Is facial recognition in shops high-risk under the EU AI Act?

Usually, yes, where the system identifies shoppers. A shop camera that compares the faces of people walking in with a watchlist, without their active involvement, is a remote biometric identification system (Article 3(41)), listed as high-risk in Annex III, point 1(a) and, under Article 6(2), high-risk unless the Article 6(3) derogation applies. It is not caught by the Article 5(1)(h) ban, which concerns the use of real-time remote biometric identification in publicly accessible spaces for the purposes of law enforcement — unless the shop is running it on the police's behalf, where the answer can flip to prohibited. Several other uses are prohibited outright: building a face database by untargeted scraping (Article 5(1)(e)) and inferring shoppers' race, religion, sexual orientation and similar traits from their biometric data (Article 5(1)(g)). Inferring shoppers' emotions is not banned, as it is for staff, but high-risk under Annex III, point 1(c), unless Article 6(3) applies. A face scan that only confirms a person is who they claim to be is outside point 1(a). And the GDPR applies throughout and, in our reading, is usually the bigger hurdle. The answer turns on three things: whether the system identifies, verifies or categorises, whose purpose it serves, and whether the person takes part actively.

This is an information service to help you orient, not legal advice. To see the obligations that attach to your own AI use, answer three questions about it.

Your situation at a glance

Your situation	High-risk?	Why (article / annex point)
Live camera matches shoppers' faces against the shop's own watchlist of suspected shoplifters	Yes, unless Article 6(3) applies	Annex III, point 1(a): remote biometric identification (Article 3(41)), real-time (Article 3(42)). Not law enforcement, so not Article 5(1)(h) (guidelines, paragraphs 425 and 426)
The same matching run afterwards on recorded CCTV footage	Yes, unless Article 6(3) applies	Point 1(a) does not distinguish real-time from post systems (Article 3(43)). The guidelines treat retrospective private use as outside the ban too (paragraph 426)
The shop runs real-time facial recognition in its store on behalf of the police, under their instructions and supervision	Prohibited, in our reading	Article 5(1)(h), read with Article 3(46) "or on their behalf". The guidelines' own example: a shopping mall entrusted by the police to find shoplifters (section 10.8)
The shop runs its own system and passes matches or footage to the police when it reports a theft	Yes, unless Article 6(3) applies — not prohibited, in our reading	Guidelines, paragraph 324: entities acting on their "own behalf" are not within Article 5(1)(h). What decides it is delegation or a specific request with instruction and supervision, not the fact of reporting
Pay-by-face at the till, or a face scan at the staff door, that the person actively steps up to	Not under point 1(a), in our reading	Annex III, point 1(a) excludes biometric verification whose "sole purpose" is to confirm identity. Guidelines, paragraphs 305 and 306, on active involvement
Building or expanding a face database by scraping faces from the internet or CCTV footage indiscriminately	Prohibited	Article 5(1)(e). Targeted collection of specific individuals is not covered (guidelines, paragraph 229)
Ad screen or analytics that estimates each shopper's age or gender	Not prohibited. High-risk status unsettled	Article 5(1)(g) does not list age or sex. Annex III, point 1(b) covers categorisation "according to sensitive or protected attributes or characteristics"; Recital 54 ties that to Article 9(1) GDPR attributes. Article 50(3) notice applies either way
AI infers shoppers' race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation from their faces	Prohibited	Article 5(1)(g)
AI infers shoppers' emotions or intentions from faces or voices, for example reactions to a display or "suspicious" behaviour	Yes, unless Article 6(3) applies	Annex III, point 1(c). Article 5(1)(f) covers only workplace and education (guidelines, paragraph 266). Article 50(3) notice applies
The same emotion analytics also reads the shop's own staff	Prohibited as to staff	Article 5(1)(f). The guidelines' example: a supermarket using cameras to track its employees' emotions (paragraph 254)
In-store "virtual mirror" that maps face or body features only so the shopper can preview a product	Possibly not biometric categorisation, in our reading	Article 3(40) excludes a system "ancillary to another commercial service and strictly necessary for objective technical reasons"; Recital 16 gives online try-on filters as an example
People counting, queue length or footfall heatmaps that neither identify nor categorise anyone	Not listed, in our reading	No reference database, so no identification (guidelines, paragraph 309); no individual categorisation (paragraph 282). If it estimates each person's age or gender, the age-and-gender row applies

The legal test

Article 6(2) says that AI systems referred to in Annex III "shall be considered to be high-risk". Annex III, point 1 reads:

"Biometrics, in so far as their use is permitted under relevant Union or national law: (a) remote biometric identification systems. This shall not include AI systems intended to be used for biometric verification the sole purpose of which is to confirm that a specific natural person is the person he or she claims to be; (b) AI systems intended to be used for biometric categorisation, according to sensitive or protected attributes or characteristics based on the inference of those attributes or characteristics; (c) AI systems intended to be used for emotion recognition."

