What the EU AI Act Means for Researchers Who Use AI Transcription

But 2026 is a different regulatory environment to the one most research teams set their workflows up in. The EU AI Act entered its first compliance phase in February 2025, and supervisory authorities across Europe have begun issuing targeted guidance on exactly the kinds of tools researchers use every day. Two of the most instructive examples came in early 2026: Spain's data protection authority, the AEPD, published detailed guidance on AI voice transcription in January and April; and Sweden's IMY released a sandbox report examining AI transcription in a public sector context in April.

Neither report concluded that AI transcription is impermissible. Both made it clear that the bar for responsible use is higher than many organisations currently meet.

This article is for research teams, ethics committees, data protection officers, and research managers who want a practical understanding of what these regulatory developments require, and how to continue using AI transcription in a way that holds up to scrutiny.

The EU AI Act: What Researchers Actually Need to Know

The EU AI Act (Regulation (EU) 2024/1689) classifies AI systems by risk level. Unacceptable-risk systems are prohibited outright. High-risk systems face conformity assessments and registration requirements. For most research applications, standard AI transcription software falls outside the high-risk categories. Pure speech-to-text conversion is not classified as high-risk.

The exception matters, though. AI systems that infer sensitive characteristics from voice, including health status, emotional state, or biometric identifiers, may qualify as high-risk under Annex III. Tools that include emotion detection or sentiment scoring sit in a different legal position to tools that simply produce text. Know what your transcription tool does beyond transcription.

The other misconception worth clearing up: the EU AI Act does not replace GDPR. The AEPD made this explicit in its April 2026 guidance. Both regimes must be assessed independently. A tool that avoids the high-risk AI classifications can still carry significant GDPR obligations. And where transcription vendors reuse voice data or transcripts to retrain their AI models, the AEPD noted that the entity performing that retraining typically becomes a separate data controller with its own legal basis requirements. Researchers who select vendors that train on client data may unknowingly create a compliance gap, even if the transcription itself is technically lawful.

GDPR Still Matters More Than Many Researchers Realize

GDPR remains the primary compliance framework for research data protection in Europe, and in the context of transcription it carries obligations that many research teams have not fully addressed.

A person's voice is personal data. Related metadata, including connection information, session identifiers, and timestamps, is also personal data. Where recordings involve health status, ethnicity, political opinions, religious beliefs, or other special category information, as many research interviews do, Article 9 of GDPR applies. Processing special category data requires an explicit legal basis and carries additional obligations around necessity, proportionality, and security.

Researchers often assume that participant consent covers everything. It does not, at least not automatically. The AEPD's guidance was specific: consent must be specific to each recording session and must be informed, which means participants need to be told what the recording will be used for, who may have access to it (including any third-party transcription vendors), whether the data will be used for anything beyond the stated purpose, and how they can exercise their rights of access and correction.

Transcripts are not neutral documents. An automated transcript that incorrectly attributes a statement to the wrong speaker, or that misquotes a participant, is a data accuracy problem under GDPR Article 5. Controllers are required to correct inaccuracies without undue delay under Article 16. This is not theoretical. In research settings, an incorrect attribution in a transcript can affect how a participant's data is analysed and reported

ad

For research teams handling sensitive topics, vulnerable participants, or data that may be subject to ethics review, GDPR-compliant transcription workflows should be documented, not assumed.

What European Regulators Are Saying About AI Transcription

Two pieces of regulatory guidance published in early 2026 deserve attention from research teams. Taken together, they sketch a picture of where European regulators expect the bar to be.

Spain's AEPD

The AEPD published two guidance documents on AI voice transcription: one in January 2026 addressing legal bases and special category data risks, and a second in April 2026 covering accountability, rights, and transparency. Both are legally significant, not as enforcement decisions, but as interpretive positions from a national supervisory authority that other European regulators are likely to follow.

The core message is that AI transcription should be treated as a processing activity requiring continuous governance, not a technical convenience. Researchers and institutions that use AI transcription tools are controllers. They cannot delegate compliance to the vendor.

The AEPD identified several specific expectations. Controllers must conduct due diligence when selecting transcription vendors, including assessing whether the vendor uses voice data or transcripts for model training, who may have human access to recordings for quality assurance purposes, where data is stored and processed, and what retention and deletion policies apply. This due diligence is not a one-time checkbox; it is an ongoing obligation throughout the tool's lifecycle.

The guidance also addressed a scenario that research teams often overlook: the right of access in multi-speaker recordings. Participants have the right to access their personal data under Article 15 GDPR, even where a recording also contains third-party data. The AEPD noted that access cannot be refused simply because other people appear in the recording. Where necessary, partial masking or anonymisation should be used to protect others while still honouring the data subject's rights.

Sweden's IMY

Sweden's supervisory authority, IMY, published its sandbox report "Transkribering inom socialtjänsten" (Transcription in Social Services) in April 2026. The report examined whether AI-based transcription and summarisation can be used lawfully in a public sector context where conversations regularly contain sensitive personal data, a situation analogous to many research settings.

IMY's conclusion was that there is a legal basis for AI transcription even of sensitive data, provided the use is genuinely necessary and proportionate. The authority applied a nuanced understanding of necessity: processing can be lawful even if the underlying task could theoretically be completed without it, provided the AI tool offers real and demonstrable efficiency gains that could not be achieved by less intrusive means.

But IMY attached conditions. Human oversight of AI-generated transcripts and summaries was not presented as a best practice. It was described as a requirement. Staff must be able to review and correct AI outputs before they are used. IMY specifically flagged the risk of automation bias, where insufficient AI literacy or organisational pressure leads staff to accept AI outputs without adequate scrutiny. The authority identified this as a source of potential errors with serious consequences, particularly where transcripts or summaries inform decisions about individuals.

