EU AI Act 2024
Definition
Regulation (EU) 2024/1689, the first comprehensive AI regulatory framework, which prohibits real-time biometric identification in publicly accessible spaces with three narrow exceptions, and classifies post-event biometric identification systems as high-risk AI requiring conformity assessment.
- Formal citation
- Regulation (EU) 2024/1689
- Real-time biometric ID
- Prohibited in public spaces, three narrow exceptions
- Post-event biometric ID
- Classified high-risk, requires conformity assessment
- Significance
- First comprehensive AI regulatory framework
Common questions
What are the narrow exceptions allowing real-time biometric identification under the EU AI Act?+
The exceptions are tightly scoped situations such as searching for specific victims of crime, preventing an imminent terrorist threat, or locating a suspect of a serious crime, each requiring prior judicial or independent authorisation rather than open-ended police use.
What does classifying post-event biometric identification as high-risk require in practice?+
High-risk systems must undergo a conformity assessment covering data quality, documentation, human oversight, and accuracy testing before deployment, and providers must register the system in an EU database, obligations that do not apply to lower-risk AI tools.
Does the EU AI Act apply only to companies based in the EU?+
No, it applies extraterritorially to any provider or deployer whose AI system output is used within the EU, so a biometric system built outside the EU can still fall under the Act if it processes EU residents' data or operates in EU territory.
Related terms
- BIPA
- Illinois Biometric Information Privacy Act (740 ILCS 14, 2008). Requires informed written consent before collecting biometric identifiers and prohibits their sale. The...
- Clearview AI
- New York company that built a face-recognition database of approximately 30 billion images scraped from public websites without consent; subject to BIPA...
- Conformity Assessment
- The process by which a provider of a high-risk AI system (such as a face recognition database for law enforcement) demonstrates compliance...
- DPDP Act 2023
- Digital Personal Data Protection Act 2023. India's general data protection statute, in force in phases from 2024. Applies to IoT-collected personal data...
- High-Risk AI System
- An AI system classified under Annex III of the EU AI Act as requiring mandatory technical documentation, risk management, human oversight, transparency,...
- Law Enforcement Directive (LED)
- EU Directive 2016/680, which governs the processing of personal data by competent authorities for the purposes of prevention, investigation, prosecution and execution...
- PACE S.78
- Section 78 of the Police and Criminal Evidence Act 1984 (England and Wales), which gives courts discretion to exclude prosecution evidence if...
- Purpose-Limitation
- The data protection principle prohibiting processing of personal (including biometric) data for any purpose other than the one for which it was...
- Puttaswamy V. Union of India
- The Supreme Court of India's 2017 nine-judge bench decision recognising the right to privacy as a fundamental right under Article 21 of...