The opening words matter. Point 1 does not make a biometric system lawful; it classifies systems whose use is permitted by other law, such as the GDPR. In our reading, a system that is unlawful under the GDPR does not become usable because it meets the AI Act's high-risk requirements.

What counts as remote biometric identification

Article 3(41) defines a remote biometric identification system as "an AI system for the purpose of identifying natural persons, without their active involvement, typically at a distance through the comparison of a person's biometric data with the biometric data contained in a reference database". Three elements do the work for a shop:

• A reference database. A watchlist of faces is one. The guidelines say identification "is not possible without a reference database" (paragraph 309).
• No active involvement. The guidelines say that, for active involvement, "it is not sufficient that persons are informed about the presence of cameras"; people must step actively and consciously in front of a camera installed to foster participation (paragraph 306). A ceiling or entrance camera scanning everyone who walks in is the remote case. A warning sign at the door does not change that.
• Real-time or post. A real-time system is one "whereby the capturing of biometric data, the comparison and the identification all occur without a significant delay" (Article 3(42)); a post system is any other (Article 3(43)). Point 1(a) covers both. The distinction matters mainly for the Article 5(1)(h) ban and the Article 26(10) rules, both of which are framed around law enforcement.

Biometric data is defined in Article 3(34) as personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, "such as facial images or dactyloscopic data".

Why a shop's own watchlist is not the Article 5(1)(h) ban

Article 5(1)(h) prohibits "the use of 'real-time' remote biometric identification systems in publicly accessible spaces for the purposes of law enforcement", subject to three narrow exceptions. A shop is a publicly accessible space: Article 3(44) covers "any publicly or privately owned physical place accessible to an undetermined number of natural persons", and the guidelines name shops among the examples (paragraph 314). The deciding element is law enforcement.

Article 3(46) defines law enforcement as "activities carried out by law enforcement authorities or on their behalf for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including safeguarding against and preventing threats to public security". A retailer is not a law enforcement authority under Article 3(45) unless Member State law entrusts it with public authority and public powers for those purposes. The guidelines are explicit that the use of remote biometric identification by private actors, "both in real-time and retrospective (such as the use of live facial recognition technology by a supermarket to identify known shoplifters...)", falls outside the prohibition (paragraph 426), and that all other uses not covered by the ban fall within the high-risk category of Annex III, point 1(a) (paragraph 425). Their worked examples put it in two lines: shopping malls using real-time remote biometric identification to find shoplifters is "not law enforcement"; a mall doing the same when entrusted by the police is prohibited, "because the search for shoplifters does not fall under any of the exceptions" (section 10.8).

So the question for a retailer that works with the police is whether it is acting on its own behalf or on theirs. The guidelines read "on behalf of" as a law enforcement authority having "delegated the performance of a law enforcement activity (or part of it)" to another entity, or having "requested in specific cases" it to support law enforcement, with the authority instructing on all major aspects and supervising (paragraph 324). In our reading, a shop that runs its own system for its own loss prevention and hands evidence to the police when it reports a crime is acting on its own behalf; a shop that runs real-time matching at the police's request, against their list, under their direction, is the case the guidelines call prohibited. The line between the two is not drawn in the Act itself, and the guidelines are not binding.

Note also the second subparagraph of Article 5(1): point (h) "is without prejudice to Article 9 of Regulation (EU) 2016/679 for the processing of biometric data for purposes other than law enforcement". In our reading, private facial recognition therefore stays subject to the GDPR's special-category rules as well as to the AI Act's high-risk rules.

Verification: pay-by-face and staff entry

Annex III, point 1(a) "shall not include AI systems intended to be used for biometric verification the sole purpose of which is to confirm that a specific natural person is the person he or she claims to be". Article 3(36) defines biometric verification as "the automated, one-to-one verification, including authentication, of the identity of natural persons by comparing their biometric data to previously provided biometric data". Recital 17 of the original 2024 text says the exclusion covers confirming identity "for the sole purpose of having access to a service, unlocking a device or having security access to premises", because such systems are likely to have a minor impact on fundamental rights.

