Biometrics in the EU: Navigating the GDPR and AI Act
Biometric technologies have long been utilized for identifying individuals, primarily in the realms of security and law enforcement. However, their applications are expanding rapidly into various new domains. This shift is driven by advancements in artificial intelligence, enabling biometric technologies to infer a person’s emotions, personality traits, and other characteristics based solely on their physical features.
These technologies are increasingly deployed across multiple settings: businesses analyze facial expressions to gauge customer sentiment and evaluate job candidates, employers use monitoring tools to measure employee focus, and online platforms leverage biometric software to enforce age restrictions.
Regulatory Landscape
The European regulatory framework has evolved in response to this changing landscape. Since 2018, the EU General Data Protection Regulation (GDPR) has governed the processing of biometric data as a form of personal data and, when used to uniquely identify individuals, as special category data. The processing of special category data is generally prohibited unless the individual provides explicit consent or another condition under Article 9(2) applies.
Building on this foundation, the EU AI Act introduces a new layer of regulation that targets four types of biometrics, classifying them by risk — ranging from prohibited to high risk and limited risk — based on their purpose and context of use.
Types of Biometric Technologies
Remote Biometric Identification
Remote biometric identification systems are AI systems designed to identify individuals without their active participation, typically from a distance. A common example is facial recognition software that scans CCTV footage to identify people in real-time or retrospectively by matching images against a biometric database. This definition notably excludes biometric verification and authentication tools, such as fingerprint scanning used for building access control or unlocking smartphones, which involve the individual’s active participation.
Under the AI Act, the use of real-time remote biometric identification systems is prohibited for law enforcement purposes, except in narrowly defined circumstances. All other uses of remote biometric identification systems are permitted but classified as high risk, which triggers a range of compliance obligations, including requirements around risk management, data governance, human oversight, and registration in the EU’s database.
Biometric Categorization
Biometric categorization systems are AI systems that assign individuals to specific categories based on their biometric data. These categories may relate to innocuous traits, such as age or eye color, or more sensitive attributes like sex, ethnicity, personality traits, and personal affiliations. However, the definition excludes biometric categorization that is purely ancillary to commercial services, such as virtual try-on features or facial augmentation in online marketplaces.
Under the AI Act, biometric categorization systems categorizing individuals according to certain prohibited characteristics — including race, political opinions, trade union membership, religion, and sexual orientation — are banned, with limited exceptions for labeling or filtering biometric datasets and certain medical, safety, and law enforcement uses. Biometric categorization systems involving other sensitive characteristics are classified as high risk, triggering obligations equivalent to those for remote biometric identification systems.
Emotion Recognition
Emotion recognition systems are AI systems designed to identify or infer an individual’s emotions or intentions based on their biometric data. The AI Act distinguishes between emotion inference — which is regulated — and the detection of readily apparent expressions or physical states — which is not regulated. For example, a system that identifies whether someone is smiling or tired is not considered an emotion recognition system, whereas a system that interprets facial expressions to conclude that a person is happy, sad, or amused falls within the scope.
The AI Act prohibits emotion recognition systems in workplace and educational settings, except where strictly necessary for medical or safety purposes. In other contexts, they are classified as high risk and subject to extensive compliance requirements.
Facial Recognition Databases
Lastly, the AI Act prohibits the development or expansion of facial recognition databases through the untargeted scraping of facial images from the internet or CCTV footage. This prohibition is absolute and has no exceptions, specifically applying to facial images and not extending to biometric databases built using other types of biometric data, such as voice recordings.
Navigating the Overlap
The intersection of the GDPR and the AI Act creates a layered regulatory framework for biometric technologies in the EU. While the prohibitions under the AI Act took effect in February 2025, the rules for high-risk and limited-risk systems will not apply until August 2026. During this interim period, organizations face overlapping obligations that present significant compliance challenges.
Navigating this overlap requires a careful mapping of roles and responsibilities across both frameworks. A company utilizing a biometric tool internally may act simultaneously as a controller under the GDPR and a deployer under the AI Act, triggering distinct compliance obligations. Furthermore, providers of biometric tools — who may typically consider themselves processors under the GDPR — face the most extensive requirements under the AI Act, particularly for high-risk systems.
The AI Act’s risk classifications are complex, making it challenging to determine whether a system is prohibited, high, or limited risk. This requires a nuanced understanding of the technology and the specific context of its use.
Moreover, the substantive requirements for high-risk systems represent a significant operational and financial undertaking. Providers of these systems must implement a comprehensive set of safeguards — including risk management procedures, data quality and governance controls, post-market monitoring, logging mechanisms, and human oversight — while deployers have related but more limited obligations.
These challenges mark a shift away from the GDPR’s compliance model rooted in notice and consent to one demanding proactive, risk-based life cycle governance. Effective compliance thus requires not only a strong grasp of the legal framework but also a deep understanding of the underlying technology, its intended use, and the organization’s role within the AI supply chain.
