For organisations that need to classify biometric AI without mixing up prohibited practices, high-risk rules and privacy risk.
The Commission guidelines treat biometrics as a separate high-risk area with three routes: remote biometric identification, biometric categorisation and emotion recognition. The first question is whether Article 5 prohibits the system, and only then whether Annex III point 1 makes it high-risk.
The 19 May 2026 draft guidelines cover point 1(a), 1(b) and 1(c), with strong attention to context, purpose, consent, real-time use and exceptions.
Can this biometric system be used at all, or does Article 5 need to be checked first?
AI systems that identify natural persons remotely based on biometric data.
Systems that categorise persons using biometric data, with a strict boundary against prohibited practices.
AI systems that infer emotions or intentions, with special attention to work and education where prohibitions may apply.
Have a biometric AI use case reviewed against Article 5, Annex III point 1, GDPR and required safeguards.
Short answers for classification, evidence and next steps under Annex III.
The 19 May 2026 draft guidelines cover point 1(a), 1(b) and 1(c), with strong attention to context, purpose, consent, real-time use and exceptions. The practical starting question is: Can this biometric system be used at all, or does Article 5 need to be checked first?
This domain page expands the main routes: Remote biometric identification, Biometric categorisation and Emotion recognition. For each system, check the intended purpose, the output and the impact on access, rights or safety.
Document the intended purpose, use context, relevant Annex III route, Article 6(3) assessment, any profiling, provider/deployer roles and the required safeguards.