AI Employee Monitoring: The Line Nobody Agreed On, and What It Costs

Productivity software now reads what your team writes, commits and says out loud. The rules governing it were written by five different bodies over three decades, and they do not agree. France's regulator has already imposed a 32 million euro penalty on an employer whose staff knew they were tracked. The permitted set is narrower than a vendor demo suggests, and the trust cost lands inside it too.

The short answer

AI employee monitoring is lawful in most of the world, on conditions that vary sharply. The European Union bans emotion inference at work outright. Three United States states require prior written notice and the rest require none. Ontario requires a written policy. India treats employment as a purpose that needs no consent at all.

What AI employee monitoring actually covers now

The phrase used to mean a screenshot tool. It now means something broader and much harder to bound.

Three streams have converged. Communication platforms expose message content and metadata. Version control exposes every commit, review and comment. Meeting tools expose transcripts, speaking time and, increasingly, tone. A model sits across all three and produces a score.

That score is the product. The logging was never the interesting part.

Recording that a message was sent at 14:02 is logging. Concluding from a quarter of messages that someone is disengaged is inference. Almost every legal line drawn in the last four years sits between those two acts, not between monitoring and no monitoring.

This matters at procurement. Vendors routinely sell both capabilities under one product name. Ask one question. Does the system make a claim about what a person did, or about how a person is? The answer decides which section of this post applies to you.

The 32 million euro case that set Europe's ceiling

France's data protection authority, the CNIL, fined Amazon France Logistique 32 million euros in a decision dated 27 December 2023, published on 23 January 2024. It remains the largest workplace monitoring penalty a European regulator has issued.

The number is useful. The reasoning is more useful, because it is where compliance thinking usually goes wrong.

What the CNIL actually objected to

Warehouse staff used handheld scanners. The system built indicators from the scan stream, and the regulator found several of them excessive. One flagged inactivity beyond ten minutes. Another, reported as the stow machine gun indicator, flagged scans registered under 1.25 seconds apart.

The CNIL also found the video surveillance ran without adequate information to staff and without sufficient security. Amazon said it disagreed with the findings, and that the decision contained factual inaccuracies.

Read the objection carefully. Employees knew the scanners recorded their work. The finding was that measuring at that resolution, and making people account for every interruption, went past what the purpose justified. The penalty was reported at roughly 3% of that entity's annual revenue, against a ceiling of 4%.

The lesson generalises past warehouses. Under European data protection law, notice is necessary and it is not sufficient. Granularity is itself a legal variable.

What is prohibited outright, and where

Most of this debate is about conditions. A small part is about absolute bans, and that part has grown quickly.

Emotion inference is banned, not restricted

Article 5(1)(f) of the EU AI Act prohibits placing on the market, putting into service or using AI systems that infer a person's emotions in the workplace, outside medical or safety reasons. It applied from 2 February 2025. The Commission's guidelines on prohibited AI practices set out how the definitions are read.

Penalties reach 35 million euros or 7% of total worldwide annual turnover, whichever is higher. That is the regulation's top tier.

Consent does not cure it, because this is a prohibition rather than a lawful basis question. The ban also reaches facial expression analysis, voice stress scoring and physiological signals alike. A sentiment score derived from tone of voice in a sales call is inside it. The wider disclosure duties are set out in the checklist of what the AI Act requires you to publish.

Platform work adds a second prohibition list

Directive (EU) 2024/2831 goes further, and member states have until 2 December 2026 to write it into national law. Article 7 bans automated systems from processing several categories outright.

The list includes anything allowing conclusions about a worker's emotional or psychological state. It covers private conversations, and data gathered while the worker is neither working nor offering to work. It also covers data predicting the exercise of fundamental rights, such as freedom of association or the right to strike.

Consent cannot waive any of it. The scope limit is often dropped in summaries: this directive binds digital labour platforms, not every employer. Treat it as the direction of travel rather than a rule that already covers your engineering team.

In Germany a works council can simply refuse

Section 87(1)(6) of the Works Constitution Act gives a works council co-determination over the introduction and use of technical equipment intended to monitor behaviour or performance. Federal Labour Court case law reads that broadly. It is enough that a system is objectively capable of monitoring, whether or not the employer intends to analyse anything.

That test captures far more than monitoring tools. Ticketing systems, customer relationship platforms and collaboration tools with activity logs all fall inside it. The right is not consultative. Where a works council exists and has not agreed, the employer cannot deploy.

My view is that this is the most underestimated constraint on any European rollout plan. Legal review clears the tool, and the works council stops it six weeks after signature.

Notice, and only notice, in the United States

No federal statute makes a private employer tell staff they are monitored. The duty, where it exists, is set state by state, and the map is thinner than most compliance decks imply.

Three states, three notice statutes

Connecticut, Delaware and New York each require prior written notice to private sector employees. New York's Civil Rights Law 52-c took effect on 7 May 2022. It requires notice at hiring, employee acknowledgment, and a posting in a conspicuous place.

The penalties are small. New York provides for 500 dollars on a first offence, 1,000 on a second and 3,000 on each one after. Connecticut's regime, enforced by the state labour commissioner, sits in the same 500 to 3,000 dollar range.

Set those numbers beside the 32 million euro CNIL decision. The gap is not a difference in enforcement appetite. It is a difference in what the two systems think the underlying interest is worth.

Illinois adds an AI notice from January 2026

Illinois HB 3773 amended the state Human Rights Act with effect from 1 January 2026. Employers must give notice when AI is used in recruitment, hiring, promotion, discipline, discharge or other terms of employment. Discriminatory use is prohibited, as is using postcode as a proxy for a protected class.

