The EU AI Act lands on mental health: what changes on 2 August 2026
- On **2 August 2026**, the bulk of EU Regulation 2024/1689 (the AI Act) becomes enforceable — including the full high-risk regime under Articles 8–17 that directly covers AI systems used in mental health, employment screening, education assessment and emergency triage.
- The Commission's **2 February 2026** deadline for guidelines on Article 6 has passed; providers of mental-health-relevant AI now have a six-month operational window before enforcement, with fines up to **€35 million or 7% of global turnover** for prohibited uses and **€15 million or 3%** for high-risk non-compliance.
- Two provisions hit clinical practice directly: **Article 5 prohibits inference of emotions in workplaces and educational institutions** except for medical or safety reasons (HR "burnout-detection" dashboards, classroom mood AI), and **Annex III classifies all emotion-recognition systems as high-risk** outside those two contexts — therapy chatbots, suicide-risk predictors, affect-tracking apps used in clinics.
- By the same date, each Member State must have at least one **AI regulatory sandbox** operational (Article 57(1)) — the practical route for digital-therapeutic vendors to test mood-classification or relapse-prediction models against a competent authority before market launch.
The AI Act has been on the books since August 2024, but until now its mental-health relevance was abstract. On 2 August 2026 the regime acquires teeth. Any product that classifies a user's emotional state, screens applicants for "psychological resilience", flags students or employees for mental-health concern, or triages crisis-line calls is now either prohibited, high-risk, or — if it slips under Article 6(3) exceptions — must be documented as such by the provider before market entry. The era when a startup could ship an "AI therapist" into the EU on the strength of a privacy policy has ended.
What the regulation actually requires
The 2 August threshold activates the full provider checklist in Articles 8–17: a documented risk-management system across the lifecycle, data governance ensuring training datasets are "relevant, sufficiently representative and to the best extent possible free of errors", technical documentation, automated event logging, instructions enabling downstream human oversight, demonstrated accuracy/robustness/cybersecurity, and a quality-management system. For an AI mood-detection module embedded in a therapy app, this is closer to medical-device documentation than to typical SaaS hygiene. Conformity assessment is mandatory before CE-style marking; post-market monitoring is continuous; serious incidents must be reported.
The Article 5 prohibitions are categorical. An employer cannot deploy an AI tool to infer affective state from camera, voice or keystroke data in the workplace, even with consent. A university cannot use emotion AI to assess engagement in lectures. The carve-out — "medical or safety reasons" — is narrow and will be tested. A clinic-grade AI used in a psychiatric ward to monitor agitation arguably qualifies; the same product re-skinned for HR "wellbeing analytics" does not.
What changes in clinical practice
Three operational shifts for European clinicians. First, the AI tools you recommend to patients between sessions — mood trackers, journaling apps that score affect, sleep-anxiety predictors — must now carry compliance documentation if their developer falls under Annex III. Ask vendors for the conformity assessment, not just the privacy notice. Second, if your service uses an AI triage layer (chatbot intake, risk-stratification for self-referral), you have likely become a deployer of a high-risk AI system under Article 26, with your own logging, human-oversight and fundamental-rights obligations. Third, anything employer-commissioned — corporate "mental wellness" platforms with affect inference — is now legally untouchable in the workplace context: refuse to integrate clinical pathways with such tools, and document the refusal.
The RU comparison is straightforward: Russia has no analogue. Federal Law 152-FZ governs personal data, and a draft "AI experimental legal regime" framework exists, but there is no risk-tiered classification, no prohibition on workplace emotion inference, no mandatory conformity assessment, no sandbox right. EU-market vendors will diverge from RU-market vendors within 18 months — the same chatbot may be a regulated medical device in Berlin and unregulated lifestyle software in Moscow.
From 2 August 2026, an AI tool that infers emotion in the workplace or classroom is not "controversial" in the EU — it is illegal.
Enforcement capacity at the national level is uneven; many Member States have not yet designated their notified bodies for AI conformity assessment. The "medical or safety" carve-out in Article 5 will require case law to delimit. Implementation guidance for Article 6(1) — the boundary between high-risk and not — does not become applicable until 2 August 2027.