Biometric AI Under the EU AI Act: High-Risk, Prohibited, or Neither

Biometrics is the one Annex III use case where the same underlying technology can land in three completely different places: prohibited, high-risk, or minimal-risk. A phone's face-login and a public surveillance camera both "do face recognition" — but one is unregulated and the other is banned. Annex III point 1 of Regulation (EU) 2024/1689 sets out the high-risk band, and it carries a feature unique among the Annex III points: a notified body is involved in the conformity assessment. This page draws all three lines.

The high-risk regime for stand-alone Annex III systems applies from 2 December 2027 under the Digital Omnibus, adopted by the European Parliament and Council in June 2026 (see the note below).

---

High-risk: Annex III point 1

Three families of biometric AI are high-risk under Annex III point 1, where the use is not otherwise prohibited:

• Remote biometric identification systems (post / non-real-time). Identifying people by comparing their biometric data against a reference database, after the fact rather than live. This is the high-risk cousin of the prohibited real-time variant.
• Biometric categorisation by sensitive or protected attributes. Systems that sort people into categories based on biometric data — where that categorisation is not itself prohibited.
• Emotion recognition. Systems inferring a person's emotional state from biometric data — again, where the use is not prohibited.

The defining word in each line is where not prohibited. Annex III point 1 is the residual high-risk band that catches biometric uses which survive the Article 5 filter. So you always check Article 5 first.

---

Draw the prohibited line — four bans to clear

Several biometric uses are not high-risk but banned outright under Article 5, in force since 2 February 2025, with breaches in the top tier (up to €35,000,000 or 7%, Article 99(3)):

• Real-time remote biometric identification in publicly accessible spaces for law-enforcement purposes — prohibited, Article 5(1)(h) (narrow, pre-authorised exceptions only). This is the headline ban: live public face recognition by police.
• Untargeted scraping of facial images from the internet or CCTV to build or expand facial-recognition databases — prohibited, Article 5(1)(e).
• Biometric categorisation that infers sensitive attributes — race, political opinions, trade-union membership, religious or philosophical beliefs, sex life or sexual orientation — prohibited, Article 5(1)(g) (with a narrow exception for lawful labelling/filtering of lawfully acquired datasets in law enforcement).
• Emotion recognition in the workplace and in education — prohibited, Article 5(1)(f) (except for medical or safety reasons). Note this carefully: emotion recognition is high-risk in some settings under Annex III point 1, but prohibited in workplace and education. Do not write workplace emotion recognition as "high-risk."

---

And the minimal-risk floor: 1:1 verification

At the other end, one-to-one biometric verification — confirming a person is who they claim to be, by matching them against a single stored template — is not Annex III point 1 and carries no mandatory obligations. Logging into your phone with your face, or authenticating into an app with a fingerprint, is verification, not identification against a database. It sits in the minimal-risk band. The distinction between identification (one-to-many, against a database) and verification (one-to-one, against a claimed identity) is the hinge of this whole analysis.

---

The conformity twist: a notified body (Annex VII)

Here is what makes point 1 different from the rest of Annex III. For most Annex III high-risk systems (points 2–8), the provider self-assesses through the internal-control route under Annex VI. For Annex III point 1 biometrics, the provider must use the notified-body route under Annex VII where the relevant harmonised standards have not been applied, or applied only in part — meaning an independent, EU-accredited third party reviews the technical documentation and quality management system before the system can be CE-marked.

In practice: if you build a high-risk biometric system, budget for an external conformity-assessment body, not just an internal sign-off. This is the single biggest operational difference between point 1 and the rest of Annex III, and it lengthens the runway to market. The route is selected under Article 43; the CE marking follows under Article 48, the Declaration of Conformity under Article 47 (Annex V).

---

The deadline note

The deferral to 2 December 2027 is adopted: the European Parliament passed it on 16 June 2026 and the Council adopted it on 29 June 2026. It enters into force on publication in the Official Journal, expected before 2 August 2026 — a formality, not an open question. Plan against 2 December 2027 for stand-alone high-risk Annex III systems. The Article 5 biometric prohibitions are already in force and do not move.

---

Worked example: a biometric vendor and its airport customer

Iris Systems GmbH — a fictional 70-person German biometrics vendor (~€14M turnover) — sells a passenger-identification tool to Nordhafen Airport Authority, a fictional public operator. The tool matches passengers, after the fact, against a watchlist database from recorded footage.

• That is post (non-real-time) remote biometric identification — high-risk under Annex III point 1, not prohibited (the prohibition targets the real-time public-space variant for law enforcement).
• Iris Systems is the provider (Article 16). Because this is point 1, it must use the Annex VII notified-body conformity route under Article 43 unless it fully applies the harmonised standards — an external body reviews its technical file (Art 11 / Annex IV) and quality management system (Art 17). As an SME, its penalty exposure is capped at the lower figure under Article 99(6).
• Nordhafen Airport is the deployer (Article 26) and, as a public-service body, must complete the Article 27 FRIA before first use and register the system (Art 49). Human oversight under Article 14 carries a special rule here: for remote biometric identification, Article 14(5) requires that no action be taken on an identification unless at least two competent persons separately verify and confirm it.
• The line they cannot cross. If the airport instead ran live identification in the public concourse for a law-enforcement purpose, that would flip to prohibited under Article 5(1)(h) — outside the narrow exceptions, no compliance route exists.

Same vendor, same database — and a single switch from "post" to "real-time, public, law-enforcement" moves the system from high-risk to banned.

---

How Confir helps

Confir's classification logic runs the Article 5 biometric prohibitions first — real-time public RBI (5(1)(h)), facial scraping (5(1)(e)), sensitive categorisation (5(1)(g)), workplace/education emotion recognition (5(1)(f)) — then tests the residual use against Annex III point 1, and flags 1:1 verification down to minimal. Crucially, for point 1 systems it routes the conformity step to Annex VII (notified body) rather than the internal-control default, so you are not caught out by the third-party requirement late in the project. The engine is deterministic and rule-based, citing the Article or Annex point behind every finding.

Related guides

• Remote biometric identification (high-risk)
• Biometric categorisation AI
• Real-time biometric prohibition (Article 5)
• Face recognition in public spaces
• Notified body — what it is
• Conformity assessment explained