The guidelines go a step further on "remote": a system used to confirm identity for access to a service or premises is excluded from the concept, and their example is a face scan at the entrance of a restricted area that compares the person presented with a database of people allowed in (paragraph 305). In our reading, a pay-by-face till or a staff-door scanner that a person deliberately approaches is outside point 1(a), even where it searches a list of enrolled customers or staff, provided the person is actively involved and the system is used only for that access or payment. A till camera that also silently checks every shopper against a watchlist is a different system.

Outside point 1(a) is not outside the law. Under Article 9(1) GDPR, the processing of "biometric data for the purpose of uniquely identifying a natural person" is prohibited unless an Article 9(2) exception applies, and in our reading that can cover verification too.

Scraping faces into a database

Article 5(1)(e) prohibits "the placing on the market, the putting into service for this specific purpose, or the use of AI systems that create or expand facial recognition databases through the untargeted scraping of facial images from the internet or CCTV footage". The guidelines describe "untargeted" as a technique that operates like a "vacuum cleaner", without a specific focus on a given individual or group (paragraph 228); collecting images only of specific individuals is targeted and not covered (paragraph 229). They name surveillance cameras in places such as airports, streets and parks as examples of CCTV sources (paragraph 232).

In our reading, a retailer that builds its watchlist by running every visitor's face from its own CCTV into a database for later recognition is close to this line; a watchlist of specific individuals involved in specific incidents is the targeted case. Both remain subject to the GDPR. The ban has applied since 2 February 2025.

Age, gender and other categorisation

Article 3(40) defines a biometric categorisation system as "an AI system for the purpose of assigning natural persons to specific categories on the basis of their biometric data, unless it is ancillary to another commercial service and strictly necessary for objective technical reasons". Recital 16 of the original text lists sex and age among such categories. The guidelines' own illustration is retail-shaped: "an advertising display may show different adverts depending on the individual that is looking at it based on their age or gender" (paragraph 276), and they give "Attribute Estimation" of "age, gender, ethnicity" as an example of individual categorisation (paragraph 282).

Three different rules then apply:

• Prohibited. Article 5(1)(g) bans biometric categorisation to deduce or infer "race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation". Age and sex are not on that list. The guidelines distinguish a system that claims to deduce race, which is prohibited, from one that categorises people by skin or eye colour, which is not (paragraph 283). In our reading, an analytics tool that outputs an "ethnicity" estimate for each shopper needs a hard look against the race limb.
• High-risk. Annex III, point 1(b) covers categorisation "according to sensitive or protected attributes or characteristics based on the inference of those attributes or characteristics". Recital 54 of the original text describes this as categorisation "according to sensitive attributes or characteristics protected under Article 9(1) of Regulation (EU) 2016/679", and the guidelines repeat that (paragraph 287). Age and sex are not Article 9(1) categories. Our reading is that age-and-gender estimation for advertising is therefore arguable either way: outside point 1(b) on the recital's reading, within it if "protected" is read to include characteristics protected by non-discrimination law. The Act does not settle this. A cautious provider would not assume it is out.
• The ancillary exclusion. The Article 3(40) carve-out needs both conditions: ancillary to another commercial service and strictly necessary for objective technical reasons (guidelines, paragraph 279). Recital 16's example is a filter on an online marketplace that lets a consumer preview a product on themselves. In our reading, an in-store virtual mirror doing the same is the closest fit; an ad screen that picks adverts by apparent age is not, because choosing an advert does not technically require categorising the viewer.

Whatever the classification, Article 50(3) applies to a biometric categorisation system (below).

Emotions: shoppers versus staff

Article 5(1)(f) prohibits AI systems that infer emotions of a natural person "in the areas of workplace and education institutions", except for medical or safety reasons. Shoppers are neither. The guidelines say emotion recognition systems in all other domains "do not fall under the prohibition" but "are, however, considered high-risk AI systems" (paragraph 266), and that systems addressing customers, including "intelligent billboards", are not covered by the ban, though they may be caught by the manipulation and exploitation bans in Article 5(1)(a) and (b) where all conditions are met. Article 3(39) defines an emotion recognition system as one for identifying or inferring "emotions or intentions of natural persons on the basis of their biometric data", so a camera that reads "intent to steal" from posture or expression is, in our reading, within the definition. Recital 18 of the original text excludes the mere detection of readily apparent expressions, gestures or movements, unless they are used for identifying or inferring emotions.

