is scientifically reliable.
Nor does it mean police are automatically permitted to deploy the technology.
Relevant European and national laws continue to determine whether a particular investigative procedure is lawful.
The 2026 Amendment Changed the High-Risk Compliance Timeline
A significant development occurred in July 2026, when the EU amended the AI Act through its AI Omnibus legislation.
The amendment adjusted the implementation schedule for several categories of high-risk artificial intelligence.
As a result, the main high-risk requirements applying to systems classified under Annex III are scheduled to take effect on December 2, 2027.
That is a different deadline from the workplace emotion-recognition prohibition, which began applying in February 2025.
The distinction matters because readers may otherwise mistake the later high-risk implementation date for a postponement of the earlier prohibition.
The rules operate on separate timelines.
For AI polygraph systems within the relevant high-risk categories, the upcoming requirements address matters such as risk management, data quality, documentation, recordkeeping, transparency, human oversight, robustness and accuracy.
These requirements are designed to make qualifying systems more accountable.
They do not guarantee the scientific validity of deception-detection methods.
A system may comply with technical documentation obligations while still requiring careful assessment of whether its conclusions have adequate evidentiary value.
Likewise, postponing the application of certain high-risk obligations does not remove other applicable laws or make an otherwise prohibited activity lawful.
Better Sensors Do Not Automatically Mean Better Lie Detection
The legal distinction is especially relevant because emerging credibility-assessment technologies are often described in terms of their technical sophistication.
Traditional polygraphs record physiological responses, generally including respiration, cardiovascular activity and electrodermal activity.
Examiners interpret those measurements within structured testing procedures.
The instruments do not directly measure dishonesty.
Newer systems may introduce automated scoring, remote sensing or machine-learning analysis.
These technologies can potentially improve the consistency or efficiency of particular measurement tasks.
However, improving measurement precision is not the same as establishing that a particular physiological response proves deception.
An algorithm might identify changes in breathing or skin conductance more consistently than a human observer.
The separate scientific question is whether those changes reliably distinguish deception from anxiety, uncertainty, fear or other influences.
This difference also affects claims about facial-expression and voice-analysis technology.
Detecting a movement or acoustic pattern does not establish that the movement has a unique relationship with lying.
Polygraphianz has previously examined these technical uncertainties in its coverage of AI polygraph tools and workplace integrity.
The additional issue introduced by the EU AI Act is that some forms of automated emotional inference may be legally prohibited in certain environments regardless of a vendor’s claimed accuracy.
A system’s scientific performance and its legal permissibility are separate considerations.
Both require attention before deployment.
What the Rules Mean for Australian and New Zealand Providers
The EU AI Act is European legislation. It does not automatically make an Australian or New Zealand employer subject to European workplace restrictions merely because that employer uses artificial intelligence.
However, its territorial scope is broader than the location of a technology company’s headquarters.
The Act can apply to providers established outside the European Union when they place qualifying AI systems on the EU market or put them into service there.
It can also apply in specified circumstances involving systems whose outputs are used within the European Union.
That makes the legislation relevant to Australian and New Zealand credibility-assessment companies offering services to European organisations.
For example, an Australian software company might develop an automated interview platform that analyses voice and facial characteristics.
If the company proposes selling that system to employers in the European Union, it must consider whether the intended application falls within the workplace emotion-recognition prohibition.
The company’s physical location outside Europe does not, by itself, resolve the issue.
Similarly, a provider supplying AI-assisted assessment tools to European law-enforcement organisations may need to evaluate the relevant high-risk classification and implementation obligations.
A system suitable for research in one jurisdiction should not automatically be marketed as suitable for employment screening or criminal investigation in another.
Different applications can trigger different legal requirements.
Five Checks Before Adopting an AI Credibility System
For organisations evaluating new polygraph or automated lie-detection technology, the first priority should be understanding the actual product rather than relying on marketing terminology.
A useful procurement review should cover five areas.
1. Identify the system’s real purpose.
Does it measure physiological activity, score an existing examination, interpret emotions or attempt to classify honesty?
These activities should not be treated as interchangeable.
2. Determine where the system will operate.
Workplace recruitment, disciplinary investigations, law enforcement and migration screening can have different legal consequences.
The intended operating environment matters.
3. Examine the information being collected.
A provider should explain whether the system processes facial images, vocal characteristics, physiological signals, behavioural patterns or other information.
It should also identify whether these measurements are used to infer emotions or intentions.
4. Request validation evidence for the intended application.
A demonstration showing that software can detect physiological changes is not sufficient evidence that it can reliably identify deception.
Validation needs to address the conclusions the system actually makes.
5. Establish how results will affect decisions.
Organisations should know whether an automated output is advisory, whether a trained professional reviews it and how an affected person can challenge a questionable result.
Privacy and data-retention arrangements also need to be documented.
These checks will not substitute for jurisdiction-specific legal advice, but they can reveal fundamental weaknesses before an organisation commits to a technology.
The Most Important Boundary Is How AI Is Used
The EU AI Act does not treat artificial intelligence and polygraph testing as a single regulatory category.
Certain biometric emotion-recognition applications in workplaces and educational institutions are prohibited, subject to limited statutory exceptions.
AI-powered polygraph and similar systems intended for specified law-enforcement or migration uses appear in the high-risk framework, with the relevant Annex III requirements scheduled to apply from December 2027.
Conventional testing methods that do not qualify as AI systems are not automatically governed by those particular AI Act provisions, although other laws may still regulate their use.
For investigators and technology providers, this creates a more useful question than whether AI lie detection is simply legal or illegal.
What is the system designed to infer, which people will be affected, and what legal authority supports that particular use?
Clear answers are essential.
Artificial intelligence may change how credibility assessments are recorded and analysed. It does not remove the need for scientific validation, fair procedures or a lawful purpose.
The European framework makes one point particularly clear: technological capability alone is not a sufficient justification for using automated systems to judge people.