Analytics
Which privacy laws apply to CCTV audio analytics (gunshot, glass break, raised voice)?
Listens for a class of sound. It needs a microphone that is live, so every audio question applies, whatever the audio column says.
- Biometric identification
- no
- May infer emotion
- no
- May infer a sensitive characteristic
- no
- May be an AI system
- it may be; whether it is one under the EU AI Act is a question for your lawyer
- Read from words such as
- glass break detection
Findings it can raise, with the list
- 5 No retention period set, or retention above the maximum you set
- 6 No signage or notice recorded
- 7 Footage stored outside the site's region: who can access it there?
- 8 A third party can view or manage the footage, and no agreement is recorded
- 10 Audio recorded
- 13 No owner, or no list of who can view
- 14 Disclosures to police or insurers not logged
- 15 Covert camera
Clauses this analytics type adds
1 clausesEU AI Act Art. 4AI literacyAI literacy. Providers and deployers of AI systems must take measures to ensure, to their best extent, a sufficient level of AI literacy among their own staff and any other persons who deal with the operation and use of AI systems on their behalf. The measures must be calibrated to those persons' technical knowledge, experience, education and training, to the context in which the AI systems are to be used, and to the persons or groups of persons on whom the systems are to be used. The duty attaches to every AI system regardless of its risk class.
What a reviewer asks to see: A register of the staff and contracted persons who operate or use AI systems on the organisation's behalf; Training content differentiated by role, prior technical knowledge and the deployment context; Attendance, completion and comprehension records per cohort; Evidence the literacy measures were revisited when a new AI system or a materially different use case was introduced; Material addressing the groups the system is used on, where that shapes the risks staff must be able to recognise
Where camera lists usually fall short: One generic awareness module issued to everyone regardless of role or technical starting point; Training that covers the internal AI policy but not the capabilities and limits of the systems actually in use; Contractors and outsourced operators excluded even though they operate the system on the organisation's behalf; No refresh when the system or its use case changes, so literacy reflects a version no longer running
Source: EU AI Act, read 29 Sep 2026