A shop is also a workplace. The guidelines name shops among the places that count (paragraph 254), and give two examples side by side: "Using cameras by a supermarket to track its employees' emotions, such as happiness, is prohibited", while cameras to detect suspicious customers are not prohibited under Article 5(1)(f) "when it is ensured that no employees are being tracked and there are sufficient safeguards". In-store emotion analytics needs a way of keeping staff out of it. We cover the workplace ban in what Article 5(1)(f) prohibits at work.

Footfall and heatmaps

Counting people, measuring queues and drawing heatmaps of where people walk do not, in our reading, identify anyone (there is no reference database) or categorise individuals, so no Annex III point catches them. The guidelines note that the Article 5(1)(g) prohibition does not apply "if a whole group is categorised without looking at the individual" (paragraph 282). The harder case is a tool that recognises the same face on different cameras or on different days to count "unique" or "returning" visitors. That compares biometric data with stored biometric data, and in our reading should be assessed as possible remote biometric identification rather than assumed to be counting. Whether a system that processes video of bodies is processing biometric data at all depends on the "specific technical processing" in Article 3(34).

The Article 6(3) derogation and the profiling rule

Article 6(3) lets a system "referred to in Annex III" escape the high-risk label where it "does not pose a significant risk of harm to the health, safety or fundamental rights of natural persons, including by not materially influencing the outcome of decision making", and it meets one of four conditions: a narrow procedural task, improving a previously completed human activity, detecting decision-making patterns without replacing human review, or a preparatory task. The text makes no exception for point 1, so it can in principle apply to biometric systems.

In practice, our reading is that it rarely fits a watchlist system. Its output is the identification of a person who will then be watched, approached or refused entry, which is hard to describe as not materially influencing the outcome. The third subparagraph also makes an Annex III system "always" high-risk where it performs profiling of natural persons, which Article 3(52) defines by reference to Article 4(4) GDPR: automated evaluation of personal aspects, "in particular to analyse or predict aspects concerning that natural person's... reliability, behaviour, location or movements". Whether a bare match against a list is profiling the Act does not say; a system that scores shoppers as theft risks, or tracks a person's movements through the store, is the clearer case. A provider that relies on the derogation must document the assessment before the system is placed on the market or put into service (Article 6(4)) and register it (Article 49(2)). See when an Annex III system is not high-risk.

If it is high-risk: who does what, and when

When. The Digital Omnibus amended Article 113. Chapter III, Sections 1, 2 and 3 apply to Annex III systems from 2 December 2027. Under Article 111(2), as amended, and without prejudice to Article 5, the Act applies to operators of high-risk systems placed on the market or put into service before that date only if, from that date, those systems are subject to significant changes in their designs; providers and deployers of high-risk systems intended to be used by public authorities must in any case comply by 2 August 2030. See what the Digital Omnibus changed.

Providers (whoever develops the system and places it on the market or puts it into service under its own name or trademark, Article 3(3)) carry the Section 2 requirements, a quality management system and registration in the EU database before placing the system on the market or putting it into service (Article 49(1)). Two rules are specific to biometrics:

• Conformity assessment may need a notified body (Article 43(1)). For point 1 systems, a provider that has applied harmonised standards or, where applicable, common specifications may choose internal control under Annex VI or the Annex VII procedure "with the involvement of a notified body". It "shall follow the conformity assessment procedure set out in Annex VII" where harmonised standards do not exist and common specifications are not available, where it has not applied them or applied only part of a standard, or where a standard was published with a restriction, for the restricted part. For points 2 to 8 of Annex III, Article 43(2) provides for internal control only, so point 1 is the one Annex III area where a notified body can be mandatory. See notified bodies and conformity assessment.
• Two-person verification by design (Article 14(5)). For point 1(a) systems, the human oversight measures must ensure "that no action or decision is taken by the deployer on the basis of the identification resulting from the system unless that identification has been separately verified and confirmed by at least two natural persons with the necessary competence, training and authority". The exception in the second subparagraph covers only law enforcement, migration, border control or asylum, where Union or national law considers the requirement disproportionate. In our reading, a shop running its own watchlist is not in it.

A retailer that develops its own system and puts it into service under its own name is its provider (Article 3(3)); one that changes the intended purpose of a system that was not high-risk so that it becomes high-risk is considered the provider under Article 25(1)(c).

