Law-enforcement AI sits at one of the Act’s strictest boundaries. Some uses are prohibited, others are high-risk, and biometric deployment can trigger additional necessity and authorisation conditions. The governance question is not only whether the model performs—it is whether the use remained legally and evidentially bounded at the moment of consequence.
The Regulation prohibits certain criminal-risk assessments and tightly restricts real-time remote biometric identification for law-enforcement purposes, while Annex III places specified law-enforcement systems on high-risk pathways. Biometric and other personal-data processing remains subject to additional Union and Member State law.
Start with the actual system, role, use case and evidence boundary. The same regulation can produce different obligations for different actors and systems.
Article 5 prohibits certain law-enforcement uses, including criminal-risk assessment based solely on profiling or personality traits, subject to the Regulation’s narrow distinction for human assessment already grounded in objective and verifiable facts.
Annex III includes specified law-enforcement uses such as victim-risk assessment, polygraph or similar tools, evaluation of evidence reliability, certain offending or reoffending assessments, and profiling during detection, investigation or prosecution.
Real-time remote biometric identification in publicly accessible spaces for law enforcement is generally prohibited, with tightly bounded exceptions requiring necessity, safeguards and authorisation conditions.
Preserve the legal authority, operational purpose, case or deployment scope, system version, data sources, human decision role, approval path, logs, oversight, exception relied on, and evidence that use stayed within the declared boundary.
The goal is not merely to reach an answer. It is to preserve what facts, evidence, scope and limitations supported that answer at that time.
Do not treat a prohibited practice as simply a higher compliance tier. Determine whether the intended law-enforcement use is allowed before moving into Annex III or other operational requirements.
Separate victim-risk assessment, evidence evaluation, profiling, biometric identification, polygraph-like functions, offending-risk assessment, and other uses. Each function can sit on a different legal route.
Connect legal authority, necessity, proportionality, objective case facts, human review, logging, technical documentation, access controls, performance limits and approval evidence to the exact deployment.
A new investigation type, jurisdiction, target population, model, dataset, biometric capability, profiling purpose, approval basis or legal source can materially change whether the prior deployment remains governable.
Choose the smallest operating tier that fits the portfolio today. Upgrade when system count, team size or governance scope actually requires it.
Keep a living system-level evidence record with obligations, gaps, versions and revalidation state.
START EVIDENCE PASSPORT →Coordinate evidence, owners, documentation, incidents and team compliance work in one governed workspace.
START COMPLIANCE WORKSPACE →Operate broader high-risk, GPAI, FRIA, post-market and material-change governance across a growing portfolio.
START GOVERNANCE PRO →Run institutional governance with expanded users, authority workflows, examiner rooms and portfolio reporting.
START INSTITUTION →Use the free classifier to establish the system, intended purpose, possible actor role, EU exposure and unresolved facts. When continuing evidence infrastructure is needed, paid access begins at $19 per month. Independent human readiness review remains a separate service.
It prohibits AI systems used to assess or predict a natural person’s risk of committing a criminal offence when that assessment is based solely on profiling or on personality traits and characteristics. The Regulation distinguishes this from AI used to support a human assessment already based on objective and verifiable facts directly linked to criminal activity.
Annex III lists specified law-enforcement uses, including systems for assessing a person’s risk of becoming a crime victim, polygraph or similar tools, evaluating evidence reliability, certain offending or reoffending assessments not solely based on profiling, and profiling during criminal detection, investigation or prosecution.
Real-time remote biometric identification in publicly accessible spaces for law-enforcement purposes is generally prohibited, subject to narrowly defined exceptions and strict necessity, safeguard and authorisation conditions.
The high-risk framework still matters, but law-enforcement systems also operate inside additional Union and Member State legal constraints, including rules on personal-data processing, criminal procedure, necessity, proportionality and competent authority.
Preserve system identity and version, intended purpose, legal authority, case or deployment scope, objective facts relied on, data provenance, human decision role, approvals, logs, technical evidence, limitations, exceptions, changes and the basis for continued reliance.
No. TA-14 can preserve the authority claim, classification basis, evidence, scope, gaps, review history and revalidation state. It does not itself provide legal authorisation, legal advice, conformity assessment, certification or regulatory approval.
TA-14 Exchange Activity
Live cumulative activity recorded across the public Exchange surface.
···
Visitors
Recorded public visitors
···
Page Views
Recorded Exchange views