Gong and the EU AI Act: A Deployer's Compliance Guide

No. In ordinary sales use, Gong is not high-risk. For your organisation as a deployer it sits at minimal-to-limited risk, and the real exposure lives one layer down — in call-recording consent, confidentiality and a biometrics line you should not cross — not in an Annex III classification. This page maps where Gong actually lands and the small set of artefacts you owe.

---

Where Gong sits in the EU AI Act risk hierarchy

Gong is a revenue-intelligence platform. It records, transcribes and analyses sales calls and meetings, surfaces deal and pipeline insight, scores deals, and coaches representatives on talk patterns. That is a meaningfully wider footprint than plain meeting transcription — the tool is built to act on the commercial content of customer conversations, not just to produce notes.

Map that function against Annex III of Regulation (EU) 2024/1689 and you find no high-risk category in standard use. Gong does not perform recruitment or in-employment evaluation (point 4), creditworthiness assessment (point 5(b)), education scoring (point 3), or law-enforcement work (point 6). Because no Annex III function attaches, the Article 6(2) high-risk obligation stack — risk management, conformity assessment, registration — does not apply to your deployment.

Your role is settled too. Under Article 3, a company that subscribes to Gong and uses it as the provider intended is a deployer, not a provider. Gong supplies the system; you operate it. Provider obligations do not attach unless you cross the Article 25 boundary, which we return to at the end.

So the work moves elsewhere: to GDPR-grade data controls, the biometrics line, the Article 4 AI literacy duty, and a narrow Article 50 trigger that only fires where AI output reaches your customer. The tool's name does not set your tier. Your use does.

---

The biometrics line: analysing what is said is not biometric categorisation

The most common misclassification of a tool like Gong is to assume that because it processes voice audio, it processes biometric data. It does not, by default.

Transcription and text sentiment vs voiceprint identification

Annex III point 1 covers biometric identification (1(a)) and biometric categorisation (1(b)). Both turn on analysing a biometric template — a voiceprint, a face geometry — to identify a specific natural person or to sort that person into a category. The legal trigger is the template, not the audio.

Gong's standard analysis does something different. It transcribes what was said, scores talk-ratio and topics, tracks who spoke when, and runs text-based sentiment on the transcript. That is analysis of conversation content and patterns — not the construction or matching of a biometric template to identify or classify a person. It is the former, not the latter, and the former is not an Annex III biometric function.

When Gong would cross into Annex III point 1 or an Article 5 prohibition

The line would move only under a configuration Gong does not run by default: enrolling voiceprints to identify speakers biometrically (towards Annex III point 1(a)), or inferring sensitive or emotional attributes from voice. And here the stakes rise sharply, because two practices are not merely high-risk but prohibited outright. Article 5(1)(f) bans emotion recognition in the workplace (with narrow exceptions). Article 5(1)(g) bans biometric categorisation that infers sensitive attributes. Both have been in force since 2 February 2025.

The conclusion is clean. Ordinary Gong use sits on the limited-to-minimal side of the Act. The voiceprint-and-emotion edge is the thing to avoid in configuration — not the default behaviour you are buying.

---

The real exposure: call-recording consent, confidentiality and retention

This is where the practical compliance work actually lives, and it is governed by GDPR and national law — which apply before and beneath the AI Act. This is also what separates Gong from an internal meeting-transcription tool: Gong is pointed at customer calls, including outbound and cross-border ones.

GDPR lawful basis and national two-party-consent laws

Recording a sales call creates personal data, which needs a lawful basis under GDPR Article 6. Separately, recording a conversation triggers national consent and wiretapping rules that vary by Member State. Some require all-party (often called two-party) consent before a call may be recorded at all. That requirement bites hardest on outbound prospecting and cross-border customer calls, where the other party has not opted into your recording regime and may sit under a stricter national rule than your own.

Confidential and special-category content in transcripts

Sales transcripts are not neutral text. They capture commercially sensitive deal terms, third-party confidential information shared in negotiation, and — when a prospect volunteers health, financial or other sensitive detail — potentially special-category data under GDPR Article 9. You therefore need a policy on which calls are recorded and on who inside the organisation can open the resulting transcripts.

The operational controls that separate a compliant rollout from an exposed one are concrete: participant notice or consent built into the call flow; a vendor data processing agreement with defined controls and data residency; a defined retention period for recordings and transcripts; and access restrictions on sensitive content. Consent and wiretapping specifics vary by Member State and warrant local legal review — do not assume one national rule travels.

