Biometric AI under Annex III point 1
Point 1 is the only Annex III domain that sits directly against a prohibition. The same technology can be banned under Article 5, high-risk under Annex III, or out of scope entirely, and the difference is often a single design decision about whether you are identifying someone or confirming who they say they are.
80 days to 2 December 2026 — two new Article 5 prohibitions, and Article 50(2) marking for generative systems already on the market. Full timeline →
Is facial recognition high-risk under the EU AI Act?
It depends on what it does. Remote biometric identification systems are high-risk under Annex III point 1(a).
Reg. (EU) 2024/1689 as amended by Reg. (EU) 2026/1744 · more questions on this page
Does this reach your organisation?
- Yes if you place an AI system on the EU market, or put one into service in the EU, wherever you are established.
- Yes if you are established in the EU and use an AI system under your own authority.
- Yes if you are outside the EU and the output your system produces is used in the Union.
No EU entity and no EU customers of record is not an exemption. Article 2 turns on market placement and on where output is used. Check your position in 12 questions →
The sub-points
Classification turns on the intended purpose of the system, not on your sector. Read the sub-point that matches what the system is for.
| Described purpose | What to watch | |
|---|---|---|
| (a) | Remote biometric identification systems | Excludes biometric verification whose sole purpose is confirming that a person is who they claim to be. |
| (b) | Biometric categorisation according to sensitive or protected attributes or characteristics, based on inference of those attributes | Categorisation to deduce race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation is prohibited under Article 5, not high-risk. |
| (c) | Emotion recognition | Emotion inference in the workplace and education institutions is prohibited under Article 5, except for medical or safety reasons. |
Where this usually goes next
Three situations account for most people reading this page. Each has a different answer.
A deal is blocked on an AI questionnaire
Legal will not sign until you can evidence how AI is governed. HumanAudit’s AI Trust Package is a fixed $3,500 over five business days: a public trust page, a pre-filled SIG Lite / CAIQ / SSPA Section K questionnaire bank, and your AI inventory and classification.
You need ISO/IEC 42001 documentation
23 clause-mapped AIMS documents with all 38 Annex A controls pre-populated, editable and yours to keep, from $199. Or score your gaps first: 18 questions, free, no signup to begin.
You are not sure what reaches you
A request for information from the AI Office asks which AI systems you run, what each is for, which role you hold, and what is documented. The reply itself is penalty-bearing. Twenty minutes covers the same ground while nothing turns on the answer.
This reference is published by HumanAudit Inc. Not a law firm, not an accredited certification body, not a registered auditor. We build documentation, your counsel interprets it, and an accredited body of your choosing certifies you. How this is funded →
What this typically catches
- Access control using face or fingerprint matching against an enrolled identity
- Retail or venue systems that identify individuals from camera feeds
- Age or demographic estimation from images
- Voice or facial emotion analysis in customer service, market research or automotive
- Post-event forensic identification from recorded footage
Expert analysis. This list is our reading of common deployments against the described purposes, not an authoritative classification. Each system needs its own assessment against its own intended purpose.
Verification versus identification is the whole ballgame
Verification is one-to-one: the person asserts an identity, and the system confirms it. Unlocking a phone. Matching a passport photo to the person holding it. Point 1(a) expressly excludes this where confirming the claimed identity is the sole purpose.
Identification is one-to-many: the system searches a gallery to work out who someone is, without a claim to check against. That is inside point 1(a).
The trap is a system that does both, or one that started as verification and grew a watchlist feature. The moment there is a gallery search, the exclusion stops applying, and the exclusion is drafted around sole purpose, so a secondary identification capability defeats it.
The other line to hold: real-time remote biometric identification in publicly accessible spaces for law enforcement is prohibited under Article 5, subject to narrow exhaustively listed exceptions. Post-remote identification, after the fact, on recorded material, is high-risk under point 1(a), not prohibited. Same technology, different legal universe, decided by timing.
Biometric data is special category data
The AI Act is rarely the only instrument in play for this domain. These apply alongside it and are not discharged by AI Act conformity.
- GDPR Article 9. Biometric data processed for the purpose of uniquely identifying a natural person is a special category. You need an Article 9(2) condition, not just an Article 6 lawful basis. This is usually the harder gate, and it bites before the AI Act does.
