All other uses of RBI systems that are not covered by the prohibition of Article 5(1)(h) AI Act fall within the category of high-risk AI systems as defined by Article 6 and listed in point 1(a) of Annex III AI Act provided they fall within the scope of the AI Act.
RBI systems that fall outside the scope of the prohibition in Article 5(1)(h) AI Act include biometric verification/authentication systems and the retrospective use of (post- ) RBI systems in publicly accessible spaces for law enforcement purposes. For instance, police authorities might be authoris ed by national law to perform retrospective facial recognition to compare images of criminal suspects with recorded facial images in a criminal database.237 Another use that falls outside the scope of the prohibition is the use of real-time RBI systems for law enforcement purposes in either a private (such as at somebody’s place) or an online space (such as the use of a chat room or online game to identify a suspect of disseminating child sexual abuse material). Finally, the use of RBI systems by private actors, both in real-time and retrospective (such as the use of live facial recognition technology by a supermarket to identify known shoplifters, the use of live facial recognition technology by a sports arena to identify individuals banned from entering the arena, or the use of live facial recognition technology in schools for security purposes and school attendance) fall outside the scope of the prohibition.
In addition to the rules that apply to high-risk AI systems generally, the retrospective use of RBI systems for law enforcement purpose s is subject to additional conditions and safeguards in accordance with Article 26(10) AI Act (in application as from 2 August 2026).238
Uses for purposes other than for law enforcement must in any event comply with data protection rules . The cases below illustrate the interpretation of Article 9(2) GDPR in cases of such use and the exceptions to process biometric data. For example,
- A French administrative Court found that the trial of live facial recognition technology in two public schools for access control and security purposes was neither necessary nor proportionate (under data protection rules) . Alternative solutions that were less intrusive for the students were avail able, e.g., the use of badges. In addition, the conditions for explicit consent were not met. Therefore, consent could not be used as a valid legal basis to trial facial recognition technology in high schools.239
- A supermarket was not allowed to use live facial recognition technology to prevent shoplifting in the Netherlands. Without explicit consent from the customer or any legal basis allowing the processing for a substantial public interest (such as security purposes), the supermarket could not process biometric data and thus deploy facial recognition technology.240
- The use of live facial recognition technology at the entrance of a football club to identify supporters was prohibited in France241 and to ensure the safety of spectators was prohibited in Spain.242