The EU AI Act and Biometrics: What Identity Verification Providers Must Know

The EU AI Act is reshaping the compliance landscape for artificial intelligence used in identity verification. The regulation entered into force in August 2024, but its requirements apply in stages over several years, making the precise classification of a product especially important for providers and customers.

For the identity verification sector, the central question is whether an AI system simply confirms that an individual is the person they claim to be, or identifies an unknown person by comparing their biometric data against a database. That distinction determines whether the system falls within the Act's high-risk regime, alongside continuing obligations under the EU General Data Protection Regulation, or GDPR.

Biometric practices prohibited since February 2025

The AI Act's first substantive rules took effect in February 2025. They prohibit certain AI practices considered to create unacceptable risks. Several directly concern facial recognition and biometric technologies, although their practical relevance will vary across identity verification workflows.

• Untargeted scraping of facial images from the internet or closed-circuit television footage to create or expand facial-recognition databases is prohibited.
• Biometric categorisation systems that infer certain sensitive traits from biometric data are prohibited. The covered traits include race, political opinions, trade-union membership, religious or philosophical beliefs, sex life and sexual orientation, subject to limited exceptions in the legislation.
• Emotion-recognition systems in workplaces and education institutions are prohibited, except in narrow circumstances linked to medical or safety purposes.
• Some uses of real-time remote biometric identification in publicly accessible spaces for law-enforcement purposes are also prohibited, with tightly defined exceptions.

These bans should not be read as a general prohibition on face matching or liveness detection. Liveness detection is the process used to assess whether a biometric sample comes from a live person rather than a photograph, replay, mask or other spoof. But providers should examine data sources, model features and downstream uses carefully. A product built for verification can create a very different legal profile if it is repurposed for surveillance, database expansion or trait inference.

The one-to-one verification carve-out

The Act classifies remote biometric identification systems as high-risk AI systems. In broad terms, these systems identify people by comparing biometric data captured remotely with data held in a reference database. High-risk status brings extensive requirements for providers before a system is placed on the EU market or put into service.

Critically, the Act excludes biometric verification systems whose sole purpose is to confirm that a specific person is the person they claim to be from this high-risk category. This is the familiar one-to-one model: for example, comparing a selfie or video capture with the portrait on an identity document or an existing account record during onboarding.

For IDV providers, the legal boundary is not whether biometrics are used, but whether the system verifies a claimed identity or identifies an unknown person from a population.

The carve-out is narrow and purpose-dependent. A provider should not assume that every product described as verification qualifies. A workflow that searches a large gallery for possible matches, supports watchlists, ranks candidates, or makes inferences beyond identity confirmation may move outside the exclusion. Product documentation, contractual limits and actual customer deployment all matter.

What remains for verification providers

Avoiding high-risk classification under the AI Act does not remove data-protection duties. Under GDPR, biometric data processed for the purpose of uniquely identifying a person is a special category of personal data. Organisations generally need both a lawful basis for processing personal data and a separate condition permitting the processing of special-category data. The appropriate basis depends on the context and cannot be assumed from the technology alone.

Providers and their customers must also address core GDPR requirements, including clear privacy information, purpose limitation, data minimisation, retention controls, security and the allocation of controller and processor responsibilities. Many biometric processing operations are likely to require a data protection impact assessment, particularly where they present a high risk to individuals' rights and freedoms.

AI Act transparency duties may also apply where a product includes features such as emotion recognition or biometric categorisation. More generally, transparent user notices, understandable explanations of the verification process and accessible routes for support remain important risk-management measures, even where a specific AI Act disclosure rule is not triggered.

When high-risk obligations apply

If a system goes beyond one-to-one verification and is classified as high-risk, its provider faces a more formal compliance framework. Requirements can include a risk-management system, data-governance measures, technical documentation, record-keeping or logging, instructions for use, human oversight, accuracy, robustness and cybersecurity controls, a quality-management system and a conformity assessment. Relevant systems may also need registration in the EU database before use.

Those obligations are not limited to software vendors. Deployers, including banks, marketplaces, telecommunications companies and public-sector users, can have separate duties concerning use, monitoring, human oversight and impact assessments. Contract terms should therefore specify each party's role, permitted purpose and evidence needed to support compliance.

Why the compliance dates matter

The Act's original timetable places many high-risk obligations later than the February 2025 prohibitions. But implementation dates for parts of the high-risk regime have been the subject of proposed delays and wider policy debate. Providers should check the current legal timetable, the final status of any amendments and applicable Commission guidance rather than relying on early implementation roadmaps.

The practical task is to map each biometric feature to its purpose, data flows and user context. For most mainstream one-to-one IDV services, GDPR compliance and disciplined product boundaries will remain the immediate priorities. For systems that identify people across a database or infer sensitive characteristics, the AI Act creates materially greater legal exposure.