Applicable to: AI providers and deployers.
Date of application: 2 February 2025.
Objective: to prohibit the use of AI systems that categorise people based on their biometric data to deduce or infer “sensitive” informations.
Regulation (EU) No 1689/2024 on Artificial Intelligence (AI Act) of 13 June 2024 introduced a series of prohibitions within the European Union on practices involving the use of AI systems that pose an ‘unacceptable’ risk (the highest level assigned to certain AI systems in the risk-based approach adopted by the AI Act).
In this article, we will analyse the practice covered by Article 5.1.g) of the AI Act, under which the following is prohibited:
the placing on the market, the putting into service for this specific purpose, or the use of biometric categorisation systems that categorise individually natural persons based on their biometric data to deduce or infer their race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation; this prohibition does not cover any labelling or filtering of lawfully acquired biometric datasets, such as images, based on biometric data or categorizing of biometric data in the area of law enforcement.
The elements that characterise the prohibited practice are:
1) the fact that the AI system is placed on the market, put into service or used within the European Union
2) that the system is a biometric categorisation system
3) that the system categorise individual persons based on their biometric data
4) to deduce or infer their race, political opinions, trade union membership, religious or philosophical beliefs, sex-life or sexual orientation.
AI Act defines “biometric data” personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, such as facial images or dactyloscopic data (art. 3.34).
The categorisation based on clothes or accessories, as well as social media activity, is therefore excluded from the scope of the prohibition in question.
“Biometric categorisation system” means an AI system for the purpose of assigning natural persons to specific categories on the basis of their biometric data, unless it is ancillary to another commercial service and strictly necessary for objective technical reasons (art. 3.40 AI Act)
As specified in the Guidelines approved by the European Commission on 29 July 2025, filters categorising facial or bodily features used on online marketplaces to allow a consumer to preview a product on him or herself could constitute such an ancillary feature, since they can be only used in relation to the principal service which consists in selling a product; in this sense, they may lawfully be used for these specific purposes.
It would, however, be prohibited the use of an AI system that categorises persons active on a social network according to their assumed political orientation, by analysing the biometric data from the photos they have uploaded on the platform, to send them targeted political messages. While such a system may only be ancillary to the political advertising, it would not be strictly necessary for objective technical reasons.
AI Act finally provides that this prohibition does not cover any labelling or filtering of lawfully acquired biometric datasets in the area of law enforcement.
Law enforcement means activities carried out by law enforcement authorities or on their behalf for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including safeguarding against and preventing threats to public security.
For example, the use by a law enforcement authority of an AI system that allows labelling and filtering of a dataset suspected of containing child sexual abuse material would be excluded from the prohibition.
Articoli Correlati