EU AI Act: AI in Law Enforcement — High-Risk Classification and Obligations (2026) | MmowW

Law Enforcement AI Under the EU AI Act

The EU AI Act imposes some of its strictest requirements on AI systems used in law enforcement contexts. Annex III, Section 6 classifies several categories of law enforcement AI as high-risk, reflecting the significant impact these systems can have on fundamental rights, including the right to liberty, the presumption of innocence, and protection against discrimination.

These provisions must be read alongside Article 5, which prohibits certain AI practices outright, including specific uses of biometric identification that are particularly relevant to law enforcement.

High-Risk Law Enforcement AI Categories

Individual Risk Assessment

AI systems intended to be used by law enforcement authorities for making individual risk assessments of natural persons to assess the risk of a natural person offending or re-offending are classified as high-risk under Annex III, Section 6(a). This includes pre-trial risk assessment tools used to inform bail or detention decisions, recidivism prediction tools used in sentencing or parole contexts, and risk scoring systems used to prioritise law enforcement resources toward specific individuals.

These systems directly affect individuals' liberty and are subject to the full requirements of Title III, Chapter 2, including rigorous data governance, transparency, human oversight, and accuracy requirements.

Polygraph and Similar Tools

AI systems intended to be used by law enforcement authorities as polygraphs and similar tools, or to detect the emotional state of a natural person, are classified as high-risk under Annex III, Section 6(b). This extends to AI-based deception detection systems, voice stress analysis tools, micro-expression analysis systems, and physiological response monitoring during interviews.

The scientific validity of emotion detection and deception detection technologies remains contested. The AI Act's classification of these systems as high-risk reflects the significant risk of unreliable outputs being used to make consequential decisions about individuals in law enforcement contexts.

Evidence Reliability Evaluation

AI systems used to evaluate the reliability of evidence in criminal investigations or prosecutions are high-risk under Annex III, Section 6(c). This covers AI tools for digital forensics analysis, automated document and communications analysis, pattern matching in evidence databases, and AI systems that assess the credibility or reliability of witness statements or physical evidence.

Crime Prediction and Profiling

AI systems used for profiling of natural persons in the course of detection, investigation, or prosecution of criminal offences are classified as high-risk under Annex III, Section 6(e). This includes predictive policing systems that identify potential crime locations or patterns, social network analysis tools used to identify potential suspects, and behavioural profiling systems used in criminal investigations.

Note that Article 5(1)(d) prohibits AI systems that evaluate or classify natural persons based on their social behaviour or personality characteristics to predict criminal behaviour, where such assessment leads to detrimental treatment unrelated to the context in which the data was generated. This creates a boundary between permitted high-risk crime analytics and prohibited predictive profiling.

Prohibited Practices: Biometric Identification

Article 5(1)(h) prohibits the use of real-time remote biometric identification systems in publicly accessible spaces for law enforcement purposes, subject to strictly limited exceptions. The permitted exceptions, established in Article 5(2), include:

• The targeted search for specific victims of abduction, trafficking, or sexual exploitation, and the search for missing persons
• The prevention of a specific, substantial, and imminent threat to life or physical safety of natural persons, or of a genuine and foreseeable threat of a terrorist attack
• The localisation or identification of a person suspected of having committed a specific criminal offence listed in Article 5(3)

These exceptions require prior judicial authorisation in each case, except in duly justified situations of urgency where authorisation must be sought within 24 hours. Member States must adopt specific national legislation to permit these exceptions.

Compliance Requirements for Law Enforcement AI

Providers and deployers of high-risk law enforcement AI must comply with the full set of requirements under Title III, Chapter 2. Given the sensitivity of law enforcement applications, several requirements deserve particular attention.

Fundamental Rights Impact Assessment

Article 27 requires deployers of high-risk AI systems that are public authorities, including law enforcement agencies, to carry out a fundamental rights impact assessment before putting the system into use. This assessment must evaluate the potential impact on the rights of affected persons, including the right to non-discrimination, the right to liberty, the presumption of innocence, and the right to an effective remedy.

Transparency and Information

Article 13 requires that high-risk AI systems be accompanied by instructions for use that include information about the system's accuracy, robustness, and cybersecurity characteristics. For law enforcement AI, this information is critical for operators to understand the system's limitations and to exercise appropriate human oversight.

Article 50(4) additionally requires that deployers of AI systems that interact with natural persons inform those persons that they are interacting with an AI system, unless this is obvious from the circumstances. Law enforcement contexts may involve exemptions where disclosure would prejudice an investigation, but these exemptions are narrowly construed.

Human Oversight

Article 14 requires that high-risk AI systems be designed to allow effective human oversight. In law enforcement, this means that AI outputs must be treated as one input among many in decision-making, not as determinative. Operators must be trained to understand the system's capabilities and limitations, and must have the authority and ability to override or disregard AI recommendations.

Data Protection Considerations

Law enforcement AI systems process personal data, often including special category data such as biometric data and data relating to criminal convictions. The Law Enforcement Directive (EU) 2016/680 applies to such processing and imposes requirements including data minimisation, purpose limitation, and data protection impact assessments. These requirements operate alongside the AI Act and must be considered in combination.

Start your AI compliance journey to assess your law enforcement AI systems against EU AI Act requirements.

This article is for informational purposes only and does not constitute legal advice. Regulatory requirements change frequently — verify current rules with official sources. Built by Sawai Gyoseishoshi Office, Hiroshima, Japan.