Applicable to: AI deployers.
Date of application: 2 February 2025.
Objective: to prohibit the use of “real-time” remote biometric identification AI systems in publicly accessible spaces for law enforcement purposes, subject to the exceptions set out in the AI Act.
Regulation (EU) No 1689/2024 on Artificial Intelligence (AI Act) of 13 June 2024 introduced a series of prohibitions within the European Union on practices involving the use of AI systems that pose an ‘unacceptable’ risk (the highest level assigned to certain AI systems in the risk-based approach adopted by the AI Act).
In this article, we will analyse the practice covered by Article 5.1.h) of the AI Act, under which the following is prohibited:
the use of ‘real-time’ remote biometric identification systems in publicly accessible spaces for the purposes of law enforcement, unless and in so far as such use is strictly necessary for one of the following objectives:
|
(i) |
the targeted search for specific victims of abduction, trafficking in human beings or sexual exploitation of human beings, as well as the search for missing persons; |
|
(ii) |
the prevention of a specific, substantial and imminent threat to the life or physical safety of natural persons or a genuine and present or genuine and foreseeable threat of a terrorist attack; |
|
(iii) |
the localisation or identification of a person suspected of having committed a criminal offence, for the purpose of conducting a criminal investigation or prosecution or executing a criminal penalty for offences referred to in Annex II and punishable in the Member State concerned by a custodial sentence or a detention order for a maximum period of at least four years. |
The elements that characterise the prohibited practice are:
1) the fact that the AI system is used within the European Union
2) the AI system must be a remote biometric identification system used:
- in real time;
- in publicly accessible spaces;
- for the purposes of law enforcement.
The AI Act has clarified that “biometric identification” means the automated recognition of physical, behavioural, or psychological human features for the purpose of establishing the identity of a natural person by comparing biometric data of that individual to biometric data of individuals stored in a database (art. 3.35).
Biometric identification is “remote” when it does not require the active involvement of individuals (art. 3.41).
The Guidelines approved by the European Commission on 29 July 2025 have clarified that for active involvement it is not sufficient that persons are informed about the presence of cameras, but they need to step actively and consciously in front of a camera that is installed in a way fostering active participation (for example, such as biometric metro tickets, where persons are actively involved and consciously approach the biometric sensor to obtain access).
The AI Act has also specified that the use is “in real time” when the system captures and further processes biometric data “instantaneously, near-instantaneously or in any event without any significant delay” (recital 17), while the notion of “publicly accessible space” includes any publicly or privately owned physical place accessible to an undetermined number of natural persons, regardless of whether certain conditions for access may apply, and regardless of the potential capacity restrictions (art. 3.44).
“Law enforcement” means activities carried out by law enforcement authorities or on their behalf for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including safeguarding against and preventing threats to public security (art. 3.46).
The AI Act also provides, in points from i to iii of h) letter, three exceptions for this prohibition:
- that the AI system is used for the targeted search for specific victims of abduction;
- that the AI system aims to prevent a threat to the life or physical safety of natural persons or a terrorist attack;
- that the AI practice aims to localise or identify a person suspected of having committed a criminal offence.
The application of these exceptions is, however, subject to the condition that the use for the specifically stated purposes is authorised under national law and that the conditions and the safeguards laid down in art. 5, paragraphs from 2 to 7, are met.
Articoli Correlati