Is Biometric AI High-Risk Under the EU AI Act? (Annex III)
Biometric AI sits on the sharpest edge of the EU AI Act. Some uses are outright banned under Article 5; the rest are high risk under Annex III point 1. Getting the line right matters — the penalties differ enormously.
What Annex III(1) covers
- Remote biometric identification systems
- Biometric categorisation by sensitive attributes
- Emotion-recognition systems
Who’s affected
Vendors of facial-recognition, voice-ID or emotion-analytics systems, and any organisation deploying them — security, retail analytics, access control, HR. Note that untargeted facial-recognition scraping and most emotion recognition at work or school are prohibited outright (Art. 5), not merely high-risk.
Why it’s high risk
Where not prohibited, biometric systems are high risk under Annex III(1). Both the provider and the deployer carry duties, and biometrics also triggers heightened data-protection scrutiny under the GDPR (special-category data).
Obligations to prepare for
FAQ
Is facial recognition banned under the EU AI Act?
Some uses are: real-time remote biometric identification in public spaces for law enforcement is prohibited except in narrow cases, and untargeted scraping of facial images to build databases is banned. Other biometric identification is high-risk, not prohibited.
Is emotion recognition high-risk or prohibited?
Emotion recognition is prohibited in the workplace and in education (Art. 5). Elsewhere it is high-risk under Annex III(1), unless used purely for medical or safety reasons.
Being high-risk sets the obligations; your role decides who owns them. See provider vs deployer duties.
The free checker classifies it deterministically in 2 minutes — no sign-up.