EU AI Act
What it does
Article 5 of the AI Act bans real-time remote biometric identification in public, emotion recognition, predictive policing, and social scoring. The bans carry exceptions. Real-time face scanning is permitted for listed law-enforcement purposes with authorization; retrospective face scanning of recorded footage is treated as high-risk rather than banned; emotion recognition is barred in workplaces and schools but not for police or borders. The prohibitions have applied since February 2025, general-purpose AI rules since August 2025, and the bulk of the Act, including the high-risk regime, applies from August 2, 2026. The Commission's November 2025 digital omnibus package proposes delaying parts of the high-risk rules.
Why it matters
This is the law every government will point to as proof biometric surveillance is regulated, and its exceptions are the operating manual. A ban with a law-enforcement carve-out is an authorization with paperwork: the member states that wanted face scanning in public squares got a legal pathway to it, written into the world's flagship AI law.
Our take
The AI Act did what a decade of surveillance debate could not: it made real-time biometric identification of the public lawful in Europe, provided the right box is ticked. The bans got the headlines; the exceptions got the future. August 2 is when the full machinery switches on.
Votes
- European Parliament — Adoption (523 to 46) · March 13, 2024
Timeline
- April 21, 2021Proposed by the European Commission
- March 13, 2024Parliament adopted the AI Act, 523 to 46
- August 1, 2024Entered into force
- February 2, 2025Prohibitions and their carve-outs took effect
- August 2, 2025General-purpose AI rules took effect
- November 19, 2025Commission proposed delaying parts of the high-risk regime (digital omnibus)
- August 2, 2026General application of the Act
Our coverage: all surveillance stories