# Rules on contact center AI and monitoring records

> 5 rules that sit on a contact center's AI and monitoring records, read 28 October 2026.

Sell Contact Center Data to AI · https://sellcontactcenterdatatoai.com/datasets/contact-center-ai-and-monitoring-law/ · computed 2026-10-28

**Rules on the register:** 5 rules (5 statute and regulation pages read; 8 named).

## The answers, question by question

- **Which record it touches:** monitoring of employees calls, email or internet use 2, customer financial information handled by a service provider 1, customer health information handled by a business associate 1, emotion or sentiment readings of workers 1
- **What it does:** requires notice to the people concerned 2, requires safeguards and oversight 1, requires a written contract with the provider 1, bans the practice 1
- **Where it applies:** not stated 2, Connecticut 1, Delaware 1, the European Union 1
- **The rule, in its words:** stated 5

## Every rule

| Rule | Which record it touches | What it does | Where it applies | The rule, in its words |
|---|---|---|---|---|
| 16 CFR Part 314 (GLBA Safeguards Rule) | customer financial information handled by a service provider | requires safeguards and oversight | not stated | Periodically assessing your service providers based on the risk they present and the… |
| 45 CFR 164.504 (HIPAA business associates) | customer health information handled by a business associate | requires a written contract with the provider | not stated | Establish the permitted and required uses and disclosures of protected health information… |
| Connecticut General Statutes 31-48d | monitoring of employees calls, email or internet use | requires notice to the people concerned | Connecticut | Each employer shall post, in a conspicuous place which is readily available for viewing… |
| Delaware Code title 19, section 705 | monitoring of employees calls, email or internet use | requires notice to the people concerned | Delaware | Whoever violates this section shall be subject to a civil penalty of $100 for each such… |
| EU AI Act (Regulation 2024/1689) | emotion or sentiment readings of workers | bans the practice | the European Union | Before putting into service or using a high-risk AI system at the workplace, deployers… |

## The sentence each answer rests on (20)

- 16 CFR Part 314 (GLBA Safeguards Rule), [16 CFR Part 314](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314), read 2026-10-24, Which record it touches: "Taking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the customer information at issue"
- 16 CFR Part 314 (GLBA Safeguards Rule), [16 CFR Part 314](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314), read 2026-10-24, What it does: "Requiring your service providers by contract to implement and maintain such safeguards"
- 16 CFR Part 314 (GLBA Safeguards Rule), [16 CFR Part 314](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314), read 2026-10-24, Where it applies: No answer on the statute or regulation page, which ran to 36,888 characters when read on 2026-10-24.
- 16 CFR Part 314 (GLBA Safeguards Rule), [16 CFR Part 314](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314), read 2026-10-24, The rule, in its words: "Periodically assessing your service providers based on the risk they present and the continued adequacy of their safeguards."
- 45 CFR 164.504 (HIPAA business associates), [45 CFR 164.504](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.504), read 2026-10-24, Which record it touches: "A contract between the covered entity and a business associate must: (i) Establish the permitted and required uses and disclosures of protected health information by the business associate."
- 45 CFR 164.504 (HIPAA business associates), [45 CFR 164.504](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.504), read 2026-10-24, What it does: "The contract may not authorize the business associate to use or further disclose the information in a manner that would violate the requirements of this subpart"
- 45 CFR 164.504 (HIPAA business associates), [45 CFR 164.504](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.504), read 2026-10-24, Where it applies: No answer on the statute or regulation page, which ran to 17,294 characters when read on 2026-10-24.
- 45 CFR 164.504 (HIPAA business associates), [45 CFR 164.504](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.504), read 2026-10-24, The rule, in its words: "Establish the permitted and required uses and disclosures of protected health information by the business associate."
- Connecticut General Statutes 31-48d, [General Statutes chapter 557, section 31-48d](https://www.cga.ct.gov/current/pub/chap_557.htm), read 2026-10-24, Which record it touches: "Employers engaged in electronic monitoring required to give prior notice to employees."
- Connecticut General Statutes 31-48d, [General Statutes chapter 557, section 31-48d](https://www.cga.ct.gov/current/pub/chap_557.htm), read 2026-10-24, What it does: "each employer who engages in any type of electronic monitoring shall give prior written notice to all employees who may be affected, informing them of the types of monitoring which may occur"
- Connecticut General Statutes 31-48d, [General Statutes chapter 557, section 31-48d](https://www.cga.ct.gov/current/pub/chap_557.htm), read 2026-10-24, Where it applies: "including the state and any political subdivision of the state which has employees"
- Connecticut General Statutes 31-48d, [General Statutes chapter 557, section 31-48d](https://www.cga.ct.gov/current/pub/chap_557.htm), read 2026-10-24, The rule, in its words: "Each employer shall post, in a conspicuous place which is readily available for viewing by its employees, a notice concerning the types of electronic monitoring which the employer may engage in."
- Delaware Code title 19, section 705, [Delaware Code title 19, chapter 7, subchapter I](https://delcode.delaware.gov/title19/c007/sc01/index.html), read 2026-10-28, Which record it touches: "shall monitor or otherwise intercept any telephone conversation or transmission, electronic mail or transmission, or Internet access or usage of or by a Delaware employee"
- Delaware Code title 19, section 705, [Delaware Code title 19, chapter 7, subchapter I](https://delcode.delaware.gov/title19/c007/sc01/index.html), read 2026-10-28, What it does: "Has first given a 1-time notice to the employee of such monitoring or intercepting activity or policies."
- Delaware Code title 19, section 705, [Delaware Code title 19, chapter 7, subchapter I](https://delcode.delaware.gov/title19/c007/sc01/index.html), read 2026-10-28, Where it applies: "with a place of business in Delaware and the State of Delaware or any agency or political subdivision thereof"
- Delaware Code title 19, section 705, [Delaware Code title 19, chapter 7, subchapter I](https://delcode.delaware.gov/title19/c007/sc01/index.html), read 2026-10-28, The rule, in its words: "Whoever violates this section shall be subject to a civil penalty of $100 for each such violation."
- EU AI Act (Regulation 2024/1689), [Regulation (EU) 2024/1689, Official Journal text](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R1689), read 2026-10-28, Which record it touches: "the use of AI systems to infer emotions of a natural person in the areas of workplace and education institutions, except where the use of the AI system is intended to be put in place or into the market for medical or safety reasons"
- EU AI Act (Regulation 2024/1689), [Regulation (EU) 2024/1689, Official Journal text](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R1689), read 2026-10-28, What it does: "the placing on the market, the putting into service for this specific purpose, or the use of AI systems to infer emotions of a natural person in the areas of workplace and education institutions"
- EU AI Act (Regulation 2024/1689), [Regulation (EU) 2024/1689, Official Journal text](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R1689), read 2026-10-28, Where it applies: "in accordance with the rules and procedures laid down in Union and national law"
- EU AI Act (Regulation 2024/1689), [Regulation (EU) 2024/1689, Official Journal text](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R1689), read 2026-10-28, The rule, in its words: "Before putting into service or using a high-risk AI system at the workplace, deployers who are employers shall inform workers’ representatives and the affected workers that they will be subject to the use of the high-risk AI system."

