The Empathy Ban

Reading your customer's mood just became a €35M risk

Jul 29, 2026

Five Days Left

In five days’ time, if you’re using tools to read your customer’s mood, it’s a €35 million risk in Europe if you’re still doing it the way most brands still do.

August 2nd is the EU AI Act’s high-risk enforcement deadline (the actual Act is Article 5(1))(f)).

It’s already banned what many brands rely on: the inferring of emotional states from biometric data like facial expression, voice stress, or physiological signals in workplace and educational contexts.

Fines are €35 million or 7% of global turnover, whichever is higher. France’s CNIL has named it a 2026 enforcement priority, and for them, recruitment is especially in their sights.

I wrote about this deadline last year, in October, in AI’s Trust Paradox. Then, I was looking nine months out; at the time, there

But this week it changes to a fact.

It’s a good thing, because it gives me a check-in on a framework I’ve already built, tested against what’s actually happened since, and — at least I think so — confirmed by events I didn’t fully reckon on when I first wrote it.

The line Europe drew, and where it actually falls.

The ban is actually narrower than the headlines suggest, and that matters.

It’s about emotion inference from biometric data, specifically in workplace and educational contexts. It doesn’t cover a support agent reading typed sentiment, or a marketing team building an audience persona from purchase history.

But on the upside, the Commission’s own guidance interprets “workplace” broadly enough to cover any physical or virtual space where work happens, and regulators in Hungary have already used parallel GDPR reasoning to order a bank to stop analysing employee emotion through voice (in that case, the Budapest Bank). One important detail: the bank had consent, but the regulator ruled it didn’t matter.

That one ruling is the clearest real-world confirmation I’ve seen of something I argued back in February, in Part 3 of my Axis of Agency series — the piece where I proposed Consent Rails.

My argument then was that “Notice and Consent” — see a pop-up, click “I agree,” transaction complete — stopped being an adequate safety model the moment systems started making thousands of small emotional inferences a person never consciously agreed to.

Budapest Bank is that example playing out in actual enforcement action. Consent wasn’t a defence. The protection has to be built into the system itself, not bolted on as a checkbox. Exactly what a Consent Rail should be.

America is running in the opposite direction.

Although It may yet change over the next few months, right now, the U.S. posture leans light-touch, and in some cases toward outright preemption of state AI rules. MetLife, Burger King, and various Slack-integrated tools are scaling emotion-adjacent AI with no federal equivalent to the new EU law anywhere in sight.

That’s a strategic problem for any brand operating in both places.

You can’t build one emotional-AI governance policy and ship it everywhere, because the compliance bar in Germany and the compliance bar in the US are different. It’s the fragmentation problem I flagged in October, and why I positioned the Empathy Spectrum as “EU-compliant plus beyond” rather than as an EU compliance checklist.

Build once, deploy everywhere, rather than maintaining a separate risk posture per geographic market. It’s all good for consumer loyalty.

The framework, revisited.

I’m not introducing a new model here but re-testing the one I already have against several more months of regulatory reality.

I recommend my Empathy Spectrum sorts every emotion-aware feature into four tiers:

Supportive — allowed by default, because it primarily reduces harm.

Things like: detecting frustration to offer a human handoff. Accessibility features for neurodivergent users. Crisis-intervention triggers when language suggests self-harm risk.

This tier is where my “design like a physiotherapist, not a puppeteer” metaphor I used in Part 4 of the Axis of Agency series plays. A physiotherapist applies resistance because resistance builds capacity. Supportive features exist to help someone through friction, not to erase it.

Assistive — allowed, but with disclosure. Things like: slowing cadence when a user seems stressed. Adjusting information density based on comprehension signals. The user should know it’s happening, in plain language, not buried three screens deep in a settings menu.

Persuasive — restricted and auditable. Things like: timing an offer to a detected engagement peak. Adjusting checkout flow when seeing hesitation patterns.

This is where many brands operate, but without them realising they’ve crossed a line, because the tactic reads as “good UX” right up until someone asks whether it was optimised against the customer’s interest, or for it.

Manipulative — prohibited entirely.

This tier can’t be a grey area, and it’s the one the EU act exists to shut down, and it’s the same territory I mapped from a different angle in the piece on manipulative UI patterns.

Dark-pattern design isn’t a separate problem from empathy governance. It’s what happens when the Empathy Spectrum has no enforcement teeth.

Where the framework and the regulation converge — and where they don’t.

What I wrote in October still holds: thinking clearly about where emotion-aware AI creates value versus creates harm brings us to the same boundaries, whether we start from ethics or from statute.

But five months of enforcement groundwork has sharpened one thing I didn’t expect: the workplace-context interpretation is expanding much faster than I expected.

It seems “Workplace” in practice now plausibly covers AI meeting tools with sentiment scoring, engagement-tracking software, and — per the CNIL’s stated 2026 priority — recruitment AI specifically. If your Persuasive-tier tools touch anything that may be adjacent to hiring, performance review, or internal meetings, your compliance clock has just run out.

How this connects to my Entangled Self stack.

But this is more than just a compliance piece.

“Neurotechnology is progressing quickly and deserves attention from anyone shaping future experiences.”

Prof. Pim Haselager, Radboud University Nijmegen

My The Age of Entanglement thesis — the one running under everything I write — argues that we’re no longer individuals pressing buttons on tools.

We’re part of a compound system: a biological self, a digital twin, and an agent layer, co-authoring decisions together, without a clean line between where the human ends and the system begins.

Emotion-aware AI is the sharpest edge of that entanglement, because it doesn’t just act on your behalf — it claims to know your internal state well enough to act on your feelings. And that’s a different order of intimacy than a recommendation engine guessing your next purchase.

The EU is, in effect, using its regulators to draw a boundary around where the Entangled Self Stack is allowed to reach. Not “can a system act for me” — hell, we crossed that line years ago — but “can a system claim to feel what I feel, and use that claim against me.”

The Empathy Spectrum was my try to suggest a boundary before the law did. Watching the two converge this precisely, five months later, isn’t about validating me. It’s better than that - a signal that the entanglement itself and not any single feature or vendor is the right unit of analysis for where governance needs to focus next.

What I’d tell a brand leader this week.

Don’t just share this with your legal people. Legal alone misses the point.

Brands that get burnt here won’t be the ones that technically broke Article 5(1)(f). They’ll be the ones who complied on paper while still making customers feel read, catalogued, and quietly priced against their own vulnerability: the exact “satisfaction without attachment” dynamic I described in the Trust Paradox piece, where customers report being fine in a survey and vanish anyway.

Five days out, the practical move for everyone managing this is small and immediate: pull every feature in your Persuasive tier, and ask whether you can produce, in one sentence, a plain-language explanation a customer would actually accept. If you can’t, you already have your answer about if it belongs there.

UNCX | The Age of Entanglement

Discussion about this post

Ready for more?