Deployers (the shop using the system under its authority, Article 3(4)) must use it in accordance with the instructions for use (Article 26(1)), assign human oversight to people with the necessary competence, training and authority, as well as the necessary support (Article 26(2)), monitor it (Article 26(5)), keep the logs under their control for at least six months unless other law provides otherwise (Article 26(6)), and use the provider's information for any GDPR data protection impact assessment (Article 26(9)). For a watchlist system, Article 14(5) in practice means two trained people confirm a match before anyone acts on it. Three further points:

• Telling the people affected (Article 26(11)). Deployers of Annex III systems that make decisions or assist in making decisions related to natural persons "shall inform the natural persons that they are subject to the use of the high-risk AI system". In our reading, a system whose matches lead staff to approach or refuse a shopper is assisting in decisions related to that shopper.
• Telling staff (Article 26(7)). If the cameras also capture employees, deployers who are employers must inform workers' representatives and affected workers before putting the system into use. See AI employee monitoring.
• Article 26(10) is about criminal investigations. It sets authorisation and other safeguards for post-remote biometric identification "in the framework of an investigation for the targeted search of a person suspected or convicted of having committed a criminal offence". Its documentation rule applies "regardless of the purpose or deployer", but requires each use to be recorded in the relevant police file. In our reading, it is not aimed at a shop running its own loss-prevention list, but a retailer asked to run retrospective searches for an investigation should check it. See deployer obligations under Article 26.

Fundamental rights impact assessment: not for most shops. Article 27(1) requires it from "deployers that are bodies governed by public law, or are private entities providing public services, and deployers of high-risk AI systems referred to in points 5 (b) and (c) of Annex III". Point 1 is not in that list. In our reading, an ordinary retailer is not a private entity providing public services, so Article 27 does not require one; the GDPR data protection impact assessment is a separate question.

What applies regardless

• AI literacy (Article 4). Applies since 2 February 2025. As replaced by the Digital Omnibus, it requires providers and deployers to "take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf", such as the security staff who act on matches, and it "does not require providers or deployers to guarantee any specific level of AI literacy of any individual". See the AI literacy duty.
• Prohibited practices (Article 5). Applies since 2 February 2025, including untargeted face scraping (Article 5(1)(e)), workplace emotion recognition (Article 5(1)(f)), sensitive biometric categorisation (Article 5(1)(g)) and, for law enforcement use, Article 5(1)(h). A shop that tries to predict who will commit a crime should also check Article 5(1)(d); the guidelines discuss when private entities are caught (paragraphs 207 to 211). The two prohibitions the Omnibus added, Article 5(1)(ba) and (bb), apply from 2 December 2026. Breaches can carry fines of up to EUR 35 million or, for an undertaking, up to 7% of its total worldwide annual turnover for the preceding financial year, whichever is higher (Article 99(3)); for SMEs, including start-ups, whichever is lower (Article 99(6)). See prohibited AI practices.
• Transparency (Article 50(3)). Applies since 2 August 2026. "Deployers of an emotion recognition system or a biometric categorisation system shall inform the natural persons exposed thereto of the operation of the system", and process the personal data in accordance with the GDPR. This applies whether or not the system is high-risk, so an age-and-gender ad screen needs it even if point 1(b) does not apply. See transparency obligations.
• The GDPR, in parallel. Article 9(1) GDPR prohibits the processing of "biometric data for the purpose of uniquely identifying a natural person" unless an exception in Article 9(2) applies. In our reading, for a private shop, finding a lawful exception for watchlist matching is usually harder than meeting the AI Act's requirements, and the AI Act does not supply one.

What to do now

1. List every camera feature that touches faces: watchlist matching, face search on recorded footage, pay-by-face, staff access, ad screens with audience analytics, emotion or "suspicious behaviour" detection, and visitor counting that recognises returning faces.
2. For each, ask what it does: identify against a list (point 1(a)), confirm a claimed identity (excluded), categorise (Article 5(1)(g), point 1(b), Article 50(3)) or infer emotions (point 1(c), Article 50(3)).
3. Check whose purpose it serves. If the police asked for it, set the list or direct its use, take advice on Article 5(1)(h) before it runs again.
4. Check how the database was built. Indiscriminate collection of faces from the internet or CCTV is an Article 5(1)(e) question now.
5. Keep staff out of emotion analytics, and start the GDPR Article 9 analysis first: if no Article 9(2) exception applies, the processing is prohibited whatever the system's AI Act classification.

For the general test behind this page, see is your AI system high-risk?. To get a weekly email of verified changes to these rules, join the waitlist.

The official text is Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744. This article is an information service to help you orient — it is not legal advice.