EU AI Act for Biometric AI Systems
For biometric AI providers and deployers: Annex III point 1 covers identification, categorisation and emotion recognition; some uses are banned.
Check Article 5 first, then Annex III point 1
Annex III point 1 covers remote biometric identification (1(a)), categorisation by sensitive attributes (1(b)) and emotion recognition (1(c)). Point 1(a) excludes one-to-one verification. Article 5 has prohibited some biometric practices since 2 February 2025. The high-risk rules apply from 2 December 2027. Next step: map each system to point 1(a), 1(b) or 1(c).
What lands on biometric AI providers and deployers
Some biometric practices are prohibited
Article 5(1) prohibits untargeted scraping of facial images to build databases (e) and inferring emotions at work and in education (f). It also prohibits categorising people by sensitive traits (g) and real-time remote identification for law enforcement (h). Each point has conditions or exceptions.
High-risk biometric systems
Providers meet Articles 8 to 15 from 2 December 2027. For point 1(a) systems, the logs record each use, the reference database and the input data that led to a match (Article 12(3)). Two people verify an identification before anyone acts on it, with exceptions (Article 14(5)).
Verification is not point 1(a)
One-to-one verification, such as unlocking a device, is outside point 1(a) (Article 3(36) defines it). Such a system is high-risk only if another point of Annex III or Annex I covers it.
What Scanara supports for biometric AI
Prohibited-practice screening
A guided Article 5 screening runs for each registered system, and code rules flag detectable patterns. Code cannot show purpose or context, so your team decides, with counsel for borderline cases.
Inventory with recorded classification
You register each AI system. Scanara records its risk classification and your reasoning on point 1(a), 1(b) or 1(c). You make the decision.
Code and document checks
Code rules cover Articles 9, 10, 12, 14 and 15. Document scans check Articles 11 and 13 content. Scanara scans code and documents; it does not test model accuracy or measure bias on your data.
Draft documentation and declaration
Scanara generates drafts of the Annex IV technical documentation and the EU declaration of conformity from your inputs. It prepares evidence; it is not a notified body and does not certify.
Two fine ceilings to know
EUR 35 million or 7%
Fine ceiling for Article 5 breaches: up to EUR 35 million or, for an undertaking, up to 7% of worldwide annual turnover, whichever is higher (Article 99(3)).
EUR 15 million or 3%
Fine ceiling for breaches of provider and deployer duties: up to EUR 15 million or, for an undertaking, up to 3% of worldwide annual turnover, whichever is higher (Article 99(4)). For SMEs and small mid-caps the lower amount is the cap (Article 99(6) and (6a)).
Questions biometric AI teams ask
Is facial recognition prohibited?
Not as such. Article 5(1)(h) prohibits real-time remote biometric identification in publicly accessible spaces for law enforcement, unless strictly necessary for one of three objectives. Article 5(1)(e) prohibits untargeted scraping of facial images to build databases. Other remote identification is listed in Annex III point 1(a), and GDPR Article 9 applies to biometric data.
Is one-to-one verification high-risk?
Not through Annex III point 1(a), which excludes systems whose sole purpose is to confirm that a specific person is who they claim to be. Such a system is high-risk only if another point of Annex III or Annex I covers it (Article 6).
Does the ban on biometric categorisation apply to businesses?
Yes. Article 5(1)(g) prohibits categorising people by biometric data to infer race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation. It does not cover labelling or filtering of lawfully acquired biometric datasets or categorisation in law enforcement.
Which dates apply?
Article 5 applies since 2 February 2025. The high-risk requirements for Annex III systems apply from 2 December 2027 (Article 113(c)(i)). A system placed on the market or put into service earlier is covered only after significant design changes (Article 111(2)).
Can Scanara tell me whether my biometric system is prohibited?
No. Scanara runs a guided Article 5 screening and flags detectable code patterns. Your team decides, with counsel for borderline cases, because code alone cannot show purpose or context.
Read next
See a sample scan report
The demo shows a real, anonymised compliance report and the product walkthrough.
Scanara prepares evidence from your repositories
Scanara reads your connected GitHub repositories and runs rule-based scans for standard AI and machine-learning patterns. It can miss non-standard code. Separately, it generates draft documentation from templates and your assessment answers as evidence for your compliance work. You make the classification decisions.