The EU AI Act, Regulation (EU) 2024/1689, regulates AI systems according to the risk of their use rather than the technology inside them. Plain speech-to-text is not listed as high-risk, so a transcription service on its own carries few obligations. The picture changes when speech is used to identify people, infer their emotions, talk to them as a voice agent, generate synthetic voices, or feed decisions in areas such as hiring, credit or justice.
Key takeaways
- The Act entered into force on 1 August 2024 and applies in stages: prohibitions from 2 February 2025, general-purpose AI rules from 2 August 2025, transparency duties from 2 August 2026, and, after the 2026 Digital Omnibus amendment, high-risk obligations from 2 December 2027 (Annex III) and 2 August 2028 (Annex I).
- Emotion recognition from voice is banned in workplaces and education, except for medical or safety reasons, and is high-risk elsewhere.
- Voice agents must tell people they are talking to an AI unless it is obvious, and synthetic audio must be marked as machine-generated.
- Speaker identification is biometric and falls under Annex III. Speaker verification whose sole purpose is to confirm a claimed identity is excluded from remote biometric identification.
- Whether transcription is part of a high-risk system depends on the deployment, not the model.
How the AI Act is structured#
The Act sorts AI practices into tiers. A small set of practices is prohibited outright (Article 5). High-risk systems, defined in Article 6 with reference to Annex I (regulated products such as medical devices and machinery) and Annex III (listed use cases), must meet requirements on risk management, data governance, documentation, logging, human oversight, accuracy and robustness. Certain systems carry transparency obligations under Article 50 regardless of risk tier. Everything else is minimal risk, subject mainly to the AI literacy duty in Article 4. General-purpose AI models have their own chapter.
Obligations fall on different actors. The provider develops the system or places it on the market under its name. The deployer uses it under its authority. A speech API vendor is typically the provider of the recognition system; a bank that builds a voice agent on top of it is a deployer, and may become a provider of the combined system if it places that on the market or substantially modifies it (Article 25).
When the rules apply#
The original timetable did not survive intact. The Commission proposed a "Digital Omnibus" amendment in November 2025, and it was adopted as Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026 and in force since 27 July 2026. It postpones the high-risk obligations: to 2 December 2027 for the standalone use cases in Annex III, and to 2 August 2028 for AI embedded in products covered by Annex I. The transparency duty in Article 50(1), which covers voice agents, still applies from 2 August 2026; systems already on the market get until 2 December 2026 to meet the Article 50(2) duty to mark synthetic content. The prohibitions and the general-purpose AI rules were not delayed. Check the consolidated text on EUR-Lex before planning a compliance programme, as further amendments are possible.
Where speech systems fall#
| Speech use | Likely treatment | Main provisions |
|---|---|---|
| Transcription, captions, dictation | Minimal risk on its own | Art. 4 (AI literacy) |
| Voice agent talking to the public | Transparency obligation | Art. 50(1) |
| Synthetic speech, voice cloning | Transparency obligation | Art. 50(2), 50(4) |
| Emotion recognition of employees or students | Prohibited, except medical or safety | Art. 5(1)(f) |
| Emotion recognition in other settings | High-risk, plus notice to people exposed | Annex III(1)(c), Art. 50(3) |
| Inferring sensitive traits from voice | Prohibited biometric categorisation | Art. 5(1)(g) |
| Speaker identification | High-risk remote biometric identification | Annex III(1)(a) |
| Speech inputs to hiring, credit or court decisions | Possibly part of a high-risk system | Annex III(4), (5), (8); Art. 6(3) |
Emotion recognition from voice#
The Act defines an emotion recognition system as one that identifies or infers emotions or intentions from biometric data. Voice is biometric data in this sense. Article 5(1)(f) prohibits placing on the market or using such systems in the workplace and in education institutions, except where intended for medical or safety reasons. For a contact centre this draws a sharp line: inferring the emotional state of agents from their voices is a workplace use and is prohibited, while inferring the emotions of customers is not prohibited but is high-risk under Annex III and requires the deployer to inform the people concerned under Article 50(3).
