The EU AI Act doesn't regulate video calls. It regulates the AI you put into them. A plain WebRTC meeting, people talking through Jitsi or anything like it, has no obligations under the Act at all.
Add a transcription bot, an AI summary, a "sentiment" dashboard or an interview-scoring tool, and that changes. Some of those features are fine. One of them has been illegal in European workplaces since February 2025.
Short answer
What the EU AI Act is, in one paragraph
The AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024. It sorts AI systems by risk: a short list of banned practices, a longer list of high-risk uses with heavy obligations, transparency duties for systems that talk to people or generate content, and everything else, which is most AI, left alone. It sits beside the GDPR rather than replacing it, and it's a separate law from the Digital Markets Act, which regulates the largest platforms rather than AI systems.
An earlier version of this article described the Act loosely and made claims about Meetrix features we can't back up. This one sticks to what the regulation says.
EU AI law compliance timeline after the Digital Omnibus
The dates moved in 2026. The Digital Omnibus on AI, Regulation (EU) 2026/1744, was published on 24 July 2026 and entered into force on 27 July. It pushed the high-risk deadlines back because the harmonised standards weren't ready. Here's where things stand now:
- 2 February 2025: prohibited practices banned, AI literacy rules apply.
- 2 August 2025: obligations for general-purpose AI models (the large language and speech models most meeting tools are built on).
- 2 August 2026: Article 50 transparency duties for new systems. Machine-readable marking of AI output gets a grace period to 2 December 2026 for systems already on the market.
- 2 December 2027: stand-alone high-risk systems in Annex III, including employment and education. This was 2 August 2026 before the Omnibus.
- 2 August 2028: high-risk AI built into products covered by other EU safety law, such as medical devices.
The Commission keeps the official schedule on its AI Act policy page.
Which meeting AI features the AI Act actually touches
Walk through a typical video platform feature by feature and most of it is unregulated. The interesting cases are few, and they're specific.
Banned: emotion recognition at work and in class
Article 5(1)(f) prohibits AI that infers people's emotions in the workplace or in education institutions, unless it's for medical or safety reasons. That covers the "engagement" and "sentiment" scores some meeting tools put on employees in a call, and attention-tracking on students in a virtual classroom. If a vendor sells you that for internal meetings or online teaching in the EU, it's been a prohibited practice since 2 February 2025, and the fine tier for prohibited practices is the highest in the Act.
Article 5 also bans biometric categorisation that infers sensitive traits such as race, political opinions or sexual orientation from someone's face or voice.
High-risk: AI that judges people
Annex III lists the uses that count as high-risk. Two of them show up in video calls all the time:
- Employment: AI used to screen or rank job candidates, including tools that analyse recorded or live video interviews, and AI that monitors or evaluates workers' performance and behaviour.
- Education: AI that evaluates learning outcomes or watches students for cheating during online exams (proctoring).
High-risk means risk management, data governance, logging, human oversight, technical documentation and registration in the EU database. Providers carry most of that. Deployers, the company actually running the interviews or exams, still have to use the system as instructed, keep logs and assign human oversight. Those duties now apply from 2 December 2027.
Transparency: bots, synthetic media and notetakers
Article 50 applies from 2 August 2026. For meetings, the practical parts are:
- A voice or chat assistant in a call has to make clear it's an AI, unless that's obvious.
- Synthetic or manipulated video and audio, avatars and voice clones included, has to be disclosed as AI-generated.
- Providers of generative AI have to mark output in a machine-readable way.
- If you do run emotion recognition or biometric categorisation where it's allowed, the people exposed to it must be told.
Mostly unregulated: transcription, summaries, noise suppression
Live captions, transcripts, meeting summaries, background blur and noise cancellation aren't on the banned list or the high-risk list. They're minimal risk under the AI Act. That doesn't make them a compliance-free zone: a transcript is personal data, so GDPR decides where it's stored, how long you keep it and on what lawful basis you recorded it. Our guide to GDPR-compliant WebRTC video covers that side.
What this means for a self-hosted WebRTC platform
WebRTC itself is just transport. It's encrypted by default (DTLS-SRTP), and the AI Act has nothing to say about it. What you build on top is what counts, and running the platform yourself gives you a straight answer to the questions an auditor or a works council will ask: which models touch the audio, where the transcripts go, and who can switch a feature off.
That's the setup we run for customers: Jitsi Meet inside their own AWS or GCP account. If you want AI notes without sending audio to a third-party service, our self-hosted Whisper notetaker for Jitsi keeps transcription on your own servers. For teams whose real goal is keeping meeting data inside Europe, sovereign video conferencing is the closer fit. For the security baseline buyers ask for, see ISO 27001 for Jitsi and WebRTC.
A short checklist we'd use before switching on any AI feature in a meeting product sold or used in the EU:
- List every AI feature and who provides the model behind it.
- Remove anything that infers emotions of employees or students.
- Flag anything that scores candidates, workers or students as high-risk and plan for December 2027.
- Add AI disclosure to bots, avatars and generated media before 2 August 2026.
- Run GDPR on the recordings and transcripts as usual: lawful basis, retention, storage location.
Outside the EU the picture is patchier. In the US there's still no federal AI or privacy law, as we explain in our piece on where the American Privacy Rights Act ended up, and healthcare video has its own rules, covered in HIPAA-compliant self-hosted telehealth.
Frequently Asked Questions
Does the EU AI Act apply to video conferencing?
Not to video calls as such. It applies to the AI inside them: transcription, summaries, meeting bots, and anything that scores or watches participants. Most of that is minimal risk. Emotion recognition at work and AI that grades students or employees are the parts it actually restricts.
Is emotion recognition in video calls banned under the EU AI Act?
In workplaces and schools, yes. Article 5(1)(f) prohibits AI that infers emotions in the workplace or in education, except for medical or safety reasons, and that ban has applied since 2 February 2025. Outside those settings it is allowed, but people exposed to it must be told.
When do the EU AI Act obligations apply after the Digital Omnibus?
Bans and AI literacy since 2 February 2025, general-purpose AI rules since 2 August 2025, and transparency duties from 2 August 2026. The Digital Omnibus (Regulation 2026/1744) moved Annex III high-risk systems to 2 December 2027 and product-embedded ones to 2 August 2028.
Are AI meeting transcription and summaries high-risk?
No, not on their own. Transcribing or summarising a meeting isn't on the Annex III list. It becomes high-risk when the output feeds decisions the Act names, such as scoring job interviews, evaluating workers or grading students. GDPR still applies to every recording and transcript either way.
What are the fines under the EU AI Act?
Up to €35 million or 7% of worldwide annual turnover for prohibited practices, up to €15 million or 3% for most other breaches, and up to €7.5 million or 1% for giving regulators incorrect information. Whichever is higher applies, with lower caps for SMEs.