AI Biometric Categorisation Under the EU AI Act: When It Is High-Risk and When It Is Banned
AI biometric categorisation is high-risk under Annex III point 1(b) unless it infers sensitive attributes, which Article 5(1)(g) bans. The bright line.
It depends on one thing: what your system infers. A biometric categorisation system — an AI system that assigns natural persons to categories on the basis of their biometric data (Article 3(40)) — is high-risk under Annex III point 1(b) unless it crosses into the prohibited zone. The line is drawn by Article 5(1)(g): the moment a system deduces or infers a sensitive attribute, it stops being a high-risk system you can deploy with paperwork and becomes a banned practice. This guide covers stand-alone biometric categorisation, not the identification sibling.
The stakes ride on the difference. Prohibited practices attract fines of €35 million or 7% of total worldwide annual turnover, whichever is higher (Article 99(3)); high-risk non-compliance sits at €15 million or 3% (Article 99(4)). The prohibition is live now, applied since 2 February 2025.
The Bright Line: High-Risk by Default, Prohibited When It Infers Sensitive Attributes
Biometric categorisation is listed as high-risk under Annex III point 1, sub-point 1(b) — that is the default. But Article 5(1)(g) carves a banned tier out of it: categorisation that deduces or infers a protected attribute is prohibited, not high-risk.
The one question that decides the tier
Ask what the system infers. If it deduces or infers race or ethnic origin, political opinions, trade-union membership, religious or philosophical beliefs, or sex life or sexual orientation, it is prohibited. Full stop. No conformity assessment and no documentation package makes it lawful. Everything else stays high-risk under point 1(b): age-band gating, demographic segmentation for anonymous analytics, apparent-emotion grouping outside the workplace and education contexts — lawful only after the full obligation stack is in place. The tier is decided by what the model actually deduces about a person, not by the vendor's marketing label.
Why categorisation is treated differently from identification
The Act treats the two as separate limbs of Annex III point 1 with different prohibited-tier triggers: identification implicates the Article 5(1)(h) real-time remote identification ban, categorisation the Article 5(1)(g) sensitive-attribute ban. A categorisation system clears the Article 5(1)(g) test, not the Article 5(1)(h) test.
What Article 5(1)(g) Prohibits — and the Two Narrow Exceptions
Article 5(1)(g) bans placing on the market, putting into service, or using AI systems that categorise natural persons individually on the basis of their biometric data to deduce or infer the listed sensitive attributes.
The prohibited sensitive-attribute list
The banned inferences are race or ethnic origin, political opinions, trade-union membership, religious or philosophical beliefs, and sex life or sexual orientation. The prohibition does not turn on accuracy: attempting the inference is itself prohibited, and regulators examine design intent, configuration, and actual use — not just the label on the box.
The dataset-labelling and law-enforcement carve-outs
Two exceptions exist, both read strictly. First, lawful labelling or filtering of biometric datasets already lawfully acquired — a data-governance operation, not a deployed inference engine. Second, categorisation by law enforcement, subject to the Act's additional safeguards. Outside these two carve-outs, there is no pathway: the prohibition has applied since 2 February 2025, and no documentation, conformity assessment, or notified-body sign-off makes a prohibited categorisation system lawful.
What Stays High-Risk Under Annex III Point 1(b)
Categorisation that does not touch the Article 5(1)(g) list is high-risk under point 1(b): age-band gating, broad anonymous audience analytics, apparent-emotion grouping outside the Article 5(1)(f) workplace-and-education ban — lawful, but inside the stack.
Permitted categorisation that is still high-risk
Article 6(2) makes Annex III listing the trigger for high-risk status. The Article 6(3) filter can exempt a system that performs a narrow procedural or preparatory task — but it never applies to a system that profiles natural persons, and biometric categorisation profiles them almost by definition, so the filter rarely rescues a categorisation system.
The Article 6(3) profiling carve-out trap
The trap is the narrowness of the line. A system that groups people by age band is high-risk; re-tuned to infer ethnicity, it is prohibited. Operators must document that their categorisation logic cannot be used to infer any Article 5(1)(g) attribute, or they risk sliding into the banned tier without noticing. One adjacency to keep separate: emotion recognition in workplaces and educational institutions is prohibited under Article 5(1)(f), a different ban from 5(1)(g); apparent-emotion grouping outside those settings can remain high-risk.
