Prohibitions § 10.1.1

FRIAs carried out in application of Article 5(2) AI Act must comply with the conditions laid down in Article 27 AI Act. Th at provision sets out the requirements concerning FRIAs applicable to high-risk AI systems.

In the period between when the prohibitions in Article 5 AI Act become applicable (after 2 February 2025)but the provisions on high-risk AI systemsare not yet applicable (before 2 August 2026), the requirements for FRIA set out in Article 27 AI Act should be implemented by the deployers of real-time RBI systems meeting the conditions to benefit from one or more of the exceptions in Article 5(1) (h) AI Act . The following provisional guidance relates only to the use of real-time RBI in publicly accessible spaces for law enforcement purposes for the period before the obligations for high-risk AI systems become applicable and the Commission adopts the template for FRIA and provides further guidance on the obligation under Article 27 AI Act.

A FRIA is a new type of impact assessment that aims to identify the impactthat certain high-risk AI systems, including RBI systems, may produce on fundamental rights. A FRIA is an accountability tool. The FRIA does not replace the existing Data Protection Impact Assessment (DPIA) that data controllers (i.e. those responsible for the processing of personal data) must perform under Article 27 LED, Article 35 GDPR or Article 39 EUDPR. For example, a DPIA must be conducted when biometric data are processed through new technologies likely to result in a high risk to the rights and freedoms of natural persons (such as CCTV, AI facial recognition, and body-worn cameras) in publicly accessible spaces.

Whereas a DPIA focuses on the risks to the rights and freedoms of individuals resulting from the processing of their personal data , a FRIA covers the possible impact of AI systems on individuals’ fundamental rightsmore generally . The scope of a FRIA is therefore broader in terms of activities covered and fundamental rights assessed. Where personal data are processed by the AI system (which is the case of RBI systems), the FRIA should complement the DPIA performed by the deployer as data controller,²¹³ without covering aspects already addressed in the DPIA and avoiding overlap s. The analysis of the FRIA in these Guidelines is limited to the authorized use of RBI in real-time and is aimed to serve asa preliminary guidance for deployers in this interim period before the AI Office provides a template.²¹⁴

The obligation to carry out the FRIA under Article 5(2) AI Act is imposed on the deployers of the RBI system , and not entities or bodies or anyone else acting on their behalf. If other actors are acting on behalf of the deployer/the law enforcement authority, they will have to contribute to the preparation of the FRIA with all relevant information to ensure it is properly carried out.

A FRIA must be carried out before the deployment of the authorized real-time RBI system.

According to Article 27 AI Act, a FRIA should include the following information:

• A description of the RBI use and the deployer’s processesfor the use, together with the intended purpose of use The description should include:
• the name of the deployer;
• the law enforcement purpose(s) for which the real-time RBI system will be used;
• the description of the reference database against which the biometric identification will be compared, including the sources of the biometric data (facial images, voice samples, etc.) that will be used;
• the description of the technology underlying the system to explain its functioning (by referencing the available documentation provided by the provider and its name);²¹⁵
• the legal basis on which the real-time RBI will be deployed.
• The period of use and frequency of use Each individual use of a real-time RBI system for one of the permitted exceptions must be authorised prior to its deployment by a judicial authority or other independent authority under Article 5(3) AI Act. By contrast, for the FRIA, deployers must provide a general indication of the intended period of use and the expected frequency.
• The categories of persons and groups affected by the system For the purpose of the exception in Article 5(1)(h) AI Act, the FRIA should distinguish between:
• The targeted individual, who may be a victim of a crime, a perpetrator, or a suspect,
• The individuals whose biometric data are included in the reference database, and
• Categories of persons who are present in the surrounding areas where the RBI system will be deployed. The use of real-time RBI systems will not only affect the fundamental rights of the targeted individual. The rights of other individuals whose biometric data are used for comparison purposes, passersby, and people incidentally presented in the search area will also be affected . The description of the geographic scope of the search area(s) covered by the real-time RBI system will impact the number of persons affected by the system.
• The specific risks of harm to the affected persons