---

Article 4 AI literacy: the EU AI Act duty already binding you

Of the whole Act, one obligation already binds a Gong deployer in ordinary use: Article 4 AI literacy, in force since 2 February 2025. It requires you to ensure a sufficient, role-appropriate level of understanding among the staff who operate the system.

For Gong that means sales staff and managers should understand, at a level fit for their role, what the tool does and where it fails. Chiefly: transcripts contain transcription errors, and AI-generated deal scores, call summaries and coaching signals are probabilistic outputs, not ground truth to be acted on blindly.

Make the proportionality point plainly. Article 4 does not demand a formal training programme. A short acceptable-use note — covering accuracy limits, recording-consent rules, and how to handle confidential calls — satisfies the duty for ordinary revenue-intelligence use. In practice a deployer should produce two artefacts: the literacy and acceptable-use record, and the recording-consent policy.

---

When Article 50 transparency applies: AI output reaching the customer

Article 50 is a disclosure regime, not a conformity assessment. It requires that AI chatbots disclose they are AI, that deepfakes and synthetic media are marked as artificially generated, and that generative-AI providers mark their outputs in a machine-readable way.

Most Gong use does not engage it. Internal rep coaching and pipeline analytics — analysis of recorded calls for your own teams — is neither a customer-facing chatbot nor synthetic-media generation, so Article 50 stays dormant.

The trigger to watch is narrow but real: where a Gong generative feature drafts customer-facing email or text, or powers a customer-facing conversational interface, the Article 50(1) chatbot disclosure and the Article 50(2) generated-content considerations can become relevant.

Note the timeline. Article 50 content-marking duties take effect 2 December 2026 under the Digital Omnibus, adopted by the European Parliament (16 June 2026) and the Council (29 June 2026), entering into force on Official Journal publication expected before 2 August 2026.

---

Gong obligation map by use case

The principle is that the tier rises with the use, not the tool's name. Across realistic rows Gong stays minimal or limited; the variable that moves is the data-and-consent layer beneath the Act.

---

Worked example: a 400-person SaaS sales org rolling out Gong

Lattigo Software, a 400-person B2B SaaS company, deploys Gong across its EU and cross-border sales teams. Its compliance lead works the classification before anything else.

There is no Annex III function in Lattigo's use, and no voiceprint biometric analysis is switched on, so the AI Act tier is minimal-to-limited. The live issues are recording consent for outbound customer calls, confidentiality of deal-stage commercial data, and retention of transcripts — all data-layer questions, not high-risk ones.

The deployer to-do list is short and concrete:

• Establish a lawful basis and participant notice or consent under GDPR Article 6 for recording calls.
• Sign a vendor data processing agreement with defined controls and data residency.
• Set policy on which calls are recorded and who may access transcripts.
• Write a one-page Article 4 literacy and acceptable-use note.
• Define and enforce a transcript retention period.
• Check the Article 50 disclosure point if any generative feature drafts customer-facing messages.

The closing question is the Article 25 boundary. Lattigo using Gong as delivered stays a deployer. It would become a provider only by putting its own trademark on the system's output, substantially modifying the system, or repurposing it into a high-risk use — none of which is happening here.

---

How Confir helps

Add Gong to your AI register and Confir's classification engine runs the checks in order. It applies the Article 5 prohibited-practice test first — the voiceprint and workplace-emotion edge — then the Article 6 and Annex III scoping. For ordinary revenue intelligence it confirms the limited-to-minimal tier and surfaces the controls that actually matter: the GDPR consent, confidentiality and retention obligations, and the Article 4 literacy record.

The engine is deterministic and rule-based — no model inference, no hallucination. The same intake produces the same finding every time, and the rule that fired is written in plain language any reviewer can check.

The dates that bind a Gong deployer are few. Article 4 literacy and the Article 5 prohibitions have both been in force since 2 February 2025 (the prohibitions matter only at the voiceprint-and-emotion edge). Article 50 content-marking is set for 2 December 2026 under the Digital Omnibus, adopted by the European Parliament and the Council in June 2026.

The penalty tiers, exactly: prohibited practices carry fines up to €35 million or 7% of total worldwide annual turnover, whichever is higher (Article 99(3)); most deployer and transparency breaches up to €15 million or 3% (Article 99(4)); supplying incorrect or incomplete information to authorities up to €7.5 million or 1% (Article 99(5)). Under Article 99(6), fines for SMEs and start-ups are capped at the lower of the percentage or the fixed amount. GDPR penalties for consent and confidentiality failures apply separately and on their own track.

---

Related guides

• add Gong to your AI system inventory
• classifying meeting-transcription tools by use, not name
• what counts as biometric data
• limited-risk classification under the EU AI Act
• Article 50 transparency duties explained