Categorisation vs Identification: Point 1(b) Is Not Point 1(a)
Both limbs sit in Annex III point 1 and carry the high-risk stack, but they answer different questions. Identification (point 1(a)) matches biometric data against a reference database to establish who someone is; categorisation (point 1(b)) assigns a person to a category without establishing identity. One-to-one verification — confirming a claimed identity against a single template, as in phone face-unlock or an airport e-gate — is neither, and falls outside Annex III point 1 entirely.
Where each triggers a prohibition
| Dimension | Identification — point 1(a) | Categorisation — point 1(b) |
|---|---|---|
| Core question | Who is this person? | What category does this person fall into? |
| Output | A matched identity | A category label (age band, emotion, demographic) |
| Relevant prohibition | Article 5(1)(h) real-time remote identification ban | Article 5(1)(g) sensitive-attribute inference ban |
| Typical example | Matching CCTV footage against a database | Estimating apparent age band from a selfie |
| High-risk if not prohibited | Annex III point 1(a) | Annex III point 1(b) |
Obligations If Your Categorisation System Is High-Risk
Once a categorisation system clears the Article 5(1)(g) test and is confirmed high-risk under point 1(b), the full stack applies.
The provider obligation stack
Providers carry Article 9 lifecycle risk management, Article 10 data governance and bias assessment, Article 11 and Annex IV technical documentation before market placement, Article 13 transparency to deployers, Article 14 human oversight by design, Article 15 accuracy, robustness, and cybersecurity, and Article 16 provider duties overall.
Notified-body conformity assessment
Article 43 is where biometrics diverges from most of Annex III. Most categories allow the Annex VI internal-control route, where the provider self-certifies. Annex III point 1 biometric systems are the exception: a notified body (the Annex VII third-party procedure) is required unless harmonised standards covering all applicable requirements have been applied — and as of mid-2026, no such standards fully cover biometric AI, so an accredited assessor must audit the technical file before market placement. The provider must then register under Article 49, run post-market monitoring under Article 72, and report serious incidents under Article 73.
Deployer duties: Article 50(3) disclosure and Article 27 FRIA
Article 26 requires use within the intended purpose and at least six months of log retention. A duty unique to this category: Article 50(3) requires deployers to inform the natural persons exposed to a biometric categorisation system — and this transparency duty applies regardless of whether the system is high-risk. Public bodies and public-service providers must also complete a fundamental rights impact assessment under Article 27 before first deployment. And a role-flip warning: under Article 25, a deployer becomes a provider on rebranding, substantial modification, or a change of intended purpose to a high-risk one.
Worked Example: Apparent-Age Gating at a Mid-Size Gaming Operator
Ludoria, a 220-person online gaming operator, deploys a third-party AI system that estimates a user's apparent age band from a selfie to gate age-restricted features. No identity is established; no sensitive attribute is inferred.
It categorises by apparent age, not identity — so it is not point 1(a) identification. It does not deduce any Article 5(1)(g) attribute — so it is not prohibited. It is high-risk under Annex III point 1(b). The contrast trap is one configuration change away: if the vendor re-tuned the model to infer ethnicity or sexual orientation, it would flip to prohibited under Article 5(1)(g). The architecture is identical; the inference is everything.
On the lawful path, the provider (the SaaS vendor) prepares Article 11 technical documentation, completes an Article 43 notified-body assessment under Annex VII, and registers under Article 49. Ludoria as deployer keeps use within the intended purpose (Article 26), informs users under Article 50(3), retains six months of logs, reports serious incidents under Article 73, and runs a GDPR Article 9 special-category lawful basis in parallel, since EU AI Act conformity does not satisfy data-protection law.
Deadlines: Which Dates Apply When
The prohibition and the high-risk obligations move on different clocks, and confusing them is the most common planning error in this category.
Applying now vs deferred
The Article 5(1)(g) and Article 5(1)(f) prohibitions have applied since 2 February 2025 — current law, no deferral. The high-risk Annex III obligations for Article 6(2) systems, including point 1(b) categorisation, apply from 2 December 2027, the date set by the Digital Omnibus, adopted by the European Parliament on 16 June 2026 and by the Council on 29 June 2026. The Article 50(3) transparency duty is unaffected and applies from 2 August 2026.
The Digital Omnibus high-risk dates
Stand-alone Annex III high-risk obligations apply from 2 December 2027; product-embedded Annex I systems from 2 August 2028. Plan against 2 December 2027 for the high-risk stack. The actionable point sits earlier: the prohibition is live now, so your first compliance step — confirming you are not in the banned tier — does not wait for any deferral.