The practical problem is that the Illinois Department of Human Rights withdrew its proposed implementing rules. The statutory duty is live and the shape of a compliant notice is not settled. If a monitoring score feeds a promotion or discipline decision, that duty attaches, even though nobody described the tool as an employment decision system. Keeping that boundary clean is the subject of the piece on performance review criteria that survive AI inputs.

The broadest bill of 2026 died in February

California is the instructive failure. AB 1221 would have been the country's widest workplace surveillance law. It required 30 days of written notice before a surveillance tool was introduced. It would also have prohibited facial recognition, gait analysis, emotion detection and neural data collection, with a narrow carve-out for opening a locked device or secured area.

It failed. The bill was filed with the Chief Clerk under Joint Rule 56 on 2 February 2026. Separately, the California Privacy Protection Agency's automated decisionmaking rules took effect on 1 January 2026, with obligations for significant decisions, employment among them, applying from 1 January 2027.

Canada, India, and the size of the gap

Ontario took the disclosure route and took it seriously. Bill 88 amended the Employment Standards Act. Employers with 25 or more employees on 1 January must hold a written electronic monitoring policy by 1 March that year. The first deadline was 11 October 2022, as Osler set out when the rules came into force.

The policy must state whether employees are monitored, by what methods, and how the resulting information may be used. Every Ontario employee counts toward the threshold, including part-time staff and people on leave. An employer that does not monitor still has to say so in writing.

What Ontario does not do is limit the monitoring. Disclose fully and you may proceed. That is a different philosophy from the French one, and it is the one most of the common law world has adopted.

India goes further again. Section 7(i) of the Digital Personal Data Protection Act 2023 lists employment purposes as a legitimate use. An employer may therefore process employee data without consent where the purpose relates to employment, or to protecting the employer from loss or liability. Purpose limitation, security and retention duties still apply. Where that data may physically sit is covered in the comparison of EU and India residency rules.

This covers monitoring-specific rules only. General wiretap, biometric and confidentiality law applies in every row, and can be the binding constraint even where this column reads as empty.

What damages trust regardless of the law

Compliance is the floor. The evidence on what monitoring does to a workforce sits separately from it, and it points somewhere uncomfortable.

Monitoring raised rule breaking rather than lowering it

Thiel, Bonner, Bush, Welsh and Garud published Stripped of Agency in the Journal of Management in 2023. Using a field study and an experiment, they found monitoring increased workplace deviance rather than reducing it.

The mechanism is specific. Monitoring reduces an employee's sense of agency, which enables moral disengagement through displacement of responsibility. If the system is watching, the system owns the outcome. The effect weakened substantially where employees rated the organisation as fair overall.

That last finding is the actionable one, and it is almost never quoted. Monitoring is not automatically corrosive. Monitoring without perceived fairness is.

The wellbeing data runs the same way. In the American Psychological Association's 2023 Work in America survey, 51% of workers said their employer used technology to monitor them. Among those, 56% reported typically feeling tense or stressed at work, against closer to 40% of the unmonitored. Emotional exhaustion ran 39% against 22%. The pattern in engineering teams is examined in the piece on burnout and the pace AI sets.

One more number explains the demand better than any of the above. In its September 2022 Work Trend Index Pulse, covering 20,000 people in 11 countries, Microsoft found 85% of leaders said hybrid work made it hard to be confident people were productive. 87% of employees said they were productive. Microsoft called the gap productivity paranoia.

That gap is what most monitoring budgets actually buy. Not measurement, reassurance. Be honest about which of the two you are purchasing, because only one of them can be evaluated afterwards. The same instinct shows up in tooling decisions, as set out in the analysis of the gap between developer trust and developer usage.

Where this argument is weakest

Three places, and one of them undercuts the evidence in this post.

The first is that the case for monitoring is stronger than critics admit. Regulated industries carry supervision obligations they cannot meet by trusting people. Financial services firms must retain and review communications. Security teams need access logs to detect compromise. A blanket argument against workplace measurement ignores that much of it exists because a regulator demanded it.

The second is the self-report problem. Almost all the wellbeing evidence, including the figures charted above, comes from people describing their own state in a survey. Workers who feel badly treated may be likelier to notice and report being monitored. The direction of causation is not settled by that design, which is why it is presented here as correlation.

The third is the one to watch. A large body of adoption statistics circulates claiming specific percentages of firms now use AI to score employee behaviour. I could not trace any of them to a published sample, a stated window or a named methodology. They originate almost entirely from monitoring software vendors, the parties with the strongest interest in the number being high. None of them appear in this post, and I would not act on one.

What I would still not switch on, whatever local law permits, is sentiment or emotion scoring of employees. It is banned across the European Union, it is technically weak, and the cost of being wrong about someone's internal state falls entirely on that person. Recording and analysing meetings sits close to the same line, and the consent questions are set out in the piece on note takers, consent and training rights.

Frequently asked questions

Where to start this week

Two exercises, both cheap, both revealing.

Run an inventory first. List every tool you already run that is objectively capable of monitoring behaviour or performance. Include the ticketing system, the version control platform, the meeting recorder and the customer relationship system. Do not limit the list to products sold as monitoring. Most teams find between six and fifteen. In Germany that list is the works council's jurisdiction. In Ontario it is the content of a policy you may already be required to hold.

Then apply one test to each entry. Does the tool produce a claim about what a person did, or about how a person is? Move everything in the second category onto a separate list, and treat that list as a board decision rather than a procurement one. It is prohibited across the European Union, and it is the part of the stack most likely to cost you the trust of the people it measures.

Related reading