Article 15 for Biometrics: Accuracy, Robustness and Cybersecurity

Article 15 sets design requirements for the provider. It names no accuracy value for any sector.

• Art. 15(1)
  Appropriate level, throughout the lifecycle

  High-risk AI systems must be designed and developed to reach an appropriate level of accuracy, robustness and cybersecurity, and to perform consistently in those respects throughout their lifecycle.

• Art. 15(2)
  Benchmarks are for the Commission to encourage

  The Commission is to encourage, as appropriate, benchmarks and measurement methodologies, in cooperation with stakeholders such as metrology and benchmarking authorities. This is not a duty of the provider.

• Art. 15(3)
  Declare levels and metrics

  The levels of accuracy and the relevant accuracy metrics must be declared in the accompanying instructions for use.

• Art. 15(4)
  Resilience against errors, and feedback loops

  Systems must be as resilient as possible against errors, faults or inconsistencies in the system or its environment, in particular from interaction with natural persons or other systems. Technical and organisational measures must be taken; redundancy, backup or fail-safe plans are named as options. A system that keeps learning after it is placed on the market must be developed to eliminate or reduce as far as possible the risk that biased outputs influence future inputs (feedback loops).

• Art. 15(5)
  Cybersecurity against unauthorised third parties

  Systems must be resilient against attempts by unauthorised third parties to alter their use, outputs or performance by exploiting vulnerabilities. Where appropriate, the technical solutions must include measures against data poisoning, model poisoning, adversarial examples or model evasion, confidentiality attacks and model flaws.

Article 15 binds providers of high-risk AI systems only. The rows below show where biometric AI becomes high-risk.

• Biometrics is a limited area of Annex III

  Annex III has an area headed “Biometrics”, limited to points (a) to (c) and to uses permitted under relevant Union or national law (Annex III point 1). The Act has no wider biometrics regime. This site also counts the bans in Article 5(1), points (e) to (h), as biometrics.

• Annex III point 1: biometrics

  Annex III point 1 lists three kinds of AI system, in so far as their use is permitted under relevant Union or national law: (a) remote biometric identification systems, which does not include AI systems intended to be used for biometric verification the sole purpose of which is to confirm that a specific natural person is the person he or she claims to be; (b) AI systems intended to be used for biometric categorisation, according to sensitive or protected attributes or characteristics based on the inference of those attributes or characteristics; (c) AI systems intended to be used for emotion recognition. Biometric verification systems as described in point (a) are not listed in point 1. Other Annex III systems are not high-risk where Article 6(3) applies; ask counsel how its conditions combine. A system that performs profiling of natural persons is always high-risk. A provider that considers an Annex III system not high-risk must document the assessment before the system is placed on the market or put into service and register it under Article 49(2) (Article 6(4)).

• Verification is not remote identification

  Biometric verification is the automated, one-to-one verification, including authentication, of the identity of natural persons by comparing their biometric data to previously provided biometric data (Article 3(36)). A remote biometric identification system identifies natural persons, without their active involvement, typically at a distance, by comparing their biometric data with the biometric data contained in a reference database (Article 3(41)). The Act lists no product types; classify each system by these definitions and its intended purpose (Article 3(12)).

• Extra provider rules for remote identification

  Two of the provider rules specific to Annex III point 1(a) systems are these. The logging capabilities must provide at least the period of each use, the reference database against which input data was checked, the input data for which the search led to a match, and the identification of the natural persons who verified the results (Article 12(3)). The human-oversight measures must also ensure that no action or decision is taken on the basis of the identification unless two natural persons with the necessary competence, training and authority have separately verified and confirmed it; this does not apply to systems used for law enforcement, migration, border control or asylum where Union or national law considers it disproportionate (Article 14(5)).

• Provider and deployer

  The provider, for example a vendor of face-recognition software, develops the AI system, or has it developed, and places it on the market or puts it into service under its own name (Article 3(3)). A company, public authority or other body that uses a system under its authority is a deployer (Article 3(4)). A deployer becomes a provider if it puts its name or trademark on a high-risk system already on the market, makes a substantial modification that leaves the system high-risk, or changes the intended purpose of a non-high-risk system so that it becomes high-risk (Article 25(1)); contractual arrangements may allocate the obligations otherwise in the first case. The Act does not apply to the obligations of deployers who are natural persons using AI systems in the course of a purely personal non-professional activity (Article 2(10)).

