EU AI Act & biometrics: what's banned vs high-risk

Biometric AI is the one area where the EU AI Act draws two lines, not one: some uses are outright prohibited under Article 5, others are high-risk under Annex III, point 1. Getting the split right matters — a prohibited system cannot be fixed with paperwork. Here is a plain-English map.

What is prohibited (Article 5)

You cannot deploy these at all:

• Emotion recognition in the workplace or in education (except for medical or safety purposes, e.g. driver-fatigue detection).
• Biometric categorisation that infers sensitive attributes — race, political opinions, trade-union membership, religion, sex life or sexual orientation.
• Untargeted scraping of facial images from the internet or CCTV to build or expand recognition databases.
• Real-time remote biometric identification in publicly accessible spaces for law enforcement (with narrow, authorised exceptions).

What is high-risk (Annex III point 1)

Permitted, but with the full high-risk obligations:

• Remote biometric identification systems — except pure verification (1:1 confirmation that you are who you claim to be).
• Biometric categorisation by non-sensitive attributes.
• Emotion recognition outside the workplace and education, where it is not otherwise prohibited.

One-to-one verification is largely out of scope

Simple identity verification — unlocking a phone, confirming a returning user 1:1 — is not remote biometric identification and generally falls outside the high-risk category. The high-risk trigger is 1-to-many identification against a database.

What high-risk biometrics requires

For the permitted high-risk uses: human oversight, bias and accuracy testing across demographic groups, data governance, the Annex IV technical file, registration and post-market monitoring.

Where to start

Not sure which side of the line your system sits on? The free EU AI Act Snapshot returns your tier — including a prohibited flag — in two minutes. The plans start at €0.