Rules on contact center AI and monitoring records
5 rules that sit on a contact center's AI and monitoring records, read 28 October 2026.
Which record it touches
What it does
Where it applies
The rule, in its words
Each rule, answer by answer
Each row is one rule. Click an answer to see the sentence behind it, quoted from the statute or regulation page with the date we read it. Where it says "not stated", the statute or regulation page we read is silent on that question.
| Rule | Which record it touches | What it does | Where it applies | The rule, in its words |
|---|---|---|---|---|
| 16 CFR Part 314 (GLBA Safeguards Rule) | customer financial information handled by a service provider | requires safeguards and oversight | not statedNot addressed in 16 CFR Part 314 | Periodically assessing your service providers based on the risk they present and the… |
| 45 CFR 164.504 (HIPAA business associates) | customer health information handled by a business associate | requires a written contract with the provider | not statedNot addressed in 45 CFR 164.504 | Establish the permitted and required uses and disclosures of protected health information… |
| Connecticut General Statutes 31-48d | monitoring of employees calls, email or internet use | requires notice to the people concerned | Connecticut | Each employer shall post, in a conspicuous place which is readily available for viewing… |
| Delaware Code title 19, section 705 | monitoring of employees calls, email or internet use | requires notice to the people concerned | Delaware | Whoever violates this section shall be subject to a civil penalty of $100 for each such… |
| EU AI Act (Regulation 2024/1689) | emotion or sentiment readings of workers | bans the practice | the European Union | Before putting into service or using a high-risk AI system at the workplace, deployers… |
The source sentence behind every answer (20)
- 16 CFR Part 314 (GLBA Safeguards Rule), 16 CFR Part 314, read 2026-10-24, Which record it touches:
Taking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the customer information at issue
- 16 CFR Part 314 (GLBA Safeguards Rule), 16 CFR Part 314, read 2026-10-24, What it does:
Requiring your service providers by contract to implement and maintain such safeguards
- 16 CFR Part 314 (GLBA Safeguards Rule), 16 CFR Part 314, read 2026-10-24, Where it applies: No answer on the statute or regulation page, which ran to 36,888 characters when read on 2026-10-24.
- 16 CFR Part 314 (GLBA Safeguards Rule), 16 CFR Part 314, read 2026-10-24, The rule, in its words:
Periodically assessing your service providers based on the risk they present and the continued adequacy of their safeguards.
- 45 CFR 164.504 (HIPAA business associates), 45 CFR 164.504, read 2026-10-24, Which record it touches:
A contract between the covered entity and a business associate must: (i) Establish the permitted and required uses and disclosures of protected health information by the business associate.
- 45 CFR 164.504 (HIPAA business associates), 45 CFR 164.504, read 2026-10-24, What it does:
The contract may not authorize the business associate to use or further disclose the information in a manner that would violate the requirements of this subpart
- 45 CFR 164.504 (HIPAA business associates), 45 CFR 164.504, read 2026-10-24, Where it applies: No answer on the statute or regulation page, which ran to 17,294 characters when read on 2026-10-24.
- 45 CFR 164.504 (HIPAA business associates), 45 CFR 164.504, read 2026-10-24, The rule, in its words:
Establish the permitted and required uses and disclosures of protected health information by the business associate.
- Connecticut General Statutes 31-48d, General Statutes chapter 557, section 31-48d, read 2026-10-24, Which record it touches:
Employers engaged in electronic monitoring required to give prior notice to employees.
- Connecticut General Statutes 31-48d, General Statutes chapter 557, section 31-48d, read 2026-10-24, What it does:
each employer who engages in any type of electronic monitoring shall give prior written notice to all employees who may be affected, informing them of the types of monitoring which may occur
- Connecticut General Statutes 31-48d, General Statutes chapter 557, section 31-48d, read 2026-10-24, Where it applies:
including the state and any political subdivision of the state which has employees
- Connecticut General Statutes 31-48d, General Statutes chapter 557, section 31-48d, read 2026-10-24, The rule, in its words:
Each employer shall post, in a conspicuous place which is readily available for viewing by its employees, a notice concerning the types of electronic monitoring which the employer may engage in.
- Delaware Code title 19, section 705, Delaware Code title 19, chapter 7, subchapter I, read 2026-10-28, Which record it touches:
shall monitor or otherwise intercept any telephone conversation or transmission, electronic mail or transmission, or Internet access or usage of or by a Delaware employee
- Delaware Code title 19, section 705, Delaware Code title 19, chapter 7, subchapter I, read 2026-10-28, What it does:
Has first given a 1-time notice to the employee of such monitoring or intercepting activity or policies.
- Delaware Code title 19, section 705, Delaware Code title 19, chapter 7, subchapter I, read 2026-10-28, Where it applies:
with a place of business in Delaware and the State of Delaware or any agency or political subdivision thereof
- Delaware Code title 19, section 705, Delaware Code title 19, chapter 7, subchapter I, read 2026-10-28, The rule, in its words:
Whoever violates this section shall be subject to a civil penalty of $100 for each such violation.