The IMY report also set out concrete technical and organisational requirements: data must be encrypted in transit and at rest; access must be controlled through role-based permissions limited to those with a genuine need; logging must be in place so that access to sensitive material can be audited; and data that is no longer needed must be deleted according to documented retention policies.

For academic and qualitative researchers handling interview data, these expectations are directly transferable.

The Hidden Risks of AI-Generated Transcripts and Summaries

Most researchers who work with AI transcription are familiar with accuracy issues in passing: a misheard word, a speaker attribution error. What the regulatory guidance treats more seriously is the cumulative effect of those errors when transcripts and summaries are not reviewed before use.

The known failure modes are worth naming directly. Speaker attribution errors in multi-speaker recordings are common; a participant's words end up logged under a different speaker label, which can distort analysis in ways that are hard to detect later. Hallucination, where the system generates plausible text that was not in the original recording, is rare but more likely with poor audio. Domain-specific terminology is frequently mangled. And AI-generated summaries carry more downstream risk than transcript errors, because the compression itself involves inference and errors are harder to locate.

For qualitative research transcription, the AEPD said these limitations are known, and that controllers must manage them proactively rather than correcting errors after the fact. That means telling users what the system cannot reliably do, and building review into the workflow before transcripts enter analysis.

Human Oversight Is Becoming a Regulatory Expectation

Both the AEPD and IMY guidance converge on the same point: human review of AI-generated transcripts and summaries is not optional for research or public sector organisations. It is an expected component of responsible use.

This matters because the practical workflow in many research teams has drifted toward treating AI drafts as finished documents. Time pressure is real; transcription is often viewed as a preparatory task rather than an analytical one. But regulators are drawing a line between using AI to generate a draft and relying on that draft without verification.

IMY's language was direct. Automation bias, defined as insufficient critical assessment of AI outputs due to overconfidence in the system or inadequate AI literacy, was identified as a risk that organisations must address through training, time allocation, and clear internal procedures. The report noted that social workers using the tested transcription system must have not just the theoretical ability to review transcripts, but the practical time and organisational support to do so.

For research teams, the equivalent is straightforward: whoever is responsible for the transcript needs to read it against the recording, not just skim it for obvious errors. Where AI-generated summaries are being used to inform analysis, those summaries need to be verified before they are treated as data.

The AEPD added that controllers must proactively put in place mechanisms to prevent, detect, and correct inaccuracies, including explaining the system's known limitations to all users and maintaining clear correction procedures.

When Human Transcription May Be the Better Choice

AI transcription suits many research workflows. But there are contexts where professional human transcription is the more appropriate choice on both accuracy and compliance grounds.

Consider it when: recordings involve vulnerable participants (children, people with cognitive disabilities, individuals in mental health settings); the content is sensitive or legally significant; audio quality is poor; the methodology requires verbatim notation with pauses and prosodic features, as in conversation or discourse analysis; the project involves complex multi-speaker recordings where AI speaker attribution is unreliable; or your institution or ethics committee requires it for the study type. Some academic transcription frameworks specify human transcription for certain categories of research regardless of researcher preference.

Conclusion

The EU AI Act does not prohibit AI transcription for research. That is the short answer, and it is worth being direct about it because the regulatory landscape can feel more alarming than the practical situation warrants.

The longer answer is that 2026 represents a genuine shift in expectations. European supervisory authorities, through guidance documents from the AEPD and sandbox findings from IMY, have set out a clear picture of what responsible AI transcription use requires: vendor due diligence, documented workflows, human review of AI outputs before use, encryption and access controls, clear retention policies, and meaningful participant transparency.

Research teams that have been using AI transcription informally, treating it as a technical convenience rather than a data processing activity, may need to revisit their practices. The regulatory guidance is not retrospective enforcement; it is an opportunity to bring workflows into line with what the rules now expect.

For most European research teams, that means a combination of the right vendor, documented processes, and a genuine commitment to human oversight. It does not mean abandoning AI transcription. It means using it responsibly.

FAQs

Does the EU AI Act ban AI transcription for research?

No. Standard AI transcription, converting speech to text without additional inference, is not classified as a high-risk AI system under the EU AI Act. Researchers can continue to use AI transcription tools, but they must do so within GDPR requirements, which remain the primary compliance framework for personal data processing in Europe.

Does GDPR apply to research interview recordings?

Yes. Recordings of identifiable individuals are personal data. Transcripts derived from those recordings are also personal data. Where recordings contain information about health, ethnicity, political opinions, or other special categories, GDPR Article 9 applies and requires an appropriate legal basis and additional safeguards.

What did the Spanish AEPD guidance say about AI transcription?The AEPD published two guidance documents in 2026 confirming that organisations using AI transcription tools act as data controllers and cannot delegate GDPR compliance to vendors. Key requirements include ongoing vendor due diligence, specific and informed consent for each recording session, proactive measures to detect and correct transcript errors, and effective processes for responding to data subject rights requests.

What did Sweden's IMY sandbox report conclude about AI transcription?

IMY concluded that AI transcription can be lawful under GDPR, including for sensitive data, where genuine necessity and proportionality can be demonstrated. The authority attached conditions: human review of AI-generated outputs before use, encryption and access controls, role-based permissions, audit logging, and documented retention and deletion policies. IMY specifically identified automation bias as a risk that organisations must address through training and organisational design.

When should researchers choose human transcription over AI?

Human transcription is generally the better choice when recordings involve vulnerable participants, sensitive or legally significant content, poor audio quality, verbatim accuracy requirements for methodology-specific notation, or complex multi-speaker discussions such as focus groups. Some institutional ethics frameworks require human transcription for certain study types regardless of preference.