The EU AI Act regulates AI systems, models, and operators; it does not create a standalone approval regime for speech datasets. Which duties apply depends on intended purpose, classification, and whether an organization is a provider, deployer, importer, distributor, or another operator. A supplier evidence pack can support compliance, but it does not establish the buyer's classification or discharge the responsible operator's duties.
The Act is phased in: Article 4 and the original Article 5 prohibitions generally apply from February 2, 2025; GPAI and governance provisions from August 2, 2025; and Article 50 and many remaining provisions from August 2, 2026. Regulation (EU) 2026/1744 moved Chapter III Sections 1–3 to December 2, 2027 for Article 6(2)/Annex III high-risk systems and August 2, 2028 for Article 6(1)/Annex I systems, subject to transition provisions. Check the current consolidated text, classification guidance, and any amendments for the date and use case at issue.
This guide is a procurement orientation, not legal advice. Ask qualified counsel to map your role, system classification, jurisdiction, and deployment before relying on it.
Start with role and classification
The same speech application can create different duties for a model provider, system provider, deployer, importer, distributor, or data supplier. Article 10 is a requirement for high-risk AI systems trained with data; Article 16 places the related compliance obligation on providers of high-risk systems. Buying data does not automatically make the buyer the provider, and supplying data does not transfer the provider's legal responsibility. Map the operator roles and intended purpose first.
Article 5 prohibits certain practices, including AI systems used to infer emotions in workplace and education settings, subject to a medical-or-safety exception. The scope depends on the Act's definitions, intended purpose, and actual setting. Article 53 separately requires providers of general-purpose AI models to prepare and publish a sufficiently detailed summary of training content using the prescribed template, with transitional provisions for models already on the market.
The application timeline is phased
| Application date | Provision | Buyer implication |
|---|---|---|
| February 2, 2025 | Article 4 and the original Article 5 prohibitions | AI-literacy duties and the original prohibited-practice rules began applying, including the workplace and education emotion-inference prohibition and its medical-or-safety exception. |
| August 2, 2025 | GPAI chapter and governance provisions | GPAI-provider duties began applying, subject to the Act's transition rules for models placed on the market before that date. |
| August 2, 2026 | Article 50 and other provisions not deferred | Article 50 direct-interaction transparency applies, subject to its exceptions and transition rules. |
| December 2, 2026 | New Article 5 provisions and specified legacy Article 50(2) systems | The Article 5 additions made by Regulation (EU) 2026/1744 apply; providers of qualifying synthetic-content systems placed on the market before August 2, 2026 must take the necessary steps to comply with Article 50(2). |
| December 2, 2027 | Chapter III Sections 1–3 for Article 6(2)/Annex III systems | The deferred high-risk classification and obligation rules apply to Annex III systems, except Article 6(5) and subject to transition provisions. |
| August 2, 2028 | Chapter III Sections 1–3 for Article 6(1)/Annex I systems | The corresponding deferred rules apply to Annex I product-safety systems, subject to transition provisions. |
This table is orientation, not a classification decision. Official sources are Regulation (EU) 2024/1689 on EUR-Lex and Regulation (EU) 2026/1744, which amended the application timeline; see Articles 5, 6, 10, 16, 50, 53, 99, and 113. Check the current consolidated text and applicable guidance because timing can depend on the provision, model history, and system category.
What Article 50 says about conversational AI
Article 50(1) requires providers to design systems intended to interact directly with people so those people are informed that they are interacting with AI, unless that is obvious to a reasonably well-informed, observant, and circumspect person in the circumstances. Article 50 also contains law-enforcement exceptions. Under Article 50(5), required information must be clear and distinguishable and provided at the latest at the first interaction or exposure.
That is more precise than saying every voice bot must always make the same opening announcement. Product teams should document whether the exception applies, who implements the notice, its timing and accessibility, and any sector-specific disclosure rules.
