Biometric identification is not one single use case. The EU AI Act treats some biometric categorisation, emotion inference and law-enforcement identification practices differently, with narrow exceptions and legal conditions.
Distinguish the technologies
Remote biometric identification compares a person’s biometric data with reference records. Biometric verification confirms a claimed identity. Biometric categorisation groups people on inferred characteristics; emotion recognition purports to infer emotions or intentions. Technical labels matter because restrictions are triggered by actual system purpose and context, not a vendor’s marketing category.
Prohibited classification and emotion uses
Article 5 prohibits specified categorisation using biometric data to infer sensitive characteristics such as political opinions or religious beliefs. It also bans AI emotion inference in workplace and educational institutions except where intended for medical or safety reasons. These are defined prohibitions, not an automatic ban on all facial analysis or all workplace sensors.
Law enforcement identification is tightly framed
The law restricts real-time remote biometric identification in publicly accessible spaces for law enforcement with enumerated objectives, necessity safeguards and authorization processes. Member State implementing laws matter. A city’s desire to improve efficiency is not itself an enumerated exception, and the legislation cannot be reduced to a simple “police may use it” slogan.
Use a procurement fact pattern
A transit operator evaluating crowd-management cameras should ask whether faces are detected, whether people are identified, whether a database is searched and whether sensitive inferences are generated. Remove identification features unless demonstrably necessary, and obtain legal review of purposes, actors, public space and applicable data-protection provisions.
Timing and complementary law
This account uses the EU’s consolidated 27 July 2026 text and is date-sensitive. Applicable provisions and exceptions vary, and GDPR or law-enforcement data-protection rules remain relevant. No statement here gives a universal permission to collect biometric identifiers without a separate lawful basis.
Sources & Further Reading
- EU AI Act — Article 5 prohibited practices (consolidated 27 July 2026) — European Commission AI Act Service Desk.
- EU AI Act — consolidated version of 27 July 2026 — EUR-Lex.
Jurisdiction/scope: European Union; consolidated AI Act July 2026. This is educational information, not legal, medical or other professional advice. No hands-on product testing is claimed.