- EU AI Act (Regulation 2024/1689), Regulation (EU) 2024/1689, Official Journal text, read 2026-10-28, Which record it touches:
the use of AI systems to infer emotions of a natural person in the areas of workplace and education institutions, except where the use of the AI system is intended to be put in place or into the market for medical or safety reasons
- EU AI Act (Regulation 2024/1689), Regulation (EU) 2024/1689, Official Journal text, read 2026-10-28, What it does:
the placing on the market, the putting into service for this specific purpose, or the use of AI systems to infer emotions of a natural person in the areas of workplace and education institutions
- EU AI Act (Regulation 2024/1689), Regulation (EU) 2024/1689, Official Journal text, read 2026-10-28, Where it applies:
in accordance with the rules and procedures laid down in Union and national law
- EU AI Act (Regulation 2024/1689), Regulation (EU) 2024/1689, Official Journal text, read 2026-10-28, The rule, in its words:
Before putting into service or using a high-risk AI system at the workplace, deployers who are employers shall inform workers’ representatives and the affected workers that they will be subject to the use of the high-risk AI system.
Not counted on this board
3 named documents fell outside what this board reads once we had read them; their reasons follow. They are tallied, never scored as answers.
- Regulation (EU) 2024/1689, the AI Act (Article 5(1)(f) emotion recognition at work, Article 26 deployers, Article 50 transparency): the box's stored read of this address is an EUR-Lex Official Journal index in several languages, not the text of Regulation 2024/1689; no article could be quoted from it
- New York Civil Rights Law 52-C (notice of electronic monitoring of employees): the stored read shows the other section numbered 52-C (sexually explicit depictions); the electronic-monitoring section is not in its text
- AI Act Explorer, Article 5 prohibited practices: a secondary navigation site for the AI Act, admitted for navigation only; the Act's text was not in the box's EUR-Lex read
How this was built
Each rule's own the EU AI Act, US state employee-monitoring statutes and federal service-provider rules were read through estate-fetch and stored whole (sha256 on every row).
For every statute or regulation page, four questions were answered from its own words: which record it touches, what it does, where it applies, the rule, in its words.
Every stated answer carries the sentence it rests on, checked against the stored text; 'not stated' means the statute or regulation page read does not address the question.
A rule with several statute and regulation pages reads 'varies' where they disagree.
5 rules, 5 statute and regulation pages.
Where we looked (8)
- Regulation (EU) 2024/1689, the AI Act (Article 5(1)(f) emotion recognition at work, Article 26 deployers, Article 50 transparency) (read, set aside)
- New York Civil Rights Law 52-C (notice of electronic monitoring of employees) (read, set aside)
- Connecticut General Statutes chapter 557 (31-48d, electronic monitoring of employees) (quoted for comment from the publisher's own the EU AI Act, US state employee-monitoring statutes and federal service-provider rules)
- 16 CFR Part 314 (GLBA Safeguards Rule: overseeing service providers) (quoted for comment from the publisher's own the EU AI Act, US state employee-monitoring statutes and federal service-provider rules)
- 45 CFR 164.504 (HIPAA business associate contracts) (quoted for comment from the publisher's own the EU AI Act, US state employee-monitoring statutes and federal service-provider rules)
- AI Act Explorer, Article 5 prohibited practices (read, set aside)
- Regulation (EU) 2024/1689, the AI Act, full text (Article 5(1)(f), Article 26, Article 50) (quoted for comment from the publisher's own the EU AI Act, US state employee-monitoring statutes and federal service-provider rules)
- Delaware Code title 19, chapter 7, subchapter I (section 705, notice of monitoring of employees) (quoted for comment from the publisher's own the EU AI Act, US state employee-monitoring statutes and federal service-provider rules)
Quote this figure or put it on your site
5 rules that sit on a contact center's AI and monitoring records, read 28 October 2026.
Which record it touches, by rule: monitoring of employees calls, email or internet use 2 of 5, customer financial information handled by a service provider 1 of 5, customer health information handled by a business associate 1 of 5, emotion or sentiment readings of workers 1 of 5 (5 rules, read 28 October 2026).
What it does, by rule: requires notice to the people concerned 2 of 5, bans the practice 1 of 5, requires a written contract with the provider 1 of 5, requires safeguards and oversight 1 of 5 (5 rules, read 28 October 2026).
Where it applies, by rule: not stated 2 of 5, Connecticut 1 of 5, Delaware 1 of 5, the European Union 1 of 5 (5 rules, read 28 October 2026).
The rule, in its words, by rule: stated 5 of 5 (5 rules, read 28 October 2026).
Credit as: "Rules on contact center AI and monitoring records", updated 2026-10-28, https://sellcontactcenterdatatoai.com/datasets/contact-center-ai-and-monitoring-law/.
CSV download (20 answers; derived 2026-10-28)