The EU AI Act and User Research: What AI-Moderated Interviews Actually Require (2026)

If you run AI-moderated interviews with participants in the EU, here is the short answer: customer research is almost certainly in the AI Act's limited-risk "transparency" tier, not the high-risk tier. Your core duty is one sentence long — tell participants they are interacting with an AI, before the conversation starts. That obligation, in Article 50, became applicable on 2 August 2026.

Two things escalate a study out of that comfortable tier:

1. Inferring emotions from voice or face. Emotion recognition is prohibited outright in workplace and education settings under Article 5, and carries disclosure duties everywhere else.
2. Using AI interviews to recruit, screen, or evaluate employees. That is Annex III territory, where the full high-risk regime applies.

Most product and UX teams never touch either. But the teams that do — HR tech, candidate experience, employee listening — are frequently the ones who assume "it's just a survey" and get it wrong. This guide draws the line precisely.

A note on scope. The AI Act governs the AI system. GDPR governs the personal data that flows through it. They are separate regimes with separate penalties, and satisfying one does not satisfy the other. If you have not already worked through lawful basis, retention, and sub-processors, start with our GDPR-compliant AI user research guide and treat this page as the second layer.

The four risk tiers, mapped to research

The AI Act sorts systems by what they do, not by how they are built. Here is where research activities land.

The vast majority of commercial customer research — the discovery calls, the churn interviews, the pricing studies — lives in that third row. The obligation is real but light.

What Article 50 actually requires of you

Article 50(1) puts the design duty on the provider: a system that interacts directly with natural persons must be built so those people are informed they are dealing with an AI, unless it is already obvious from the context.

Article 50(3) puts a separate duty on the deployer: if you operate an emotion recognition or biometric categorisation system, you must inform the people exposed to it.

That provider/deployer split matters commercially, because it determines who owes what:

• If you use a platform like Koji, the platform is the provider of the AI system. The disclosure has to be engineered into the interview experience, and that is the vendor's job.
• You are the deployer. You choose the purpose, the audience, and the questions. You own the decision about whether your study strays into emotion inference or employment evaluation — and no vendor can make that call for you.

The practical bar for disclosure is low but specific. It must be clear, at the first interaction, and not buried. A line in a privacy policy does not satisfy it. "You're chatting with an AI interviewer" on the opening screen does.

There is also a "unless it is obvious" carve-out. Do not lean on it. A participant who clicked an email link labelled "share your feedback" has no reason to assume the interviewer is software, and regulators read obviousness narrowly.

The emotion recognition trap — and the nuance most guides get wrong

This is the part worth reading twice, because the distinction is genuinely subtle and it decides whether you are doing something regulated, something prohibited, or something entirely unremarkable.

The Act defines an emotion recognition system as one that identifies or infers the emotions or intentions of natural persons on the basis of their biometric data. That last clause does the work:

• Coding what someone said is not emotion recognition. If your analysis reads the words "I was really frustrated when the export failed" and tags that response as negative sentiment, you are processing language, not biometric data. This is ordinary qualitative analysis and falls outside the definition.
• Inferring emotion from how someone sounded is a different matter. Deriving affect from vocal tone, pitch, or facial expression uses biometric data, and that lands inside the definition.

So a voice interview is not a compliance problem in itself. A voice interview with a tone-based "sentiment from audio" feature is. And in a workplace or educational setting, that second thing is not merely regulated — Article 5(1)(f) prohibits it, at the top penalty band.

The safe posture, and the one Koji is built around: analyse what participants say, never how their voice sounds. Thematic analysis, quality scoring, and sentiment in Koji all operate on the transcript. There is no vocal affect model anywhere in the pipeline, which keeps voice studies in the limited-risk tier by design rather than by configuration.

When research becomes high-risk: the employment line

Annex III designates AI systems used to recruit, select, and evaluate people as high-risk. The trigger is the decision the output feeds, not the interview format.

Draw the line like this:

• Not high-risk: anonymous employee engagement research, exit interviews analysed in aggregate to find retention themes, candidate experience studies measuring how your hiring process felt.
• High-risk: an AI interview that scores, ranks, or filters candidates. Any output that influences who gets hired, promoted, or terminated at the individual level.