• Dates

  Annex III point 1 systems must meet these duties from 2 December 2027 (Article 113, point (c)(i)). A system placed on the market or put into service before that date is covered only if its design changes significantly afterwards; in any case, providers and deployers of high-risk systems intended to be used by public authorities must take the necessary steps to comply by 2 August 2030 (Article 111(2)); this does not apply to the Annex X components mentioned next. AI systems that are components of the large-scale IT systems listed in Annex X and were placed on the market or put into service before 2 August 2027 must comply by 31 December 2030 (Article 111(1)). The bans in Article 5(1), points (e) to (h), have applied since 2 February 2025; the carve-out in Article 113, point (a) does not concern them. Articles 43 and 49 sit in Chapter III, Section 5, which Article 113 does not name in any of its points. Article 113 gives no separate date for them; ask counsel from when they bind providers of Annex III systems.

• Fines

  Breaches of provider obligations under Article 16 and of deployer obligations under Article 26 can be fined up to EUR 15 million or, if the offender is an undertaking, up to 3% of its total worldwide annual turnover in the preceding financial year, whichever is higher (Article 99(4)). For SMEs, including start-ups, each fine is up to whichever is lower (Article 99(6)); the same applies to small mid-cap enterprises (Article 3(14b), Article 99(6a)). Each Member State decides to what extent fines may be imposed on public authorities and bodies established there (Article 99(8)).

• Scope limits

  The Act does not apply to areas outside the scope of Union law (Article 2(3), first sentence). It does not apply to AI systems to the extent they are placed on the market, put into service or used, with or without modification, exclusively for military, defence or national security purposes (Article 2(3), second sentence). It does not apply to public authorities in a third country or to international organisations that use AI systems in the framework of international cooperation or agreements for law enforcement and judicial cooperation with the Union or Member States, provided that they offer adequate safeguards for the protection of fundamental rights and freedoms (Article 2(4)). It does not apply to AI systems or AI models, including their output, specifically developed and put into service for the sole purpose of scientific research and development (Article 2(6)), or to research, testing or development before a system is placed on the market or put into service; testing in real world conditions is not covered by that exclusion (Article 2(8)). It does not apply to AI systems released under free and open-source licences, unless they are placed on the market or put into service as high-risk AI systems or fall under Article 5 or 50 (Article 2(12)).

• No accuracy value or test method for biometrics

  Article 15 names no accuracy metric, minimum value, test method or standard for biometric systems or any other sector. The provider declares the levels and the relevant metrics (Article 15(3)). The technical documentation must also describe the metrics used to measure accuracy, robustness and compliance, as well as potentially discriminatory impacts (Annex IV point 2(g)).

• Presumptions of conformity

  The Act names no standard itself. Systems in conformity with harmonised standards whose references are published in the Official Journal are presumed to comply with the Section 2 requirements to the extent the standards cover them (Article 40(1)). A cybersecurity certificate or statement of conformity under Regulation (EU) 2019/881, published in the Official Journal, gives a presumption for the cybersecurity requirements of Article 15 (Article 42(2)); systems within Regulation (EU) 2024/2847 that meet its Article 12(1) are deemed to comply with them (Article 42(3)). The Commission is to develop guidelines on the application of the requirements and obligations in Articles 8 to 15 and in Articles 25 and 26 (Article 96(1), point (a)).

• Example: stating how accuracy was measured

  Example, not an Act requirement: a provider of a remote biometric identification system could state, next to each declared accuracy metric, the data and test conditions it was measured on. Article 15(3) requires only the levels and the relevant accuracy metrics.

• EU AI Act Article 15: Accuracy, Robustness and Cybersecurity

  Article 15 for all sectors: the requirements, dates and fines.

• EU AI Act Compliance for Biometrics

  The biometrics overview: how the Act reaches remote identification, biometric categorisation and emotion recognition.

• Article 17 for Biometrics: Quality Management System

  Biometric AI and Article 17: the quality management system, conformity assessment, dates and roles.

• Annex III Deep Dive: All 8 High-Risk Categories

  How Annex III makes AI systems high-risk, including biometrics.