Recital 18 excludes the mere detection of readily apparent expressions, and gives voice characteristics such as a raised voice or whispering as examples, unless they are used to infer emotions. Sentiment scored from transcript text alone does not rest on biometric data, which is why it is generally treated differently; see sentiment analysis on speech for how the two approaches differ technically.
Voice agents and synthetic speech#
Article 50(1) requires providers to design AI systems that interact directly with people so that those people are informed they are dealing with an AI, unless this is obvious from the context. A voice agent answering a customer service line is the textbook case. In practice this means a short disclosure at the start of the call.
Article 50(2) requires providers of systems that generate synthetic audio to mark the output in a machine-readable format and make it detectable as artificially generated, where technically feasible. Article 50(4) requires deployers of deep fakes, which include audio that falsely appears authentic, to disclose that the content has been artificially generated or manipulated. Both matter for text-to-speech and voice cloning.
Speaker identification#
Annex III point 1(a) lists remote biometric identification systems as high-risk, but explicitly excludes biometric verification whose sole purpose is to confirm that a person is who they claim to be. A bank's voice login that checks a caller against their own enrolled voiceprint is verification. A system that searches a database of voices to find out who is speaking is identification. The GDPR rules on biometric data apply to both; see voice biometrics and consent.
Speech recognition inside high-risk systems#
A recruitment tool that transcribes video interviews and scores candidates is a high-risk system under Annex III point 4. The transcription model is one component of it. The provider of the complete system carries the high-risk obligations, including accuracy requirements under Article 15 and data governance under Article 10, and will need information from the speech vendor to meet them: error rates on relevant populations, known weaknesses with accents, and how outputs should be interpreted.
Article 6(3) provides that an Annex III system is not high-risk if it does not pose a significant risk of harm, for example where it performs a narrow procedural task or a preparatory task for an assessment. A system that only transcribes a hearing for the record may fall under this derogation; one that ranks witnesses by credibility would not. A provider relying on Article 6(3) must document its assessment, and systems that profile natural persons are always high-risk.
General-purpose models#
Chapter V imposes obligations on providers of general-purpose AI models, applying since 2 August 2025, with models already on the market before that date given until 2 August 2027. A dedicated speech recognition model that performs one task is unlikely to be a general-purpose model. Large multimodal models that accept audio and perform a wide range of tasks may be. A company that builds a voice product on such a model is a downstream provider and is entitled to documentation from the model provider under Article 53.
Common questions#
Is speech-to-text high-risk under the AI Act?
Not in itself. It is not listed in Annex III. It can become part of a high-risk system when it is used in a listed area, such as employment decisions or access to essential services.
Does a voice agent have to say it is an AI?
Yes, under Article 50(1), unless it is obvious from the circumstances to a reasonably well-informed person. The obligation applies from 2 August 2026.
Can a contact centre analyse caller emotion?
Voice-based emotion recognition of callers is not prohibited but is classed as high-risk, and callers must be informed. Applying the same system to the centre's own agents is a workplace use and is prohibited, except for medical or safety reasons.
Does the AI Act replace GDPR for voice data?
No. The AI Act applies alongside GDPR. Biometric processing, lawful basis and data subject rights are still governed by GDPR.
This article is general information, not legal advice.
References#
- Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). EUR-Lex.
- Regulation (EU) 2026/1744 amending Regulation (EU) 2024/1689 (Digital Omnibus on AI). EUR-Lex.
- Regulation (EU) 2016/679 (General Data Protection Regulation). EUR-Lex.
- European Commission (2025). Guidelines on prohibited artificial intelligence practices established by Regulation (EU) 2024/1689. European Commission.
- European Commission (2025). Guidelines on the definition of an artificial intelligence system established by Regulation (EU) 2024/1689. European Commission.
- European Commission (2025). The General-Purpose AI Code of Practice. European Commission.