Remote Biometric Identification in the EU AI Act: Bans, Exceptions and Authorisations

Overview: The Most Contested Provision of the AI Act

No part of the EU AI Act was fought over harder than remote biometric identification — the technology that scans faces or other biometric traits of people at a distance and matches them against databases. The European Parliament sought a complete ban on its real-time use in public; the Council defended law enforcement access; the final text of Article 5(1)(h) is the negotiated result: a prohibition with three tightly drawn exceptions, wrapped in procedural safeguards that make lawful deployment deliberately difficult. Understanding the full scheme — definitions, exceptions, authorisation machinery, and the separate regime for after-the-fact identification — matters to police forces, to the vendors who supply them, and to every operator of camera infrastructure that could be repurposed for matching.

Definitions That Control Everything

A remote biometric identification system, under Article 3(41), identifies natural persons without their active involvement, typically at a distance, by comparing their biometric data with data in a reference database. The regulation splits the concept by timing: real-time systems capture, compare and identify instantaneously or near-instantaneously — including with limited short delays to prevent circumvention — while post systems perform identification after a significant delay, from previously captured material. Two boundary clarifications prevent common misreadings. Verification systems that merely confirm a person is who they claim to be — unlocking a phone, matching a traveller to their own passport — are not remote identification and sit outside this scheme. And the Article 5 prohibition attaches specifically to use for the purposes of law enforcement in publicly accessible spaces; other configurations are governed by the high-risk regime of Annex III point 1(a) and by data protection law, which independently restricts biometric processing severely.

The Three Exceptions

Real-time remote biometric identification in publicly accessible spaces for law enforcement is prohibited unless and in so far as strictly necessary for one of three objectives:

• The targeted search for specific victims of abduction, trafficking in human beings or sexual exploitation of human beings, as well as the search for missing persons
• The prevention of a specific, substantial and imminent threat to the life or physical safety of natural persons, or of a genuine and present or genuine and foreseeable threat of a terrorist attack
• The localisation or identification of a person suspected of having committed a criminal offence, for the purposes of conducting a criminal investigation or prosecution or executing a criminal penalty, for offences listed in Annex II and punishable in the Member State concerned by a custodial sentence or detention order of a maximum period of at least four years

Each exception is targeted by construction: the regulation requires that deployment pursue a specific listed objective concerning specifically targeted individuals — the exceptions do not permit generalised scanning of crowds to see who turns up.

The Safeguard Machinery

Even within the exceptions, lawful use must clear a procedural staircase set out in Article 5(2) to 5(7). The deployment must be provided for in the national law of the Member State concerned — a state that has not legislated for it cannot use the exceptions at all. Each individual use requires prior authorisation by a judicial authority or an independent administrative authority whose decision is binding, granted on reasoned request; in duly justified situations of urgency, use may begin without authorisation provided it is requested without undue delay and at the latest within 24 hours, with use halted and data deleted if refused. Before deployment, the authority must complete a fundamental rights impact assessment and register the system in the EU database. Each use must weigh the seriousness, probability and scale of the harm against the consequences for rights and freedoms, respect temporal, geographic and personal limitations, and each use must be notified to the relevant market surveillance authority and the national data protection authority. Member States report annually to the Commission on their use of the exceptions, and the Commission publishes aggregated reports. No decision producing adverse legal effects may be taken based solely on the output of such a system.

Post-Event Identification: The Other Half

Identification performed after the fact — running face recognition across recorded footage to find a suspect — is not covered by the Article 5 prohibition, but the regulation declines to leave it loose. It is high-risk under Annex III point 1(a), carrying the full Chapter III obligations, and Article 26(10) adds a use-level control for law enforcement deployers: in the framework of a criminal investigation, the use of post remote biometric identification must be subject to authorisation by a judicial authority or administrative authority whose decision is binding, requested no later than 48 hours after use began — except where the system is used for the initial identification of a potential suspect based on objective and verifiable facts directly linked to the offence. Targeted use, linked to a specific criminal offence, is the organising requirement; untargeted trawling of footage against population-scale databases is precisely what the structure forbids, and the prohibition on untargeted scraping of facial images under Article 5(1)(e) cuts off the database-building practice at its source.

Who Must Act

1. Member State authorities: lawful real-time use requires national implementing legislation, designated authorisation authorities, registration and reporting infrastructure — states without that scaffolding have no access to the exceptions
2. Police forces: build the request-and-authorisation workflow into operations, including the 24-hour urgency procedure and the 48-hour post-event procedure, and train commanders on the targeting requirements
3. Vendors: systems sold for these uses are Annex III point 1 high-risk, facing conformity assessment with possible notified body involvement, logging designed for judicial review, and accuracy evidence across demographic groups — the documented failure modes of face recognition on different populations will be examined
4. Private operators: remote identification outside law enforcement — stadium security, retail watchlists — is not under the Article 5(1)(h) ban but is high-risk and must clear the GDPR, which has already proven fatal to most such deployments in Europe

Concrete Example

A child is abducted; investigators have images of the suspect. Under national law implementing the exception, police request authorisation to run real-time identification on camera networks around transport hubs for 48 hours, targeted at locating the specific child and suspect. A judge grants it with geographic and temporal limits; uses are logged, the data protection authority notified, and non-matches are not retained. This is the scheme working as designed. The contrast case — permanently wiring a city's cameras to a watchlist in case something happens — fails every element: no specific objective, no targeted individuals, no temporal limit, and no authorisation could lawfully cover it.

Action Before August 2, 2026

The prohibition and its exceptions have applied since February 2, 2025; the high-risk obligations for identification systems, real-time and post, reach full application on August 2, 2026. The remaining window is for infrastructure: Member States completing implementing law and authorisation procedures, forces operationalising the workflows, vendors finishing conformity assessment, and every operator of biometric capability documenting which legal box each function occupies. This technology now has the most explicit rulebook in the world — and the organisations that thrive under explicit rules are invariably those that read them before the first urgent request arrives at midnight.

Why the Procedure Is the Point

Critics of Article 5(1)(h) argue from both directions — that the exceptions swallow the ban, or that the safeguards strangle legitimate policing — but the design logic rewards a closer look. Every element of the machinery converts a surveillance decision into a recorded, reviewable, accountable act: the national law requirement forces a democratic legislature to own the choice; prior authorisation places an independent decision-maker between the operational impulse and the deployment; the impact assessment and registration create the paper trail; the notification duties keep two supervisory authorities informed; and the annual reporting aggregates national practice into European visibility. The structure does not assume good or bad faith in any actor — it assumes that unrecorded power expands, and it makes every expansion legible. For practitioners, this reframes compliance: the documentation is not overhead attached to the capability, it is the legal existence of the capability. A deployment whose authorisation, scope limits and logs are complete is defensible in court and in politics; an identical deployment with gaps in the record is indistinguishable from the abuse the article was written to prevent. Agencies and vendors that internalise this — building systems where the procedural record generates itself as a by-product of operation — will find the regime demanding but navigable. Those that treat the safeguards as friction to be minimised will discover that in this corner of European law, the friction is the feature.

This article is for informational purposes only and does not constitute legal advice. Regulatory requirements change frequently — verify current rules with official sources. Built by Sawai Gyoseishoshi Office, Hiroshima, Japan.