Editor's note: The IAPP is policy neutral. We publish contributed opinion and analysis pieces to enable our members to hear a broad spectrum of views in our domains.
Biometric technologies have long been used to identify individuals, primarily in security and law enforcement contexts. Today, however, their use is expanding rapidly into new domains. Driven by advances in artificial intelligence, biometric technologies now claim the ability to infer a person's emotions, personality traits and other characteristics based solely on physical features.
These tools are increasingly used across various settings: businesses analyze facial expressions to gauge customer sentiment and evaluate job candidates, employers deploy monitoring tools to measure employee focus, and online platforms leverage biometric software to enforce age restrictions.
European regulations have evolved in response to this changing landscape. Since 2018, the EU General Data Protection Regulation has governed the processing of biometric data as a form of personal data and, when used to uniquely identify individuals, as "special category data." The processing of special category data is generally prohibited unless the individual provides explicit consent or another condition under Article 9(2) applies.
Building on this foundation, the EU AI Act introduces a new layer of regulation that targets four types of biometrics and classifies them by risk — ranging from prohibited to high risk and limited risk — based on their purpose and context of use.
Remote biometric identification
Remote biometric identification systems are AI systems designed to identify individuals without their active involvement, typically at a distance. A common example is facial recognition software that scans CCTV footage to identify people in real time or retrospectively by matching images against a biometric database. Notably, this definition excludes biometric verification and authentication tools, such as fingerprint scanning used for building access control or unlocking smartphones, as these involve the individual's active participation.
Under the AI Act, the use of real-time remote biometric identification systems — that is, systems that capture and analyze biometric data simultaneously — is prohibited for law enforcement purposes, except in narrowly defined circumstances. All other uses of remote biometric identification systems, including post-remote — systems that analyze biometric data after the initial capture — are permitted but classified as high risk. This designation triggers a range of compliance obligations, including requirements around risk management, data governance, human oversight and registration in the EU's database.
Biometric categorization
Biometric categorization systems are AI systems that assign individuals to specific categories based on their biometric data. These categories may relate to relatively innocuous traits, such as age or eye color, or more sensitive and controversial attributes like sex, ethnicity, personality traits and personal affiliations. However, the definition excludes biometric categorization that is purely ancillary to commercial services, such as virtual try-on features or facial augmentation in online marketplaces and gaming apps, that adjust filters based on an individual's skin tone or facial structure.
Under the AI Act, biometric categorization systems that categorize individuals according to certain prohibited characteristics — including race, political opinions, trade union membership, religion and sexual orientation — are banned, with limited exceptions for labeling or filtering biometric datasets and certain medical, safety and law enforcement uses. Biometric categorization systems involving other sensitive or protected characteristics are classified as high risk, triggering obligations equivalent to those for remote biometric identification systems. All other biometric categorization systems, where the categories involve nonprohibited and nonsensitive traits, are considered limited risk and subject to transparency requirements.
Emotion recognition
Emotion recognition systems are AI systems designed to identify or infer an individual's emotions or intentions based on their biometric data. The AI Act distinguishes between emotion inference — regulated — and the detection of readily apparent expressions or physical states — not regulated. For example, a system that identifies whether someone is smiling or tired is not considered an emotion recognition system, whereas a system that interprets facial expressions to conclude that the person is happy, sad or amused falls within scope. The definition of an emotion recognition system also excludes sentiment analysis software that relies solely on text and other nonbiometric inputs.
The AI Act prohibits emotion recognition systems in workplace and educational settings, except where strictly necessary for medical or safety purposes. In other contexts, they are classified as high risk and subject to extensive compliance requirements. This means that, for example, using voice analysis to gauge customer sentiment during support calls would be considered high-risk, whereas applying the same technology to monitor employee emotions in the same context would be prohibited. Similarly, AI-powered learning tools that leverage emotion recognition are generally high risk, but their use is banned within schools and other learning environments.
Facial recognition databases
Finally, the AI Act prohibits the development or expansion of facial recognition databases through the untargeted scraping of facial images from the internet or CCTV footage. This prohibition is absolute and there are no exceptions. However, it applies specifically to facial images and does not extend to biometric databases built using other types of biometric data, such as voice recordings.
Navigating the overlap
The intersection of the GDPR and the AI Act creates a layered regulatory framework for biometric technologies in the EU. While the AI Act's prohibitions took effect in February 2025, the rules for high-risk and limited-risk systems will not apply until August 2026. In the meantime, organizations face overlapping obligations that present significant compliance challenges for those developing and using these technologies.
First, navigating the overlap between the GDPR and AI Act requires a careful mapping of roles and responsibilities across both frameworks. A company using a biometric tool internally may act simultaneously as a controller under the GDPR and a deployer under the AI Act, triggering distinct compliance obligations. At the same time, providers of biometric tools — who may typically consider themselves processors under the GDPR — face the most extensive requirements under the AI Act, particularly for high-risk systems.
Second, the AI Act's risk classifications are complex and often challenging to interpret. Determining whether a system is prohibited, high or limited risk requires a nuanced understanding of the technology and the specific context of its use. Although the European Commission has published guidelines on the prohibitions, some boundaries also remain ambiguous. This includes, for example, the distinction between prohibited and high-risk biometric categorization and whether an inference qualifies as emotion recognition or simply identifying a person's facial expressions.
Third, the substantive requirements for high-risk systems represent a major operational and financial undertaking. Providers of these systems must implement an extensive set of safeguards — including risk management procedures, data quality and governance controls, post-market monitoring, logging mechanisms and human oversight — while deployers have more limited, but related, obligations. For many organizations, especially startups and small- to medium-sized enterprises, these demands may deter innovation or delay product rollout within the EU.
Together, these challenges mark a shift away from the GDPR's compliance model rooted in notice and consent to one that requires proactive, risk-based life cycle governance. For legal practitioners, effective compliance demands not only a strong grasp of the legal framework, but also a deep understanding of the underlying technology, its intended use, and the organization's role within the AI supply chain.
Richard Lawne, CIPP/E, CIPP/US, CIPM, is a senior associate at Fieldfisher.
