Updated 27 October 2026: this post first said the high-risk obligations applied from 2 August 2026. The Digital Omnibus on AI, Regulation (EU) 2026/1744, in force since 27 July 2026, moved them to 2 December 2027 for workplace systems.
The EU AI Act applies in stages. The prohibitions have applied since February 2025 and the general-purpose AI rules since August 2025. The stage that reaches into physical operations (risk management, logging, transparency, human oversight and conformity assessment for high-risk AI systems, with penalties reaching €35 million or 7% of global turnover) now applies from 2 December 2027.
If AI analytics runs on cameras that watch people at work (your plants, warehouses, sites, or stores), this applies to you. Not today, but soon enough that the work starts this year.
Why workplace camera AI is squarely in scope
The Act regulates AI systems by the risk they pose to people, and AI used for monitoring and evaluating people in employment contexts is one of the categories that can qualify as high-risk. A PPE-detection model watching a production line, a zone-intrusion rule protecting a forklift lane, a housekeeping score derived from camera feeds: each of these is an AI system making assessments in a workplace, and each needs to be able to answer the regulator's core question: prove it works, prove it's overseen, prove it's documented.
Two practices are banned outright, with the highest fines in the Act:
- Emotion recognition in the workplace. Inferring the emotional state of employees from camera feeds is prohibited. Full stop.
- Untargeted biometric scraping. Building identification databases from camera footage is prohibited.
If a vendor's roadmap includes either capability, that is no longer a feature. It is a liability.
The five obligations that matter for camera estates
Strip the legal text to what an operations or compliance leader must actually operationalize, and five requirements remain:
- Record-keeping. The system must automatically log events over its lifetime, so any decision can be traced and reconstructed.
- Human oversight. Consequential decisions need meaningful human review: an approval step, not a rubber stamp.
- Transparency. Outputs must be interpretable enough for the people acting on them to understand what happened and why.
- Technical documentation. System descriptions, model information, and compliance evidence: maintained, not assembled in a panic before an audit.
- Data governance. Operational data handled with privacy in mind, retention enforced by policy, access logged.
Notice what these five have in common: none of them can be bolted on after the fact by the compliance department. They are architectural properties. A detection-only tool that fires alerts into a dashboard has nowhere to put a decision log, an oversight workflow, or a versioned rule set.
The strategic reversal
For years, compliance teams slowed camera-AI projects down. Under the AI Act, the reverse is true: a governed platform with its evidence in order is the fastest way to satisfy obligations that carry eight-figure penalties.
That is the part most coverage of the Act misses. Regulation did not make camera AI harder to buy. It made ungoverned camera AI impossible to defend, and governed camera AI the easiest path to obligations you already have. Enterprises that deploy deterministic rules, sealed evidence, and continuous compliance evidence get something their auditors have never had: an answer to “prove it” that takes hours, not weeks.
What to do this quarter
Start with an inventory: which cameras have AI on them today, from which vendors, making which decisions about people? Then map your exposure: the regulations that apply depend on where you operate, and the EU is rarely the only regime in play. Data-protection laws from the GDPR to Saudi Arabia's PDPL are actively enforced, and many add residency requirements of their own. Finally, put every incumbent and candidate vendor through the five obligations above and ask for the documentation, not the roadmap.
Camnitive keeps the compliance evidence (decision logs, human-review records, versioned rules) with every deployment, because the platform was designed after the specification regulation set, not before it.
