EU AI Act Compliance for Biometrics

Annex III point 1 covers biometrics in so far as its use is permitted under relevant Union or national law. This site’s word “biometrics” maps to the hooks below.

• Point 1(a): remote biometric identification systems

  A remote biometric identification system identifies natural persons without their active involvement, typically at a distance, by comparing a person’s biometric data with the biometric data in a reference database (Article 3(41)). Annex III lists these systems without separating real-time from post-remote identification (Article 3(42), Article 3(43)).

• Verification is excluded from point 1(a)

  Point 1(a) does not include AI systems intended to be used for biometric verification the sole purpose of which is to confirm that a specific natural person is the person he or she claims to be. Biometric verification is automated one-to-one verification, including authentication, by comparing biometric data to previously provided biometric data (Article 3(36)). Such a system is high-risk only if another point of Annex III or Annex I covers it.

• Point 1(b): categorisation by sensitive or protected attributes

  AI systems intended to be used for biometric categorisation, according to sensitive or protected attributes or characteristics based on the inference of those attributes or characteristics. A biometric categorisation system assigns natural persons to specific categories on the basis of their biometric data, unless it is ancillary to another commercial service and strictly necessary for objective technical reasons (Article 3(40)). Article 5(1), point (g) prohibits some categorisation (see below).

• Point 1(c): emotion recognition

  AI systems intended to be used for emotion recognition. An emotion recognition system is an AI system for the purpose of identifying or inferring emotions or intentions of natural persons on the basis of their biometric data (Article 3(39)). Article 5(1), point (f) prohibits inferring emotions in the workplace and in education institutions, except for medical or safety reasons (see below).

• Points 6 and 7: other public-authority uses

  Annex III point 7(d) covers AI systems used by or on behalf of competent public authorities, or by Union institutions, bodies, offices or agencies, in the context of migration, asylum or border control management, for the purpose of detecting, recognising or identifying natural persons, with the exception of the verification of travel documents. Point 6 lists law-enforcement uses; see the law enforcement overview. Registration of systems under points 1, 6 and 7 in these areas is in a secure non-public section of the EU database (Article 49(4)).

• Real-time, post-remote and law enforcement

  A ‘real-time’ remote biometric identification system is one where capturing biometric data, comparison and identification all occur without a significant delay, including limited short delays to avoid circumvention (Article 3(42)). A post-remote system is any other remote biometric identification system (Article 3(43)). ‘Law enforcement’ means activities carried out by law enforcement authorities or on their behalf for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including safeguarding against and preventing threats to public security (Article 3(46)). A law enforcement authority is a public authority competent for those tasks, or any other body or entity entrusted by Member State law to exercise public authority and public powers for them (Article 3(45)). A ‘publicly accessible space’ is any publicly or privately owned physical place accessible to an undetermined number of natural persons, regardless of whether certain conditions for access may apply (Article 3(44)).

Points (e) to (h) of Article 5(1) have applied since 2 February 2025 (Article 113, point (a)). Fines go up to EUR 35 million or, for an undertaking, up to 7% of total worldwide annual turnover, whichever is higher (Article 99(3)).

• Untargeted scraping to build face databases (point (e))

  AI systems that create or expand facial recognition databases through the untargeted scraping of facial images from the internet or CCTV footage. The prohibition covers placing on the market, putting into service for this specific purpose, and use. The text names no consent test and no named data set.

• Emotion inference at work and in education (point (f))

  AI systems to infer emotions of a natural person in the areas of workplace and education institutions, except where the use of the system is intended to be put in place or into the market for medical or safety reasons. Emotion recognition systems are listed in Annex III point 1(c), which does not limit them to an area.

• Biometric categorisation of sensitive traits (point (g))

  Biometric categorisation systems that categorise individually natural persons based on their biometric data to deduce or infer their race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation. The prohibition does not cover any labelling or filtering of lawfully acquired biometric datasets, such as images, based on biometric data, or categorizing of biometric data in the area of law enforcement.

