Real-time remote biometric identification
Real-time remote biometric identification (RBI) is identifying people from biometric data at a distance, live, in publicly accessible spaces. Its use by law enforcement is prohibited by Article 5 except in narrowly defined, authorised situations.
The Article 5 exceptions are exhaustive: targeted searches for specific victims of abduction, trafficking or sexual exploitation and for missing persons; prevention of a specific, substantial and imminent threat to life or physical safety, or a genuine and present or foreseeable threat of a terrorist attack; and the localisation or identification of a person suspected of a criminal offence listed in Annex II punishable by a custodial sentence of at least four years. Each use requires prior authorisation by a judicial or independent administrative authority, save for duly justified urgency where authorisation is sought without undue delay, plus a fundamental-rights impact assessment, registration in the EU database, and notification of the relevant authorities. Member States must legislate to permit any of it at all.
- Art. 5(1)(h)
- Art. 5(2)
- Art. 5(3)
- Annex II
- Annex III(1)
Real-time remote biometric identification: why it matters
This is the provision the Act's public debate was largely about, and it is drawn narrowly enough that most commercial deployments are simply out of the question. The scope boundaries are precise and consequential: real-time means live or near-live, remote means at a distance without the person's active involvement, and publicly accessible space excludes systems used for one-to-one verification such as unlocking a phone or passing a gate with consent. Getting those boundaries wrong is the difference between an ordinary product and a prohibited practice.
Real-time remote biometric identification in practice
A stadium operator wanting to identify banned individuals from live camera feeds is not a law-enforcement authority and cannot rely on any Article 5 exception, so the deployment is off the table. The same operator running a voluntary season-ticket gate where holders present themselves for one-to-one verification is doing something categorically different — verification, not remote identification — and is regulated as a high-risk biometric system under Annex III rather than prohibited.
Real-time remote biometric identification: the mistake people make
Conflating identification with verification. One-to-one biometric verification, where a person actively presents themselves to confirm they are who they claim, is not remote biometric identification. Post-hoc identification against recorded footage is also outside the real-time ban, though it carries its own high-risk obligations and safeguards.
Real-time remote biometric identification: common questions
- Is live facial recognition banned in the EU?
- For law enforcement in publicly accessible spaces it is prohibited except in three narrow, judicially authorised situations. Private-sector real-time remote identification in public spaces has no exception route available to it at all.
- Is face unlock on a phone covered?
- No. That is one-to-one biometric verification, where the person actively presents themselves to confirm a claimed identity. The prohibition targets remote identification of people who are not actively participating.
- What about identifying people from recorded footage afterwards?
- Post-remote biometric identification is not caught by the real-time prohibition, but it is a high-risk use under Annex III and carries its own authorisation and safeguard requirements when used for law enforcement.
Real-time remote biometric identification: terms that come up alongside it
Run the free 2-minute EU AI Act checker — no sign-up.