Classified examples · Education and biometrics · Po polsku
Face recognition to open the office door
Depends on the useDeployer
Employees enter the building by looking at a camera that checks their face against their enrolled photo.
How we classify it
- Checking that a person is who they claim to be (one-to-one verification) is expressly excluded from remote biometric identification in Annex III point 1(a): not high-risk on that ground.
- Identifying people in a crowd or across cameras (one-to-many) would be remote biometric identification: high-risk.
- Result: verification for access is not high-risk under the AI Act, but biometric data is special-category data under GDPR Article 9.
What applies now
- GDPR Article 9: a valid condition for biometric processing, a DPIA and an alternative such as a badge
- National employment law may restrict employees' biometric data (in Poland, the Labour Code sets conditions)
- Register entry
What would change the answer
- Using the same cameras to identify or track people, or to infer emotions, changes the classification: high-risk or prohibited
Evidence to keep
- DPIA
- Classification record
- Consent or legal basis record
In the AI Compliance Kit: 04Risk Classification Procedure · 03AI System Inventory.
Dates and sources
- High-risk obligations for stand-alone systems (Annex III): 2 December 2027
Legal basis: AI Act Annex III point 1(a); GDPR art. 9.
Similar examples
- AI grades tests or monitors exams in a training company High-risk (Annex III)