If you are in the second bucket, the full Chapter III regime applies — risk management system, data governance, technical documentation, logging, human oversight, accuracy and robustness testing, and a conformity assessment before you go to market. That is a compliance programme, not a checklist, and it needs counsel.

If you are in the first bucket, keep it there deliberately: report at the cohort level, do not generate per-person scores that feed personnel decisions, and document that design choice. Our guides on anonymous employee research and exit interviews both assume aggregate-only reporting for exactly this reason.

The timeline, after the Omnibus

The compliance calendar shifted materially in 2026, and a lot of published advice is now stale. The AI Omnibus Regulation entered into force in July 2026, deferring the high-risk deadlines that had been set for 2 August 2026.

The headline for researchers: the deferral does not help you. What moved was the high-risk regime. Article 50 — the tier customer research actually sits in — was not postponed. If you are running AI interviews in the EU, your deadline is now, not December 2027.

What non-compliance costs

Penalties are tiered to match the risk tiers, and they are calculated on global turnover, which is why they get executive attention:

• Prohibited practices (Art. 5): up to €35 million or 7% of worldwide annual turnover, whichever is higher.
• High-risk and other obligations: up to €15 million or 3% of worldwide annual turnover for deployers who fail their duties.

Put plainly: switching on a vocal-emotion feature in an employee study is in the same penalty band as the Act's most serious violations. That single configuration choice is worth more scrutiny than most research programmes give it.

Your compliance checklist

Run this before your next EU study ships:

1. Classify the study. Customer research, or employment decision? Write the answer down. This one line determines everything else.
2. Disclose the AI up front. First screen, plain language, before the first question.
3. Confirm no biometric emotion inference. Ask your vendor directly whether any model infers affect from audio or video. Get it in writing.
4. Name the AI in your participant notice, alongside your GDPR disclosures — see research consent form templates.
5. Keep employee research aggregate-only. No per-person scores feeding personnel decisions.
6. Log your studies. Purpose, dates, audience, model used. If a regulator asks, your defence is documentation.
7. Check the provider's posture. Providers carry the design duty — verify yours has actually met it rather than assuming.
8. Re-check before 2 December 2026 if you publish AI-generated content externally, when synthetic content marking kicks in.

How Koji handles this

The AI Act rewards platforms that made the right architectural decisions early, because the obligations that matter here are engineered in, not toggled on:

• Disclosure is built into the interview experience. Every Koji interview identifies itself as AI-moderated at the outset. There is no configuration required and no way to accidentally ship a study that hides it.
• No vocal emotion inference anywhere. Koji's analysis operates on transcripts. Voice interviews transcribe speech and analyse language — tone is never modelled — which keeps voice studies in the limited-risk tier structurally.
• Aggregate-first reporting. Koji's report aggregation rolls findings up to themes and cohorts by default, which is exactly the posture that keeps employee research out of Annex III.
• Transcript-level traceability. Every theme in a Koji report links back to the quotes that produced it, so when someone asks how a conclusion was reached, the answer is a citation rather than a shrug.
• Structured questions instead of inference. This is the underrated compliance advantage. When you need to know how someone feels, the robust move is to ask them with a scale question rather than infer it from their voice. Koji's six structured question types — open_ended, scale, single_choice, multiple_choice, ranking, and yes_no — give you quantified affect as self-reported data. A 1–7 satisfaction scale is better evidence than a tone model, and it is not regulated as biometric processing. Better methodology and lighter compliance load, from the same design decision.

The wider point: legacy survey tools were built before any of this existed, and bolt compliance on through settings you have to find and configure correctly. A platform designed in the AI Act era can make the compliant path the default one — which is the difference between a control you have to remember and a property of the system.

Related Resources

• GDPR-Compliant AI User Research — the data-protection layer that sits underneath AI Act compliance
• Structured Questions Guide — the six question types, and why self-reported scales beat inferred affect
• AI Interview Data Privacy & Security — how interview data is stored, encrypted, and retained
• Research Ethics Guide — the ethical duties that outlast any single regulation
• Research Consent Form Templates — copy-ready notices covering AI disclosure
• HIPAA-Compliant AI User Research — the parallel regime for health-related studies
• Anonymous Employee Research with AI Interviews — aggregate-only design that stays out of Annex III

Regulatory information current as of July 2026 and reflects the AI Omnibus Regulation. This guide is practitioner orientation, not legal advice — confirm your specific obligations with qualified counsel.