Biometric identification

Real-time remote biometric identification by police in a publicly accessible space is generally prohibited, but the exceptions are part of the rule. Under Article 5(1)(h), the duty falls on law-enforcement deployers, Article 74(8) authorities enforce it, and it has applied since 2 February 2025.¹

The listed exceptions concern targeted searches for specified victims or missing people, specified serious threats, and suspects in listed serious offences. Article 5(5) permits an exception only where national law authorises it within the Act’s limits. Police deployers must follow that law, market-surveillance and data-protection authorities enforce it, and the condition has applied since 2 February 2025.¹

The figure shows why a listed objective alone is insufficient. Articles 5(2) and 5(3) place the common conditions on the police deployer, supervised by Article 74(8), data-protection and authorising authorities since 2 February 2025. Commission guidance describes the urgent authorisation timetable.¹²

flowchart TD
    A["Police proposes real-time remote<br/>biometric identification in public"] --> B{"Listed targeted objective?"}
    B -->|Victim or missing person| C["Permitted objective"]
    B -->|Specified serious threat| D["Permitted objective"]
    B -->|Suspect in listed serious offence| E["Permitted objective"]
    B -->|No listed objective| X["Use prohibited"]
    C --> F["National law must authorise the exception"]
    D --> F
    E --> F
    F --> G["Confirm one targeted identity;<br/>necessary and proportionate limits"]
    G --> H["Rights impact assessment and<br/>EU registration, with urgent exception"]
    H --> I{"Duly justified urgency?"}
    I -->|No| J["Prior judicial or binding<br/>independent authorisation"]
    I -->|Yes| K["Absolute minimum use;<br/>request authorisation without undue delay<br/>and no later than 24 hours"]
    J --> L["No adverse legal decision<br/>based solely on the match"]
    K --> L

Figure: Real-time police identification requires a listed objective, national authorisation and common safeguards.

Separate prohibitions have also applied since 2 February 2025. Article 5(1)(e) bars providers, deployers and other operators from building or expanding facial-recognition databases through untargeted scraping, enforced by national market-surveillance authorities. Article 5(1)(g) bars operators from biometric categorisation used to infer listed sensitive characteristics, subject to specified exclusions and enforcement by the relevant market-surveillance authority.¹

From 2 December 2027, otherwise lawful remote identification is scheduled to become high-risk. Article 14(5) will require providers to enable separate confirmation by two competent humans, although specified police, migration or border law may disapply that safeguard where disproportionate. Article 74(8) authorities will enforce it.¹³

If you suspect unlawful use, Article 85 has permitted a complaint to the relevant AI Act market-surveillance authority since 2 August 2026. Where personal data are involved, a complaint to the national data-protection supervisory authority may also be available.¹ As of 12 September 2026, national designations on the Commission’s list were still blank or pending, so no universal complaint destination can be supplied.⁴

Boundary. Whether a real-time exception is available depends on national authorising law, which may be stricter. Verification used only to confirm a claimed identity is excluded from the later high-risk remote-identification category.¹