Real-life application of AI Actu in practice: the first decision on biometric identification

AI Act and biometric identification: why it is a sensitive topic

Artificial intelligence working with biometrics (such as facial recognition) is one of the riskiest technologies, according to AI Act. The reason is obvious: It allows you to identify specific people, track their movements and behaviour, and potentially create detailed profiles without their knowledge.

Therefore, the AI Act essentially prohibits real-time remote biometric identification in public spaces. However, it does allow for exceptions, typically for the prevention of serious crime or the search for specific individuals. It is these exceptions that are formulated rather generally – and their practical application has so far been rather theoretical.

First practical decision: preamble paragraph 35 comes to life

A recent court decision is interesting in that it explicitly relies on paragraph 35 of the AI Act’s preamble. This emphasises that when assessing the admissibility of the use of biometric identification, the specific circumstances of the case and the impact on the fundamental rights of the persons concerned must be taken into account.

The authority which decided on the authorisation did not only focus on whether the technology was technically functional. In particular, it considered:

• whether it is a publicly accessible space and how that concept is defined,
• how precisely the use of the system is limited in territory and time,
• what the purpose of the AI deployment is and whether it cannot be achieved by less invasive means,
• what safeguards are set up to protect fundamental rights (privacy, data protection, freedom of movement).

This approach confirms that the preamble of the AI Act is not just a “non-binding introduction” but an important interpretative guide.

The implications for companies and institutions

The decision sends a clear signal to anyone considering the use of AI systems working with biometric data. It is not enough to rely on technology alone to deliver security or efficiency. Legal and ethical considerations are key.

Companies and public institutions should expect that widespread and preventative AI tracking of individuals will be highly problematic, and any deployment of biometric AI must have a clear, legitimate and narrowly defined purpose. In addition, a thorough impact assessment on fundamental rights and documentation will be required and internal rules will play a crucial role in any controls.

When is an interference with rights disproportionate?

One of the most important aspects of the decision is the emphasis on proportionality. In other words, even if the objective is legitimate (e.g. protection of security), any technological tool cannot be used without further consideration.

For example, the use of AI for biometric identification may be disproportionate if:

• it is not targeted at specific individuals but at the general public,
• it takes place over a long period of time without a clear time limit,
• there is a lack of transparency towards the public,
• the risks of misuse or error of the system are not sufficiently addressed.

What we recommend from a legal point of view

If you are considering implementing higher risk AI systems, it pays to proceed with caution. Analyse which AI Act risk category your system falls into. Prepare for a fundamental rights and data protection impact assessment and set up internal processes to demonstrate the legality and proportionality of the solution. Then consult with experts before deploying the technology.

Not sure if your AI solution is legal? Contact us for a quick legal analysis.