Cameras and the works council: what the CNIL allows, what the AI Act changes in 2026, what Camly refuses
A safety tool on existing cameras goes in front of the works council. Here is the CNIL framework, what the EU AI regulation requires since August 2026, and our design choices.
The first question an HSE manager asks when you mention artificial intelligence on their cameras is not technical. It is: “Will the works council accept it?” The answer depends on what the tool does, what it refuses to do, and how it is presented. This post summarises the framework as we understand it and the choices we made. It is not legal advice; your legal department and your data protection officer remain the right people to ask.
What the CNIL’s “cameras at work” doctrine requires
The CNIL, the French data protection authority, has long regulated video surveillance in companies, and its doctrine comes down to a few principles that any project must be able to demonstrate.1
- A precise and proportionate purpose: safety of people and property, risk prevention. No general monitoring of employees.
- No permanent monitoring of a workstation, except in duly justified special circumstances.
- Information of staff and, in companies that have one, information and consultation of the works council (CSE) before deployment.
- A limited retention period for images, proportionate to the purpose.
- Restricted access to the images, and access rights for the people filmed.
Nothing in this doctrine forbids analysing images to check that an emergency exit is clear. What is forbidden is using them to measure an employee’s activity. That is where the line is, and it is a clear one.
The precedent: Amazon France Logistique, 32 million euros
By a deliberation of 27 December 2023, the CNIL fined Amazon France Logistique 32 million euros for an activity monitoring system judged excessive in its warehouses.1 The case was about scanners, not cameras; it nevertheless set the spirit in which the CNIL reads any measurement system in a warehouse: the stated purpose must be kept, and individual, continuous, minute-by-minute measurement does not pass.
For a vendor the lesson is simple. A tool that could reconstruct a person’s activity, even if it does not do so today, is a tool you will have to defend. A tool that cannot, by construction, defends itself.
What the EU AI regulation changes since August 2026
Regulation (EU) 2024/1689, the AI Act, classifies as high-risk, in Annex III point 4, systems intended to monitor and evaluate the behaviour of persons in a work relationship. The corresponding obligations apply since 2 August 2026.2 Emotion recognition in the workplace is among the prohibited practices, and prohibited practices carry fines of up to 35 million euros or 7% of turnover.2
For a warehouse this means that the question “what does this system know about my employees?” is no longer only a question of trust. It is a question of regulatory classification. A system that monitors places and situations is not a system that evaluates the behaviour of persons. Keeping that boundary intact is the most important design decision we have taken.
What Camly refuses by design
| What Camly does | What Camly does not do |
|---|---|
| Periodically checks states described in plain language on zones of existing cameras | No facial recognition, no biometrics, no identification |
| Tracks each situation as an episode with a start, an end and a duration | No tracking of a person, no individual indicator |
| Keeps an evidence image, people blurred by default | No unblurred image in the history |
| Answers questions about a zone or a situation | Refuses by design any question about an employee |
| Exports zone-level data (task, zone, camera, time, duration, description) | Never exports an operator identifier, a badge or a plate, nothing joinable to per-operator WMS records |
Contractually, the client is the data controller and Camly the processor, with the Article 28 GDPR annex. The tool is designed in line with the CNIL “cameras at work” doctrine and with the EU AI regulation.3
The works council pack, and the offer to present it with you
Every deployment comes with a works council information pack: an information note for staff, an impact assessment template, and a description of the method (which zones, which states, how often, who sees what, how long it is kept).3 The monthly report for the works council contains only findings per zone; it contains no data that could lead back to a person.
We also offer to present the system to the works council together with the HSE manager. This is not a formality: it is often the meeting that decides the project, and it is where the fairest questions get asked. “Who looks at the images?”, “What happens if I am in the picture?”, “Is this used to evaluate us?” Our answers fit in one line each, and they can be verified in the product.
Where to start
Before talking technology, list the three situations you want to monitor and the zones concerned. If each can be described without naming a person, the works council file almost writes itself. If one of them cannot, it is not a case for Camly, and we will tell you so.
Sources
- CNIL, “cameras at work” doctrine and deliberation of 27 December 2023 (Amazon France Logistique, €32M). cnil.fr
- Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence, Annex III point 4, application timetable and penalties. eur-lex.europa.eu
- Camly AI, market-fit study, French warehouses, October 2026, and works council information pack.