The answer, in detail

Which biometric uses are high-risk?

• Those in point 1 of Annex III. Article 3 draws the lines.
• Biometric identification is the automated recognition of physical, physiological, behavioural or psychological human features to establish a natural person’s identity by comparing their biometric data to biometric data of individuals stored in a database (point (35)).
• Biometric verification is the automated, one-to-one verification, including authentication, of a natural person’s identity against biometric data they provided before (point (36)).
• A biometric categorisation system assigns natural persons to specific categories on the basis of their biometric data, unless it is ancillary to another commercial service and strictly necessary for objective technical reasons (point (40)).
• A remote biometric identification system identifies natural persons without their active involvement, typically at a distance, by comparing their biometric data with a reference database (point (41)).
• Chapter III, Sections 1, 2 and 3, which hold the high-risk requirements and the deployer duties of Article 26, apply from 2 December 2027 for systems classified as high-risk under Article 6(2) and Annex III, with the exception of Article 6(5) (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744).

• Point 1 of Annex III, biometrics, in so far as their use is permitted under relevant Union or national law: (a) remote biometric identification systems, which does not include AI systems intended to be used for biometric verification the sole purpose of which is to confirm that a specific natural person is the person he or she claims to be; (b) AI systems intended to be used for biometric categorisation, according to sensitive or protected attributes or characteristics based on the inference of those attributes or characteristics; (c) AI systems intended to be used for emotion recognition.

Which biometric uses are prohibited?

• Three, each with its own limits.
• Chapters I and II, which hold Articles 4 and 5, apply from 2 February 2025 (Article 113, third paragraph, point (a), as replaced by Regulation (EU) 2026/1744).
• That point keeps two later dates: Article 5(1), first subparagraph, points (ba) and (bb) apply from 2 December 2026, as do Article 5(1a) and (1b).
• Every prohibited practice, point by point: the Article 5 list.

• Article 5(1), first subparagraph, point (e): placing on the market, putting into service for this specific purpose or using AI systems that create or expand facial recognition databases through the untargeted scraping of facial images from the internet or CCTV footage is prohibited.
• Article 5(1), first subparagraph, point (g): placing on the market, putting into service for this specific purpose or using biometric categorisation systems that categorise individually natural persons based on their biometric data to deduce or infer their race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation is prohibited. The prohibition does not cover any labelling or filtering of lawfully acquired biometric datasets, such as images, based on biometric data, or categorizing of biometric data in the area of law enforcement.
• Article 5(1), first subparagraph, point (h): the use of ‘real-time’ remote biometric identification systems in publicly accessible spaces for the purposes of law enforcement is prohibited, unless and in so far as such use is strictly necessary for one of the three objectives the point lists, and then only under the conditions the rest of Article 5 sets. Point (h) is without prejudice to Article 9 of Regulation (EU) 2016/679 for the processing of biometric data for purposes other than law enforcement.

What does a deployer owe?

• For an emotion recognition or biometric categorisation system, telling the people exposed.
• Article 50 applies from 2 August 2026, the general date in Article 113, second paragraph, except that a provider of a system generating synthetic audio, image, video or text content placed on the market before that date has until 2 December 2026 to comply with Article 50(2) (Article 111(4)).

• Article 50(3): a deployer of an emotion recognition system or a biometric categorisation system informs the natural persons exposed to it of its operation, and processes their personal data in accordance with the GDPR and the other Union data protection acts it names, as applicable. The duty does not apply to such systems permitted by law to detect, prevent or investigate criminal offences, subject to appropriate safeguards and in accordance with Union law.

Your customer asks. You answer with proof.

1. 1List every AI system
   Illustration · not your dataSystem Customer support chatbotClass Limited risk · Article 50(1)

   Add the AI you use. Each system gets a role, a risk class and the article it rests on.

   Live
2. 2Attach the proof
   Illustration · not your dataDuty Article 26(6), keep the logsProof logging-policy.pdf · page 3

   Link each duty to a file and the page it stands on: a policy, a log setting, a training record.

   Live
3. 3Answer their questionnaire
   Illustration · not your dataQuestion Do you log AI decisions?Answer drafted from your own proof

   Answering a customer's questionnaire inside the app, from the proof you already linked.

   Coming soon

• AI inventoryLive
• Risk classificationLive
• Article mappingLive
• Obligations per systemLive
• DeadlinesLive
• Annex IV documentationLive
• Documentation draftingLive
• Regulatory change monitoringLive
• Named ownersLive
• Export (PDF, JSON, spreadsheet)Live
• Evidence managementLive
• DashboardLive
• AI literacy (Article 4)Live
• Two-factor sign-inLive
• Audit logLive
• Audit packComing soon
• Customer questionnaires (audit room)Coming soon
• Domain-specific guidanceNot supported
• Full risk-management lifecycleNot supported
• Conformity assessment (Article 43)Not supported
• Post-market monitoring (Article 72)Not supported
• Serious incident reporting (Article 73)Not supported
• Fundamental rights impact assessment (Article 27)Not supported
• Declaration of conformity (Article 47)Not supported
• EU database registration (Article 49)Not supported
• ISO/IEC 42001 mappingNot supported
• Vendor managementLive

Read next

• For your own systems, one by one: Get your free readiness review.
• By tool and industry: the EU AI Act by tool, industry and country, and next to this one Is emotion recognition allowed under the EU AI Act and Is AI fraud detection high-risk under the EU AI Act.
• The role question first: am I a deployer if we just use ChatGPT at work?
• The duties once a use is high-risk: what a deployer owes under Article 26.
• What a classification records: risk classification.