The fundamental rights that may be affected by the use of real-time RBI in publicly accessible spaces for law enforcement purposes include, in particular:

• the right to private and family life , including people’s reasonable expectation of anonymity in public spaces;
• the right to data protection, as RBI systems rely on the processing of biometric data and other personal data (e.g., names, ID numbers, as well as sensitive data such as ethnicity) to identify specific individuals;
• freedom of thought, conscience and religion, freedom of expression and freedom of assembly and association in the public spaces being searched, on which the use of RBI systems could have a chilling effect, preventing individuals to fully exercise their rights and freedoms, since if individuals know that they are monitored, th ey might change their behaviour , or even prevent themselves to behave in a certain manner;
• the right to an effective remedy and a fair trial;
• the right to non-discrimination if the system embeds biases (such as gender, ethnic or racial biases) and leads to the misidentification of a suspect or perpetrator;
• the right to human dignity by the feeling ofbeing reduced to an object of the system;
• the presumption of innocence and right t o defence; since no decision adversely affecting an individual may be solely taken on the output of the real-time RBI system;
• the rights of the child in case the victim, missing person or suspect is a minor;
• the rights of the elderly in the case of a missing person. To assess the specific risks of harm likely to impact the identified affected person(s) or group(s), the FRIA must identify the fundamental rights of those persons and assess the impact on their fundamental rights, including the severity of the impact and its scale, taking into account the potentially affected persons. This part of the FRIA should also include the assessment of whether the use of a r eal-time RBI system is necessary and proportionate considering the objectives and the circumstances in which its use is intended , including the existence or absence of less intrusive alternatives. The FRIA should describe the performance and accuracy level of the system, based on the technical documentation and, if available, the training data on which the technology was tested and developed to prevent biases and discrimination. The FRIA should also identify the impact of use of a real-time RBI system on the fundamental rights of all individuals potentially affected, in particular the suspect or perpetrator, the victim searched and other individuals present in the publicly accessible spaces subject to the search. To the extent that the system processes the biometric data of these individuals, their rights to private and family life and data protection will be impacted, which will be assessed as part of the DPIA as far as the data processing activities are concerned . For other activities related to the u s e o f the real-time RBI systems and the impact on other fundamental rights, the FRIA will complement the DPIA. Depending on the context of deployment, other fundamental rights of these individuals, such as their rights to human dignity, freedom of thought, conscience and religion, assembly or freedom of expression, rights to an effective remedy and a fair trial, p resumption of innocence and right of defence , rights of the child , may be impacted. The assessment under the FRIA should be performed at an abstract level, prior to the first putting into service of the AI system . Specific context-dependent considerations that determine the impact of use in each individual case where a real-time RBI system is used should be further elaborated in the individual request for requesting the authorisation by a judicial authority or other independent administrative authority of each use of the RBI system (see section 10.23.8.3. below).
• Human oversight measures According to Article 5(3) AI Act, no decision that would adversely affect an individual may be taken solely on the basis of the output of the real-time RBI system. As a consequence, the FRIA should describe the procedures that will be followedduring the operation of the systemand how the output will be interpretedin the context of decision-making process. The procedures should provide instruc tions on the deployment of the RBI system, clarify the role of a human agent in verifying and interpreting the output and provide training to operate the system. The person in charge of human oversight should have sufficient ‘AI literacy, training and auth ority’²¹⁶ to understand how the system functions and when it underperforms or malfunctions. Other considerations for human oversight and monitoring under Articles 14 and 26 AI Act are also relevant and should be described.
• Risk mitigation measures Beyond implementing human oversight measures (including to avoid discriminatory measures), the deployer should explain redress measures in case a risk materialises , including the governance procedures and the complaint mechanisms (such as in the case of a misidentification).