• Real-time remote identification for law enforcement (point (h))

  The use of ‘real-time’ remote biometric identification systems in publicly accessible spaces for the purposes of law enforcement is prohibited unless and in so far as strictly necessary for one of three objectives. The first is the targeted search for specific victims of abduction, trafficking in human beings or sexual exploitation, and for missing persons. The second is the prevention of a specific, substantial and imminent threat to life or physical safety, or a genuine and present or genuine and foreseeable threat of a terrorist attack. The third is the localisation or identification of a person suspected of a criminal offence listed in Annex II and punishable by a custodial sentence or detention order of a maximum of at least four years. Use may only confirm the identity of the specifically targeted individual (Article 5(2)). Each use needs a prior authorisation by a judicial authority or an independent administrative authority whose decision is binding. In a duly justified situation of urgency, use may start without authorisation, provided it is requested without undue delay and at the latest within 24 hours. If it is rejected, the use stops with immediate effect and the data and results are deleted (Article 5(3)). Authorisation also requires a completed fundamental rights impact assessment and registration of the system in the EU database; in duly justified urgency, registration may follow without undue delay (Article 5(2)). Each use is notified to the market surveillance authority and the national data protection authority (Article 5(4)). Those authorities send annual reports to the Commission, which publishes annual reports (Article 5(6), Article 5(7)). A Member State may decide whether to provide for such authorisation (Article 5(5)). Point (h) concerns use for the purposes of law enforcement; it is without prejudice to Article 9 of Regulation (EU) 2016/679 for other purposes.

• Providers

  A provider develops a system, or has it developed, and places it on the market or puts it into service under its own name or trademark (Article 3(3)). A provider must ensure that its high-risk system complies with the requirements of Section 2, which includes Articles 9 to 15, have a quality management system under Article 17, and ensure the conformity assessment under Article 43 before placing the system on the market or putting it into service (Article 16, points (a), (c) and (f)).

• Deployers

  A deployer is a natural or legal person, public authority, agency or other body using an AI system under its authority (Article 3(4)). Deployers take appropriate technical and organisational measures to use the system in accordance with the instructions for use, assign human oversight to natural persons with the necessary competence, training and authority, and keep the logs under their control (Article 26, paragraphs 1, 2 and 6). Deployers that are public authorities register their use in the EU database (Article 26(8), Article 49(3)). Deployers that are bodies governed by public law, or private entities providing public services, perform a fundamental rights impact assessment before deploying a system referred to in Article 6(2) (Article 27(1)).

• Deployers of post-remote biometric identification

  In an investigation for the targeted search of a person suspected or convicted of a criminal offence, the deployer of a post-remote biometric identification system must request an authorisation, ex ante or without undue delay and no later than 48 hours, by a judicial authority or an administrative authority whose decision is binding and subject to judicial review. The exception is use for the initial identification of a potential suspect based on objective and verifiable facts directly linked to the offence. No decision that produces an adverse legal effect on a person may be taken by the law enforcement authorities based solely on the output of such a system. Regardless of the purpose or deployer, each use of such systems is documented in the relevant police file and made available to the market surveillance authority and the national data protection authority upon request, excluding sensitive operational data related to law enforcement. Deployers must submit annual reports on their use of post-remote biometric identification systems to those authorities; the reports may be aggregated (Article 26(10)).

Breaches of the Article 5 prohibitions can be fined up to EUR 35 million or, for an undertaking, up to 7% of its total worldwide annual turnover for the preceding financial year, whichever is higher (Article 99(3)). Breaches of the provider obligations in Article 16 and the deployer obligations in Article 26 can be fined up to EUR 15 million or, for an undertaking, up to 3%, whichever is higher; the same tier covers the transparency obligations in Article 50 (Article 99(4), points (a), (e) and (g)). For SMEs, including start-ups, each fine is up to whichever of the two is lower (Article 99(6)). For small mid-cap enterprises (Article 3(14b)) the same applies to the fines in Article 99(4) and Article 99(5), but not to those in Article 99(3) (Article 99(6a)). Each Member State lays down rules on to what extent administrative fines may be imposed on public authorities and bodies established in that Member State (Article 99(8)). Article 99(3) to (5) names no tier for Article 27 or Article 49.