## Read and set aside

- [Regulation (EU) 2024/1689, the AI Act (Article 5(1)(f) emotion recognition at work, Article 26 deployers, Article 50 transparency)](https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng): the box's stored read of this address is an EUR-Lex Official Journal index in several languages, not the text of Regulation 2024/1689; no article could be quoted from it
- [New York Civil Rights Law 52-C (notice of electronic monitoring of employees)](https://www.nysenate.gov/legislation/laws/CVR/52-C): the stored read shows the other section numbered 52-C (sexually explicit depictions); the electronic-monitoring section is not in its text
- [AI Act Explorer, Article 5 prohibited practices](https://artificialintelligenceact.eu/article/5/): a secondary navigation site for the AI Act, admitted for navigation only; the Act's text was not in the box's EUR-Lex read

## Methodology

Each rule's own the EU AI Act, US state employee-monitoring statutes and federal service-provider rules were read through estate-fetch and stored whole (sha256 on every row). For every statute or regulation page, four questions were answered from its own words: which record it touches, what it does, where it applies, the rule, in its words. Every stated answer carries the sentence it rests on, checked against the stored text; 'not stated' means the statute or regulation page read does not address the question. A rule with several statute and regulation pages reads 'varies' where they disagree. 5 rules, 5 statute and regulation pages.

## Sources

- [Regulation (EU) 2024/1689, the AI Act (Article 5(1)(f) emotion recognition at work, Article 26 deployers, Article 50 transparency)](https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng) (not-terms)
- [New York Civil Rights Law 52-C (notice of electronic monitoring of employees)](https://www.nysenate.gov/legislation/laws/CVR/52-C) (not-terms)
- [Connecticut General Statutes chapter 557 (31-48d, electronic monitoring of employees)](https://www.cga.ct.gov/current/pub/chap_557.htm) (read)
- [16 CFR Part 314 (GLBA Safeguards Rule: overseeing service providers)](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314) (read)
- [45 CFR 164.504 (HIPAA business associate contracts)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.504) (read)
- [AI Act Explorer, Article 5 prohibited practices](https://artificialintelligenceact.eu/article/5/) (not-terms)
- [Regulation (EU) 2024/1689, the AI Act, full text (Article 5(1)(f), Article 26, Article 50)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R1689) (read)
- [Delaware Code title 19, chapter 7, subchapter I (section 705, notice of monitoring of employees)](https://delcode.delaware.gov/title19/c007/sc01/index.html) (read)

## Cite or embed

- 5 rules that sit on a contact center's AI and monitoring records, read 28 October 2026.
- Which record it touches, by rule: monitoring of employees calls, email or internet use 2 of 5, customer financial information handled by a service provider 1 of 5, customer health information handled by a business associate 1 of 5, emotion or sentiment readings of workers 1 of 5 (5 rules, read 28 October 2026).
- What it does, by rule: requires notice to the people concerned 2 of 5, bans the practice 1 of 5, requires a written contract with the provider 1 of 5, requires safeguards and oversight 1 of 5 (5 rules, read 28 October 2026).
- Where it applies, by rule: not stated 2 of 5, Connecticut 1 of 5, Delaware 1 of 5, the European Union 1 of 5 (5 rules, read 28 October 2026).
- The rule, in its words, by rule: stated 5 of 5 (5 rules, read 28 October 2026).

Cite as: "Rules on contact center AI and monitoring records", updated 2026-10-28, https://sellcontactcenterdatatoai.com/datasets/contact-center-ai-and-monitoring-law/.

CSV: https://sellcontactcenterdatatoai.com/datasets/contact-center-ai-and-monitoring-law.csv
JSON: https://sellcontactcenterdatatoai.com/datasets/contact-center-ai-and-monitoring-law.json
Embed (plain HTML, static link back): see https://sellcontactcenterdatatoai.com/datasets/contact-center-ai-and-monitoring-law/#lead