Biometric AI cannot be governed as one generic category. Identification, verification, categorisation, emotion recognition, and remote identification sit on different legal pathways. The first question is what the system actually does—and whether that use is allowed at all.
The Regulation distinguishes biometric identification from verification, prohibits certain sensitive biometric categorisation and other biometric practices, and places specified biometric systems on high-risk pathways where the use is permitted and the relevant conditions are met.
Start with the actual system, role, use case and evidence boundary. The same regulation can produce different obligations for different actors and systems.
The Act distinguishes biometric identification, biometric verification/authentication, and biometric categorisation. Those are not interchangeable labels, and the legal route can change substantially depending on which function the system actually performs.
Certain biometric uses are prohibited, including some sensitive-attribute categorisation, untargeted facial-image scraping to build or expand recognition databases, and emotion inference in workplaces or education except for medical or safety purposes.
Certain remote biometric identification, biometric categorisation, and emotion-recognition systems can fall within Annex III high-risk categories where the use is not already prohibited and the Regulation’s scope conditions are met.
Preserve the exact intended purpose, biometric function, data source, lawful authority, operator role, system version, access controls, human oversight, deployment context, exceptions relied on, and change history.
The goal is not merely to reach an answer. It is to preserve what facts, evidence, scope and limitations supported that answer at that time.
Separate one-to-one verification, one-to-many identification, remote identification, categorisation, and emotion recognition. Do not classify a system merely as “facial recognition” if its actual function is different.
A prohibited use should not be treated as merely a stricter compliance pathway. Establish whether Article 5 blocks the use before moving on to Annex III or other obligations.
Connect lawful basis, intended purpose, data provenance, human oversight, technical documentation, logging, access controls, performance, limitations and exception claims to the exact deployed system.
A new camera network, dataset, identification target, deployment environment, law-enforcement use, sensitive-category inference, or model change can materially alter the legal and evidentiary state.
Choose the smallest operating tier that fits the portfolio today. Upgrade when system count, team size or governance scope actually requires it.
Keep a living system-level evidence record with obligations, gaps, versions and revalidation state.
START EVIDENCE PASSPORT →Coordinate evidence, owners, documentation, incidents and team compliance work in one governed workspace.
START COMPLIANCE WORKSPACE →Operate broader high-risk, GPAI, FRIA, post-market and material-change governance across a growing portfolio.
START GOVERNANCE PRO →Run institutional governance with expanded users, authority workflows, examiner rooms and portfolio reporting.
START INSTITUTION →Use the free classifier to establish the system, intended purpose, possible actor role, EU exposure and unresolved facts. When continuing evidence infrastructure is needed, paid access begins at $19 per month. Independent human readiness review remains a separate service.
No. It prohibits certain biometric practices and places some other biometric systems on high-risk pathways. The correct answer depends on the function, intended purpose, deployment context, operator, and any specific exception in the Regulation.
No. The Regulation distinguishes identification from verification/authentication. Verification generally confirms that a person is who they claim to be, while biometric identification compares biometric data against a reference database to establish identity.
The Act prohibits certain biometric categorisation used to deduce or infer sensitive characteristics such as race, political opinions, trade-union membership, religious or philosophical beliefs, sex life, or sexual orientation, subject to the Regulation’s stated exceptions.
Emotion-recognition systems are treated differently depending on context. The Act prohibits their use to infer emotions in workplaces and education institutions except for medical or safety reasons, while other emotion-recognition uses can fall into high-risk or transparency pathways.
For law-enforcement use, the Act generally prohibits real-time remote biometric identification in publicly accessible spaces, subject to narrowly defined exceptions, necessity conditions, authorisation, and safeguards.
No. TA-14 can preserve the system identity, function, authority basis, evidence, exceptions, gaps, review history, and revalidation state. It does not itself provide legal advice, conformity assessment, certification, or regulatory approval.
TA-14 Exchange Activity
Live cumulative activity recorded across the public Exchange surface.
···
Visitors
Recorded public visitors
···
Page Views
Recorded Exchange views