Face matching in your stores is not banned by the AI Act, but it is high-risk

A retailer that uses facial recognition to spot known shoplifters is not caught by the AI Act's ban on real-time remote biometric identification. That ban covers law enforcement use only. But the system is still high-risk, and some nearby uses are banned outright.

This matters if your online business also runs stores, pickup points or warehouses with cameras. Here is how the AI Act sorts face technology.

What is banned. Article 5(1)(h) bans real-time remote biometric identification in publicly accessible spaces for law enforcement purposes. A shop's own security watchlist is not law enforcement, so it falls outside this ban. The Commission's guidelines on prohibited practices confirm the ban is limited to law enforcement. Two other bans do reach retailers. Article 5(1)(e) bans building or expanding facial recognition databases by untargeted scraping of faces from the internet or CCTV footage. Article 5(1)(g) bans biometric categorisation that infers race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation. These bans have applied since 2 February 2025.

What is high-risk. Annex III point 1(a) lists remote biometric identification as high-risk. This means matching a face against a stored database without the person's active involvement. It covers live matching and matching after the fact, such as checking CCTV footage after a theft. It is not limited to public spaces. Annex III duties apply from 2 December 2027 under the Digital Omnibus, Regulation (EU) 2026/1744. As deployer, the retailer will owe the Article 26 duties. These include using the system as instructed, assigning human oversight, monitoring it and keeping its logs.

What is outside. Biometric verification is not in point 1(a). That is a one-to-one check that a person is who they claim to be, such as a customer unlocking your app with their face. Age estimation for age-restricted products is also not high-risk biometric categorisation. The AI Act Service Desk explains that age is not a sensitive attribute under GDPR Article 9(1).

The AI Act is not the only gate. Annex III point 1 covers these uses only in so far as Union or national law permits them. Facial images used to identify people are special-category biometric data under GDPR Article 9. The Dutch data protection authority has said facial recognition in supermarkets is allowed only in exceptional cases.

What to do now. List every camera and identity tool in your stores, warehouses and apps. For each one, ask the vendor a simple question: does it match faces against a stored list? If yes, treat it as high-risk and run the GDPR test first. If you do not truly need to identify people, choose tools that count visitors or detect events without biometric matching.

Sources: Regulation (EU) 2024/1689, Art. 5(1)(e), (g) and (h), Art. 26 and Annex III point 1; Regulation (EU) 2026/1744; Commission Guidelines on prohibited AI practices; AI Act Service Desk, Biometrics page.