AI Employee Monitoring in Ireland: GDPR and AI Act Points for Employers

AI employee monitoring and productivity tracking sit where data protection law and the AI Act meet. In Ireland the monitoring rules come mainly from GDPR and the Data Protection Act 2018, as Citizens Information explains, while the AI Act adds a ban on certain emotion-inferring systems at work and a high-risk category for some employment uses. This guide sets out what the official pages say and where they are silent. It builds on our general piece on employee monitoring and CCTV under data protection law, and takes the AI angle.

The baseline: monitoring rules still apply

Citizens Information's "Surveillance at work" page (last edited 22 July 2026) says employees have a right to privacy at work, to be balanced against an employer's need to protect its business, reputation, resources and equipment. It states that when an employer collects, uses or stores information about staff, it must comply with the GDPR and the Data Protection Act 2018. Adding AI to the monitoring does not remove any of that.

The page says monitoring must be "necessary, legitimate, and proportionate" and should have a legal basis. It says employers should consider less intrusive options first, giving the example of blocking websites rather than monitoring search history. It says that monitoring all emails to catch confidential information would not be proportionate, while an automated virus scan would likely be seen as proportionate.

Transparency comes first

Citizens Information says employers must tell staff who is monitoring them, what is monitored, how and when. In its CCTV section it says that where cameras are used for non-obvious purposes, such as monitoring behaviour or performance, staff must be told before recording. For remote work it says the same monitoring rules apply and that tools such as mouse and keyboard tracking should be disclosed to staff.

The Data Protection Commission (DPC) has a case study, tagged 2022, in which an employer wanted to use swipe-card data as evidence in disciplinary proceedings about timekeeping (after an internal appeal it agreed not to use the data). The DPC concluded the employer had not told the employee about that use, and so had not obtained and processed the data fairly. The page adds that employers may have valid legal bases, such as contract or legitimate interests, but the Article 5 principles apply whatever the legal basis. A productivity dashboard fed by logins, keystrokes or activity scores raises the same question: were people told, and told the real purpose?

Our guide to informing employees about AI tools covers how to do this in practice.

What changes when AI is added

The DPC's AI and large language models blog (18 July 2024) says AI products can be prone to producing inaccurate or biased information, and warns that relying on outputs without critical human analysis or intervention may create automated decision-making risks. For monitoring, that matters. A score that ranks staff on "productivity" may be wrong, and a manager acting on it without checking could be relying on a flawed output. The blog also says deploying AI may require a data protection impact assessment, and that doing one anyway would be best practice. Citizens Information's monitoring page does not mention impact assessments, so the DPC blog is the source for that point here.

Our suggestion: before introducing AI-based tracking, write down what the tool measures, why, what less intrusive option you considered, who sees the output, and what a manager must check before acting on it.

The AI Act ban on emotion inference at work

The consolidated text of Regulation (EU) 2024/1689 on EUR-Lex (version dated 27 July 2026) includes, in Article 5(1)(f), a prohibition on placing on the market, putting into service for this specific purpose, or using AI systems to infer emotions of people in workplaces and education institutions, with an exception for medical or safety reasons. The Commission's "Navigating the AI Act" page (last update 7 August 2026) lists "emotion recognition in the workplace and education institutions" among the prohibited practices, "unless for medical or safety reasons". The Commission's AI Act page (last update 3 August 2026) says prohibitions 1 to 8 became effective in February 2025.

That has a practical consequence for monitoring tools. Our suggestion: if a product claims to detect mood, stress or engagement from faces, voices or similar signals in a work setting, treat it with great caution and read our guide to prohibited AI practices for employers in Ireland. We have not read the text of the Commission's guidelines on prohibited practices. The Commission's page for them (published 4 February 2025, last updated 31 July 2025) describes them as non-binding, with authoritative interpretations reserved for the Court of Justice, and does not mention workplace emotion recognition on that page. Check the guidelines themselves for how the Commission reads the prohibition.

Monitoring as a high-risk use

The Commission's pages say Annex III covers AI systems used for certain tasks in employment and workers management, with examples such as systems that analyse and filter job applications and evaluate candidates, and describe the category as AI tools for employment, management of workers and access to self-employment. The AI Act page says those high-risk rules apply from 2 December 2027, following the Digital Omnibus, which it says entered into force on 27 July 2026. The Commission's AI Act Service Desk Annex III page lists, in point 4, AI systems used to make decisions affecting terms of work-related relationships, promotion or termination, to allocate tasks based on individual behaviour or personal traits or characteristics, or to monitor and evaluate the performance and behaviour of people in those relationships. Whether a particular monitoring tool falls within that wording depends on its intended purpose, so take advice. Dates have moved before, so check the current position.

For deployers of high-risk systems, the Commission says employers must beforehand inform affected employees and workers' representatives, in addition to any worker consultation rules that already apply. The text of Article 26(7) on EUR-Lex says deployers who are employers shall inform workers' representatives and the affected workers before putting a high-risk system into service or using it at the workplace.

Covert monitoring and special areas

Citizens Information says covert surveillance is generally unlawful but may be used in exceptional cases linked to detecting, preventing or investigating crime, that it must be focused and short-term, and that it requires a specific written policy. It adds that using CCTV to monitor areas where staff expect privacy, such as bathrooms, is very difficult to justify. Nothing on the page suggests AI changes this.

Employee rights

The page says staff can make a data subject access request for monitoring data and CCTV images of themselves, with a response due within one month, extendable by two months for complex or numerous requests. It also says employers should tell staff immediately if they suspect misuse of electronic communications, unless there are important reasons to continue monitoring without the employee's knowledge. If your AI tool generates scores or flags, plan for how you would retrieve and explain them if asked.

A short checklist (our suggestions)

• List every tool that tracks activity, location, communications or output, and mark which ones use AI.
• For each, state the purpose and the less intrusive alternative you considered.
• Check whether any feature infers emotions, and escalate before use.
• Decide who must review AI flags and scores before any action is taken.
• Tell staff in advance, in plain words, what is measured and why.
• Take advice if the tool is used for decisions about hiring, promotion or dismissal.

Learnsignal's offices are off Baggot Street in Dublin, and we offer in-person training from there. For current details, see our CPD pages.

Frequently asked questions

Can an Irish employer use AI to track productivity?

Citizens Information says monitoring must be necessary, legitimate and proportionate, with transparency about who monitors what, how and when. The page does not single out AI, so the same tests apply.

Is emotion recognition at work banned?

According to the Commission's page and the consolidated AI Act text, AI systems that infer emotions in workplaces are prohibited, except for medical or safety reasons.

Do employers have to tell staff about AI monitoring?

Citizens Information says employers must tell staff about monitoring, including non-obvious purposes such as performance. For high-risk AI used at work, the Commission says employees and their representatives must be informed beforehand.

Do we need a DPIA?

The DPC's AI blog says deploying AI may require one and that doing one anyway would be best practice. Citizens Information's page does not mention DPIAs.

The safest route is to be clear about purpose, open with staff and cautious with any tool that claims to read people's feelings.