• Art. 5(1)(e)–(h)
  Prohibitions: check first

  Check whether the system falls under points (e) to (h) of Article 5(1) before applying the high-risk rules. See the prohibitions above.

• Art. 9
  Risk management system

  A provider duty. It includes consideration of persons under 18 and other vulnerable groups (Article 9(9)). The Act names no biometric risk value or method.

• Art. 10, 4a
  Data governance and special categories of data

  Quality criteria for training, validation and testing data (Article 10). Providers may exceptionally process special categories of personal data for bias detection and correction under six conditions (Article 4a(1)).

• Art. 12(3)
  Record-keeping: minimum log content

  For point 1(a) systems, the logs record the period of each use, the reference database, the input data that led to a match, and the persons who verified the result (Article 12(3)).

• Art. 13
  Transparency and instructions for use

  The provider supplies instructions for use with at least the items in Article 13(3). Article 13 sets no rule on signs or notices for people captured by a system.

• Art. 14(5)
  Human oversight: two-person check

  For point 1(a) systems, no action or decision on an identification before separate verification and confirmation by at least two natural persons with the necessary competence, training and authority (Article 14(5)). Exemption for law enforcement, migration, border control and asylum where law considers it disproportionate.

• Art. 15, 17
  Accuracy, robustness, cybersecurity and quality management

  Provider duties (Article 15, Article 17). The Act names no accuracy value, error-rate metric or test method for biometrics. The provider declares the levels and metrics of accuracy in the instructions for use (Article 15(3)).

• Art. 26–27
  Deployer duties and fundamental rights impact assessment

  Use in accordance with the instructions, human oversight, logs (Article 26). Deployers of high-risk systems under Annex III that make or assist in decisions related to natural persons inform those persons (Article 26(11)). Post-remote identification in criminal investigations: authorisation and reporting (Article 26(10)). Fundamental rights impact assessment for the deployers named in Article 27(1).

• Art. 43(1)
  Conformity assessment route for point 1

  Where the provider has applied harmonised standards (Article 40) or, where applicable, common specifications (Article 41), it opts for internal control under Annex VI or an assessment with a notified body under Annex VII. Annex VII applies where such standards do not exist and common specifications are not available, where the provider has not applied or has applied only part of the standard, where it has not applied existing common specifications, or where a standard was published with a restriction. For systems put into service by law enforcement, immigration or asylum authorities or by Union institutions, the market surveillance authority acts as notified body (Article 43(1)).

• Art. 49
  Registration in the EU database

  Providers register themselves and their system before placing it on the market or putting it into service (Article 49(1)). Deployers that are public authorities register their use (Article 49(3)). For systems under points 1, 6 and 7 in the areas of law enforcement, migration, asylum and border control management, registration is in a secure non-public section with limited information (Article 49(4)).

• Art. 50(3)
  Information duty for emotion recognition and biometric categorisation

  Deployers of an emotion recognition system or a biometric categorisation system inform the natural persons exposed to it of the operation of the system, and process the personal data in accordance with data protection law. The obligation does not apply to systems permitted by law to detect, prevent or investigate criminal offences, subject to appropriate safeguards and in accordance with Union law (Article 50(3)). Remote biometric identification is not named in this paragraph.

• Article 9 for Biometric AI: Risk Management

  Risk management for biometric AI: what Article 9 requires of the provider.

• Article 14 for Biometric AI: Human Oversight

  Human oversight for biometric AI, including the two-person check for remote identification.

• Prohibited AI Practices Under Article 5

  All prohibited AI practices in Article 5, including the biometric ones.

• EU AI Act Compliance for Law Enforcement AI

  The law enforcement overview: Annex III point 6 and the rules for law enforcement authorities.