Read AI and GDPR / AI Act: the forbidden frontier of meeting analysis

Overview and data processed

Read AI is an American meeting assistant that, beyond transcription and summaries, offers engagement, participation and 'sentiment' measurements of participants.

Read AI processes voice, image where applicable, transcripts, and most importantly behavioural indicators (speaking time, engagement, sentiment) that relate to the behaviour and emotional state of individuals. American publisher: exposure to the CLOUD Act.

Risks for your organisation

The risk is twofold and severe: a potentially prohibited practice (emotion recognition at work) and employee monitoring which, if it feeds into HR decisions, becomes high risk. The CNIL has included the analysis of voice communications in its 2026 programme.

Main GDPR risks:

• Behavioural/emotional analysis of employees: high-risk processing, DPIA mandatory.
• Employee monitoring: proportionality (article L1121-1), information, works council.
• Information/consent of participants; transfer outside the EU (CLOUD Act); retention.

GDPR obligations

1. Disable all emotion/sentiment analysis (prohibited practice at work).
2. Limit and justify any participation measurement (proportionality); consult the works council.
3. Inform and obtain consent from participants; sign the DPA; frame transfers (SCCs).
4. Carry out a DPIA; record in the record of processing activities; define retention.
5. Involve the DPO; train teams. No DPO? See our outsourced DPO.

AI Act obligations

Prohibition (article 5, since 2 February 2025): emotion recognition at work is prohibited — this is the core problem with Read AI. These features (tone, mood, stress, emotional engagement) must be disabled. Furthermore: transparency (article 50), AI literacy (article 4), and — for participation analyses used for evaluation — high-risk regime (Annex III) with human oversight, works council information and DPIA. See the AI Act guide.

AI Act risks: emotion recognition at work (PROHIBITED practice, highest penalty ceiling); participation analyses used for evaluation (high risk); lack of transparency.

Cybersecurity and best practices

Cyber risks: sensitive behavioural indicators; transfer outside the EU; 'panoptic' view of employees; NIS 2 depending on size.

Best practices: disable emotion/sentiment measurements; limit the rest to what is strictly necessary (proportionality); information and consultation of the works council; participant consent; framed transfers; systematic DPIA; for routine use, prefer a tool without behavioural analysis; AI charter, record, AI training.

Checklist:

• Emotion/sentiment analysis DISABLED (prohibition), monitoring limited and proportionate, works council consulted
• Information + participant consent, DPA + framed transfers (SCCs), DPIA carried out
• Short retention, employees informed, teams trained

Penalties, conclusion and recommendations

Penalties: GDPR (up to €20M or 4%); AI Act — up to €35M or 7% of global turnover for prohibited practices (including emotion recognition at work), the highest ceiling in the regulation; €15M or 3% for a non-compliant high-risk system; criminal aspects (article 226-1 of the Criminal Code).

Recommendation: Read AI illustrates the line not to be crossed: measuring mood or emotional engagement is prohibited at work. Disable these features, limit participation analysis to what is proportionate, consult the works council and carry out a DPIA. If in doubt, prefer a tool without behavioural analysis such as tl;dv or Teams Copilot. See the AI tools comparison.