How Confir Helps
Three things Confir's rule-based engine does for biometric categorisation:
-
Tier classification at the bright line. The intake questionnaire applies the Article 5(1)(g) prohibited test before the Annex III point 1(b) high-risk test, returning either a stop-deployment finding or a compliance-programme finding, with the rule that fired shown in plain text. The engine is deterministic and rule-based — no model inference, no hallucination.
-
Notified-body readiness documentation. Confir structures the Article 11 and Annex IV technical documentation pack for Annex VII review — data governance (Article 10), accuracy and robustness (Article 15), risk register (Article 9), and human oversight (Article 14).
-
Deployer disclosure and FRIA workflow. Confir maps the Article 50(3) disclosure duty and, for Article 27 deployers, runs the structured fundamental rights impact assessment.
Frequently Asked Questions
Is AI biometric categorisation banned or just high-risk under the EU AI Act?
It depends on what the system infers. Article 5(1)(g) prohibits biometric categorisation that deduces sensitive attributes — race or ethnic origin, political opinions, trade-union membership, religious or philosophical beliefs, sex life or sexual orientation — banned since 2 February 2025. Any other categorisation, such as age banding or broad demographic analytics, is high-risk under Annex III point 1(b): lawful, but subject to the full obligation stack before deployment. The first compliance step is confirming which side of that line your system sits on.
What is the difference between biometric categorisation and biometric identification?
Identification answers "who is this person?" by matching biometric data against a reference database (Annex III point 1(a)). Categorisation answers "what category does this person fall into?" — by age, apparent emotion, or demographic group — without establishing identity (Annex III point 1(b)). Both are high-risk where not prohibited, but the triggers differ: identification implicates the Article 5(1)(h) real-time remote identification ban, while categorisation implicates the Article 5(1)(g) sensitive-attribute ban. One-to-one verification against a single template is neither, and falls outside Annex III point 1 entirely.
Does high-risk biometric categorisation need a notified body?
Generally yes. Most Annex III categories allow the Annex VI internal-control route, where the provider self-certifies. Article 43 makes Annex III point 1 biometric systems an exception: a notified body (the Annex VII third-party procedure) is required unless harmonised standards covering all applicable requirements have been applied. As of mid-2026, no such standards fully cover biometric AI, so an accredited assessor must audit the technical file before market placement.
Do we have to tell people a biometric categorisation system is being used?
Yes. Article 50(3) requires deployers of a biometric categorisation system to inform the natural persons exposed to it, in a clear and accessible form. This transparency duty applies regardless of whether the system is high-risk — the legislature treats categorisation by physical or behavioural traits as something people are entitled to know about. In practice this means signage, a privacy notice, or an on-screen disclosure at the point of interaction, sitting alongside GDPR transparency requirements.
When do the rules on biometric categorisation apply?
The Article 5(1)(g) prohibition has applied since 2 February 2025 and is current law with no deferral. High-risk obligations for Annex III point 1(b) categorisation apply from 2 December 2027, the date set by the Digital Omnibus adopted by the European Parliament and Council in June 2026. Plan against 2 December 2027. Because the ban is already live, confirm you are not in the prohibited tier now.
What are the penalties for getting biometric categorisation wrong?
Breaching the Article 5(1)(g) prohibition carries the top-tier fine: up to €35 million or 7% of total worldwide annual turnover, whichever is higher (Article 99(3)). Non-compliance with high-risk obligations for permitted categorisation carries up to €15 million or 3% (Article 99(4)). For SMEs and start-ups, Article 99(6) caps the fine at the lower of the percentage or the fixed amount. The gap between the two tiers is why the prohibited-versus-high-risk classification matters most.
Can a permitted high-risk categorisation system slip into the prohibited tier?
Yes, and the line is narrow. A system that groups people by age band is high-risk under Annex III point 1(b); the same architecture re-tuned to infer ethnicity, political opinion or sexual orientation would be prohibited under Article 5(1)(g). Regulators look at design intent, configuration and actual use, not just the stated purpose, so a general-purpose tool deployed to infer sensitive attributes will not escape the ban. Providers must document that their categorisation logic cannot be used to infer any Article 5(1)(g) attribute.
Related guides
- biometric identification under Annex III point 1(a)
- biometric categorisation system definition
- Article 5 prohibited AI practices
- high-risk AI classification
- Article 6 high-risk classification rules
Manage your EU AI Act compliance in one place
Confir automates risk classification, technical documentation, and audit trails for any company. No consultants. No 6-month projects. 14-day free trial.
Start free trial →