The brain at work

On 30 September the Governor of California signed a package of laws on automated systems at work. One of them, AB 1883, limits worker surveillance, including tools that infer emotional states or collect neural data. In February, Canada’s privacy commissioner had updated its interpretation: neural data are sensitive information.

In Europe, in 2026, I found no specific measure on neural data from the EDPB or the Italian Garante. One could read this as delay. I read it as a misunderstanding.

Not the signal, the inference

Europe already has strong tools. Since 2025 the AI Act has banned emotion recognition in the workplace, except for medical or safety reasons (Article 5). The GDPR protects health and biometric data (Article 9). The problem is that both reason by category of data. And an EEG signal on its own is often neither health nor biometric data in the technical sense.

Luciano Floridi, in his foreword to Mente e Tecnologia, says it better than I can: “Consent is given to the words of a document, not to the inferences the signal makes possible.” The value, and the risk, are not in the trace. They are in what is drawn from it: attention, fatigue, stress, reaction to news, a boss, a colleague.

California, with all the limits of a state law, wrote the right thing: it looks at what the tool infers, not only at what it collects.

Work is the hardest case

At work, consent does not work. We have always known this: the power imbalance makes it suspect. With neural data there is one more problem. Whoever wears a focus headband does not know what they are giving away, because even the seller does not fully know what can be inferred two years from now.

In my LX Complexity Score study we measured the documents used to consent to brain-computer interfaces. One hundred readers with no legal training, EEG and fNIRS. No document below the experimental accessibility threshold. Now imagine that document handed over by an employer, on day one, together with the badge.

Three questions Europe should ask

1. Does the Article 5 ban on emotion recognition also cover tools that measure “attention” or “cognitive load”? If not, the door is open.
2. Should neural data be a category of its own, or should we regulate inferences, whatever the sensor? I lean towards the latter: in five years the same inference will come from a camera or a keyboard.
3. Who proves that a tool does not infer what it should not? Today, nobody. The Habeas Mentem Charter proposes reversing the burden: it falls to whoever designs the environment to show that the conditions of choice do not work against the person.

For anyone selling these products across the EU, UK and US, the practical advice is one: design for the strictest regime on inferences, not on data. It is the only choice that survives the next change of law.