Is Biometric Verification High-Risk Under the EU AI Act?

No — and this is one of the most important lines to get right. One-to-one biometric verification — confirming a person is who they claim to be, like a face-login on a phone or a fingerprint at a turnstile — is excluded from the Annex III high-risk biometrics category. The carve-out is explicit in the Act's recitals and definitions. Get this wrong and you scope a heavy high-risk programme onto a system that the Regulation deliberately left out. This page draws the three-way line: verification (minimal), identification (high-risk), and real-time public identification (prohibited).

The verification carve-out, stated plainly

Annex III point 1 covers biometrics, including remote biometric identification systems. But the Act defines that term to exclude verification. A biometric verification system answers a one-to-one question — "is this person the specific individual they claim to be?" — by comparing a fresh sample against one stored template. A phone face-login, logging into a banking app with a fingerprint, badging through an access gate that confirms your enrolled identity: all one-to-one verification.

Recital 54 and the Article 3 definitions are explicit that systems whose sole purpose is to confirm a specific natural person is who they claim to be are not remote biometric identification, and so are not caught by the Annex III high-risk biometrics category. Verification is, in plain terms, outside the high-risk net. That is why the risk level on this page is minimal — the use itself sits outside Annex III.

The line: verification vs identification

Everything hinges on the question the system asks.

Verification is one-to-one and consented-to in nature — you present yourself and the system checks a single claim. Identification is one-to-many — it scans a sample against many stored identities to determine who a person is, often without their active participation. That second case is the high-risk one under Annex III point 1, and it routes through the Annex VII notified-body conformity assessment (biometrics is the one Annex III category that does).

The third tier is sharper still: real-time remote biometric identification of individuals in publicly accessible spaces for law-enforcement purposes is prohibited under Article 5(1)(h), subject to narrow, authorised exceptions. That is not "high-risk with extra steps" — it is a banned practice, in force since 2 February 2025, with the Article 5 penalty ceiling. Never describe public real-time RBI as merely high-risk.

What still applies to verification

"Excluded from Annex III high-risk" does not mean "no rules at all." A verification system processes biometric data, which is special-category data under GDPR Article 9 — so a lawful basis, a DPIA where required (GDPR Article 35), and data-protection-by-design all still apply. The biometrics don't stop being sensitive just because the AI Act leaves the use out of Annex III.

Two AI Act touchpoints can also remain:

• Article 50 transparency may bite if the deployment also does something disclosable — for instance, biometric categorisation or emotion recognition bolted onto the same camera triggers the Article 50(3) notice duty. Pure 1:1 verification does not, but check what else the system does.
• If the verification is embedded as a safety component of a regulated product, that product's own regime governs — assess the function, not the label.

The practical message: treat verification as a GDPR-first problem, not an AI Act high-risk problem.

Why this carve-out exists

The logic is proportionality. Verification is something you do to yourself — you present your own face or finger to confirm a claim you are making. The harm profile of one-to-many surveillance — being picked out of a crowd without your participation — simply is not present. The Act reserves its heaviest biometric obligations (and its Article 5 prohibition) for the identification cases where individuals are matched against many others, frequently without consent. Verification, by contrast, is closer to a password than to surveillance.

Worked example: a fintech's login does not trigger Annex III

NeoPagos S.L., a Spanish fintech with about 55 employees and roughly €11M turnover, lets customers log into its app with face-login. The product team panics — "is our biometrics high-risk?" The answer is no. The face-login is one-to-one verification: it confirms the customer is the specific account-holder they claim to be, matching against that single user's enrolled template. Recital 54 and the Article 3 definitions put it outside Annex III point 1 → minimal-risk under the AI Act.

What NeoPagos does owe is GDPR: the face template is special-category data (GDPR Article 9), so it needs a lawful basis, a DPIA (GDPR Article 35), and biometric-data security. It does not owe the high-risk stack — no Article 9–15 build, no Annex VII notified body, no Article 49 registration. Had NeoPagos instead built a system that scanned an incoming face against its whole customer base to identify who was at the door, that one-to-many identification would be high-risk under Annex III point 1 — a different system, a different answer.

How Confir helps

Confir draws the verification-vs-identification line at intake: a one-to-one verification use is classified as minimal-risk and routed to its GDPR Article 9 obligations rather than the Annex III high-risk stack, while a one-to-many identification use is flagged high-risk (Annex III point 1, Annex VII route) and a real-time public-space law-enforcement use is flagged against the Article 5 prohibition. The engine is deterministic and rule-based, so the same biometric use is classified the same way every time — no guessing which side of the line it falls.

Related guides

• Remote biometric identification explained
• Biometric identification AI: Annex III point 1
• Real-time biometric identification prohibition (Article 5)
• Biometric categorisation under the AI Act
• How Article 6 classifies high-risk AI
• How AI risk classification works