Biometric identification systems, which identify a person by comparing biometric data with a database, must be screened first under Article 5 and then classified under Article 6. Article 5 prohibits the use of real-time remote biometric identification systems in publicly accessible spaces for law enforcement purposes, subject to defined exceptions and safeguards, and it addresses post-remote biometric identification and other biometric uses in its own terms, which must be checked in the consolidated text. Annex III point 1 lists remote biometric identification systems, other than verification systems, as a high-risk use case. A system that only verifies that a person is who they claim to be, such as a one-to-one authentication check, is assessed differently from a system that identifies a person from a crowd or a database, and the distinction must be recorded.
What is biometric identification, and what is verification?
Biometric identification is the comparison of a person's biometric data, such as face, fingerprint or voice, against a database or a set of templates in order to determine who the person is, typically on a one-to-many basis. Biometric verification, or authentication, is the comparison of a person's biometric data against a template the person has provided, on a one-to-one basis, in order to confirm that the person is who they claim to be. The Act treats those functions differently: verification for the purpose of confirming identity is generally outside the remote identification listing in Annex III, while identification against a database is within it, subject to the Annex wording. A team should therefore describe the function precisely, including whether the comparison is one-to-one or one-to-many, whether the database is involved, whether the identification is real-time or after the event, and where the system is used. A label such as face recognition does not answer those questions, and a system described only by its label cannot be classified.
What does Article 5 prohibit for remote identification?
Article 5 prohibits, in outline, the use of real-time remote biometric identification systems in publicly accessible spaces for the purpose of law enforcement, subject to defined exceptions for specified serious purposes, subject to prior authorisation and safeguards, and subject to the detailed conditions in the provision. The prohibition is use-specific: it concerns real-time use, in publicly accessible spaces, for law enforcement purposes, and each of those elements must be checked before the prohibition is said to apply or not to apply. Other biometric identification uses, including post-remote identification and identification for non-law-enforcement purposes, are addressed by Article 5 and by Annex III in their own terms, and they carry their own conditions, authorisation and oversight requirements. A team assessing a biometric identification system should work through the Article 5 text element by element, record the conclusion for each element, and seek qualified advice where the use is close to a prohibition, rather than relying on a general view that identification is either always banned or always allowed.
For the broader regulatory framework, see healthcare and biometrics under the AI Act.
How does Annex III classify biometric identification?
Annex III point 1 lists, as high-risk use cases, remote biometric identification systems, other than systems intended to be used for biometric verification, and systems for biometric categorisation and emotion recognition as described in the Annex. A system that falls within the listing is high-risk under Article 6(2), subject to the Article 6(3) conditions and the profiling limit, and its provider and deployer duties follow the Chapter III framework from 2 December 2027. The classification must be based on the system's intended purpose and function, not on the vendor's description, and it must consider whether the system is used for identification, categorisation or emotion inference, since each is listed separately. A system that performs more than one biometric function should be assessed for each function, and the highest applicable classification should drive the compliance work. The classification record should cite the Annex point, the function and the evidence, so a reviewer can see why the system was listed or not listed.
What safeguards and oversight are relevant?
Biometric identification systems engage fundamental rights, including privacy, non-discrimination and the right to an effective remedy, and the Act's safeguards reflect that. A deployer should ensure that the system is used only for its assessed purpose, that the database and the matching threshold are appropriate, that false matches and false non-matches are understood and monitored, and that a human with competence and authority reviews identification results before consequential action is taken. The deployer should also consider the data protection assessment, the information given to affected people, and the fundamental-rights impact assessment where the deployer and use require it. Logs should record the identification decision, the reviewer and the outcome, without retaining biometric data beyond what is lawful and necessary. An identification result should never be treated as proof of identity on its own: it is an output that requires human assessment in its context, and the record should show that assessment took place.
What evidence should be kept for an identification system?
The evidence file for a biometric identification system should record the function, the comparison type, the timing, the setting, the purpose, the database, the threshold and the performance measures, including accuracy across different groups where the evaluation supports it. It should record the Article 5 screen, the Annex III classification, the data protection assessment, the authorisation or approval where required, the oversight arrangements and the monitoring of match rates and errors. The file should also record the information given to affected people, the complaints and challenges received, and the outcomes of those challenges. Performance evidence should be specific to the deployment environment, since accuracy in a controlled test does not guarantee accuracy in a crowded, poorly lit or fast-moving setting. A file that contains only vendor accuracy claims, without deployment-specific evidence and oversight records, does not support a deployment decision for a consequential identification use.
Continue with biometric categorisation and emotion inference.
What does this guide not decide?
This guide does not decide whether any biometric identification system is prohibited, high-risk or authorised, and it does not determine whether a particular law enforcement, border control or commercial use is lawful. Those questions depend on the system's function, timing, setting and purpose, the Article 5 exceptions and safeguards, the Annex III listing and the applicable national law, and they require the consolidated text and qualified advice on the facts. The guide also does not assess biometric accuracy or bias, which are technical questions for the evaluation evidence. Where a biometric identification system is to be deployed, confirm the prohibition, classification, authorisation and data protection position with a competent authority or legal adviser before use, and keep the assessment with the deployment record.
Frequently asked questions
Is biometric verification the same as biometric identification?
No. Verification confirms, on a one-to-one basis, that a person is who they claim to be. Identification determines, on a one-to-many basis, who a person is by comparison with a database. The Act treats them differently, and the function must be recorded.
Is real-time remote biometric identification always prohibited?
No. Article 5 prohibits real-time remote biometric identification in publicly accessible spaces for law enforcement purposes, subject to defined exceptions, prior authorisation and safeguards. Each element must be checked in the consolidated text for the use concerned.
Can an identification result alone justify action?
No. An identification result is an output requiring human assessment in context, with oversight, logging and a route to challenge. The record should show that assessment took place before consequential action followed.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689, as amended ↗AI Act Service Desk implementation timeline ↗