- Article 5 sits above this point. Real-time remote biometric identification in public for law enforcement, biometric categorisation to deduce protected traits, and emotion inference at work or in education are prohibited, check those before classifying as high-risk.
- Article 50(3). Deployers of emotion recognition and biometric categorisation systems must inform the people exposed to them. Live since 2 August 2026, whatever happens in 2027.
- National biometric rules. Several member states impose additional conditions on biometric processing in employment and public spaces.
Worked example: a venue access system
A stadium deploys cameras at entry gates. Ticket holders scan a pass; the system confirms the face matches the photo on the registered ticket. Verification, one-to-one, sole purpose confirming a claimed identity — outside point 1(a).
The operator then adds a banned-supporter watchlist. Every face at the gate is now checked against a gallery. That is identification, one-to-many, and the “sole purpose” wording in the exclusion no longer holds. The system moves inside point 1(a) with no change to the hardware.
They then add sentiment analysis to flag agitated crowds. Emotion recognition, point 1(c), and if the same system is used on staff areas, the Article 5 prohibition on emotion inference in the workplace is in play. One deployment, three different legal positions, none of them announced by a procurement decision.
Can you use the Article 6(3) derogation?
Weak. A remote identification system performs profiling of natural persons in most deployments, and the Article 6(3) profiling override makes the derogation unavailable outright where it does. Emotion recognition and categorisation systems evaluate personal aspects of identified individuals, which is the definition of profiling in GDPR Article 4(4).
Whatever your conclusion, Article 6(4) requires the assessment to be documented before the system is placed on the market or put into service, you still register under Article 49, and Article 80 gives a market surveillance authority a procedure to challenge the classification. The derogation in full →
What applies if it is high-risk
The full Chapter III Section 2 set from 2 December 2027: risk management, data governance, the Annex IV technical file, logging, instructions for use, human oversight, accuracy and security, quality management, conformity assessment, registration, post-market monitoring and incident reporting. Every obligation, article by article →
Live now regardless of 2027: Article 4 AI literacy, and Article 50 transparency if the system interacts with people or generates synthetic content.
Status labels on this page
Verified fact: The Annex III point 1 sub-point text, the Article 6(3) and 6(4) mechanics, the Article 80 challenge procedure, and the 2 December 2027 application date.
Expert analysis: The 'what this typically catches' list, the derogation assessment, and the worked edge case above.
Unsettled: The final content of the Commission's Annex III guidelines, which remain in draft and out for consultation.
Classification is a document, not an opinion
Whichever way this lands, the artefact is a dated assessment naming who decided, which sub-point was considered, and why the derogation does or does not apply. That is what Article 6(4) asks for and what Article 80 tests.
Is the derogation available?
Four conditions, one absolute profiling override, and a documentation duty that runs before market placement.
Frequently asked
Is facial recognition high-risk under the EU AI Act?
It depends on what it does. Remote biometric identification systems are high-risk under Annex III point 1(a). Biometric verification whose sole purpose is confirming a person is who they claim to be is excluded from that point. Real-time remote biometric identification in publicly accessible spaces for law enforcement purposes is prohibited under Article 5, subject to narrow exceptions, rather than high-risk.
Is emotion recognition banned in the EU?
Only in specific contexts. Article 5 prohibits inferring emotions in the workplace and in education institutions, except where the system is intended for medical or safety reasons. Emotion recognition outside those contexts is high-risk under Annex III point 1(c) and also carries the Article 50(3) transparency obligation requiring deployers to inform the people exposed to it.
Does biometric access control at our office make us high-risk?
If the system confirms that a person is who they claim to be and that is its sole purpose, point 1(a) excludes it. If it identifies people by searching a gallery, or has a watchlist or identification capability alongside verification, the exclusion is unlikely to hold because it is drafted around sole purpose.
What happens if this is not in order
Enforcement powers have applied since 2 August 2026. The AI Office can issue requests for information, evaluate models, interview staff and inspect premises. Three reporting channels are live: a public complaint tool, a whistleblower tool your own staff can use securely, and a complaints channel for downstream customers.
Penalties run to €35M or 7% for Article 5 prohibitions and €15M or 3% for other operator obligations including high-risk and Article 50. Separately, an incorrect or misleading reply to a request for information carries up to €7.5M or 1% — you can be substantively compliant and still penalised for how you answered. What is enforceable today →