What Article 10 does and does not require
For high-risk systems that train models with data, Article 10 calls for data-governance and management practices appropriate to the intended purpose. Its list includes design choices, collection processes, data origin and original purpose for personal data, preparation and annotation, assumptions, availability and suitability, bias examination, and measures to detect and address issues. It does not literally require a provenance statement for every audio hour or prescribe a universal five-document vendor pack.
A buyer can nevertheless use the following due-diligence pack to support its own governance:
- Rights and source chain. Identify the source, supplier rights, permitted uses, and restrictions for the specific delivery.
- Data-protection record. Identify controller and processor roles, lawful basis, notices, consent where relied on, purposes, transfers, retention, and rights handling.
- Collection record. Record recruitment or source method, instructions, locations, devices, and transformations relevant to the intended use.
- Annotation and QA record. Define the schema, annotator process, acceptance metrics, sampling plan, and known limitations actually agreed for the project.
- Dataset characteristics. Record available language, speaker, demographic, acoustic, quantity, suitability, and bias information, subject to data-minimization constraints.
This is a practical procurement checklist, not a statutory list. The responsible provider must decide what its Article 10 governance requires, and deployers or other operators may have different duties.
The GDPR assessment remains separate
The AI Act does not replace the GDPR. A voice recording is personal data when it relates to an identified or identifiable person, so the controller needs an Article 6 lawful basis and must meet purpose-limitation, transparency, minimization, retention, security, and data-subject-rights duties. Further use of call audio for model training is not automatically lawful or automatically prohibited: assess the original purpose, notices, compatibility, legal basis, contracts, and any applicable communications law.
Voice is not automatically biometric special-category data. Under GDPR Article 9, biometric data is special-category data when processed through specific technical means for the purpose of uniquely identifying a person. If Article 9 applies, an Article 9(2) condition is required in addition to an Article 6 basis. Explicit consent is one possible condition, not a blanket requirement for all speech processing. See the official GDPR text on EUR-Lex, especially Articles 4, 5, 6, 7, 9, 13, and 14.
Emotion recognition needs use-case analysis
Workplace and education. Article 5 prohibits AI systems used to infer emotions in these settings unless the system is intended for medical or safety reasons. The exception is not blanket approval for any feature described as safety-related; intended purpose and facts matter.
Vehicles and contact centers. An in-cabin safety feature, an employee-scoring dashboard, and customer-sentiment routing can fall into different categories. Employee emotion inference may be prohibited; emotion recognition outside the prohibited settings may fall within an Annex III high-risk category if the definitions and classification rules are met. Confirm Article 6 and Annex III classification, the Article 5 exception if claimed, and GDPR or employment-law constraints rather than assuming a vertical-wide answer.
Penalties are ceilings, not a risk calculation
Article 99 sets maximum administrative-fine tiers, including up to EUR 35 million or 7% of worldwide annual turnover for Article 5 infringements and up to EUR 15 million or 3% for certain other infringements, subject to the Regulation's conditions. The applicable amount, liable operator, enforcement route, and mitigating or aggravating factors are case-specific. Do not use the headline ceiling as a substitute for role and obligation mapping.
How to use Spirelight's documentation
Spirelight is based in Denmark, but location alone does not establish a buyer's compliance. For a specific project, confirm the available license, source, notice or consent, collection, annotation, QA, statistical, storage, retention, and transfer records. Put required artifacts and acceptance criteria in the written brief, quote, and contract.
The catalogue presents custom collection configurations and planning inputs, not a blanket representation that every item is finished inventory or carries the same evidence pack. Confirm feasibility, sample status, legal terms, documentation, schedule, and final price for the delivery under review.
When Article 10 or Article 50 may not apply
A transcription tool may fall outside the high-risk categories, but that conclusion depends on intended purpose, integration, affected persons, and Article 6 and Annex I or III analysis. Even a non-high-risk system may still trigger GDPR, consumer, employment, communications, accessibility, or sector-specific rules.
Article 50(1) concerns systems intended to interact directly with people and includes an obviousness exception; it does not apply to every system that processes speech. Document the actual interaction and operator role, then have counsel verify the result.