For organisations that need to classify biometric AI without mixing up prohibited practices, high-risk rules and privacy risk.
The Commission guidelines treat biometrics as a separate high-risk area with three routes: remote biometric identification, biometric categorisation and emotion recognition. The first question is whether Article 5 prohibits the system, and only then whether Annex III point 1 makes it high-risk.
The 19 May 2026 draft guidelines cover point 1(a), 1(b) and 1(c), with strong attention to context, purpose, consent, real-time use and exceptions.
Can this biometric system be used at all, or does Article 5 need to be checked first?
Summary by Praxikon of the draft of 19 May 2026. The draft is not binding; the final guidelines have not yet been published.
The draft draws the line between verification and identification. A system that only confirms a person is who they claim to be (one-to-one) is outside point 1(a), as the annex itself provides. A system that searches for a person in a database (one-to-many) is covered, whether in real time or after the fact. For biometrics, always check Article 5 first: real-time remote biometric identification in public spaces for law enforcement is prohibited save for narrow exceptions, biometric categorisation to infer for example race, religion or sexual orientation is prohibited, and emotion recognition at work and in education is prohibited except for medical or safety reasons. Services that infer "engagement", "stress" or "attention" from face or voice are often emotion recognition by function.
Falling outside depends on the intended purpose and on the Article 6(3) exception, which never applies to profiling.
The overview of all eight areas and the dates is on Annex III of the AI Act; the Article 6(3) filter is explained in the Commission guidelines on high-risk AI.
AI systems that identify natural persons remotely based on biometric data.
Systems that categorise persons using biometric data, with a strict boundary against prohibited practices.
AI systems for emotion recognition are high-risk (Annex III point 1(c)). In the workplace and in education, emotion recognition is prohibited, except for medical or safety reasons (Article 5(1)(f)).
Have a biometric AI use case reviewed against Article 5, Annex III point 1, GDPR and required safeguards.
Short answers for classification, evidence and next steps under Annex III.
The 19 May 2026 draft guidelines cover point 1(a), 1(b) and 1(c), with strong attention to context, purpose, consent, real-time use and exceptions. The practical starting question is: Can this biometric system be used at all, or does Article 5 need to be checked first?
This domain page expands the main routes: Remote biometric identification, Biometric categorisation and Emotion recognition. For each system, check the intended purpose, the output and the impact on access, rights or safety.
Document the intended purpose, use context, relevant Annex III route, Article 6(3) assessment, any profiling, provider/deployer roles and the required safeguards.