Real-time remote biometric identification: Article 5(1)(h) and the narrow law enforcement exceptions

What is real-time remote biometric identification?

Remote biometric identification means identifying a person, without their active involvement, typically at a distance, by comparing biometric data with a reference database. Real-time means the identification is carried out without a significant delay, including instantaneous, near-instantaneous, or with a short delay to avoid circumvention. Post, or retrospective, identification, where material is analysed after the event, is treated separately and can be high-risk under Annex III rather than prohibited under point (h), although other rules apply. Publicly accessible spaces mean places accessible to the public, regardless of ownership or access conditions, such as streets, squares, stations and shopping areas. The record should state the timing, the distance, the database, and the space, because each element affects whether point (h) is engaged.

What are the three permitted objectives?

The first objective is the targeted search for specific potential victims of crime, including missing persons. The search must be targeted at specific persons, not a general scan of everyone present. The second is the prevention of a specific, substantial and imminent threat to the life of natural persons or a foreseeable terrorist attack. The threat must be specific, substantial and imminent, or a foreseeable terrorist attack, not a general concern about crime. The third is the identification of a suspect for the purposes of conducting a criminal investigation, prosecution or executing a criminal penalty for offences referred to in Annex II and punishable by a custodial sentence of at least four years. Each objective must be evidenced with the specific facts that support it, and the use must be strictly necessary for that objective.

For the broader regulatory framework, see prohibited practices under Article 5.

What authorisation and safeguards apply?

Use within a permitted objective requires, as a rule, prior authorisation granted by a judicial authority or an independent administrative authority of the Member State, whose decision is binding, following an assessment of necessity and proportionality. In duly justified urgency, use may start without prior authorisation, provided authorisation is requested within 24 hours, and if authorisation is refused, use must stop with immediate effect and all data related to the use must be deleted. A fundamental rights impact assessment must be completed before first use, the use must be limited in time, geographical scope and persons targeted, and Member State law can impose stricter conditions or prohibit the use entirely. Annual reporting and oversight duties also apply. The safeguards are cumulative, not alternatives.

Can Member States go further than Article 5?

Yes. Article 5(1)(h) and the following paragraphs preserve the ability of Member States to provide for stricter rules, including prohibiting the use of real-time remote biometric identification in publicly accessible spaces for law enforcement in their territory. National law, including constitutional and human rights protections, can therefore be decisive even where the EU text would allow a use. A law enforcement body and its supplier must check the law of the Member State where the use takes place, not only the EU text. The record should cite the national provision relied on, the authorisation obtained, and any national prohibition or restriction that applies, because a use lawful in one Member State can be unlawful in another.

How does point (h) differ from post identification?

Post remote biometric identification, where identification is carried out after a delay and not in real time, is not prohibited by point (h) in the same way, but it is listed in Annex III as a high-risk use, subject to the Chapter III regime, and it requires authorisation under the conditions in Article 26(10) for law enforcement use in the situations the Act specifies. The timing distinction should not be gamed: a short delay introduced only to avoid the real-time label, without changing the substance of the use, will not reliably take a system outside point (h). The record should describe the actual delay, the reason for it, and the operational workflow, and should treat any attempt to reclassify by delay alone as a question for qualified review.

Continue with biometric categorisation prohibition.

What does this guide leave to authorities?

This guide outlines the prohibition, the objectives and the safeguards in general terms. It does not decide whether any particular deployment is real-time, whether an objective is met, whether authorisation was properly obtained, or whether national law permits the use. Those questions belong to the judicial or independent authority that grants authorisation, the market surveillance and fundamental rights bodies that oversee the use, and the Member State law that governs it. Suppliers and law enforcement bodies should not proceed on the basis of this guide alone, and should confirm the position with the competent authority and legal adviser in the Member State concerned before any deployment.

Frequently asked questions

Continue through this AI Act cluster

• prohibited practices under Article 5
• biometric categorisation prohibition
• Annex III biometric uses
• the risk-based approach
• enforcement and market surveillance
• Understand AI Act risk categories