Versatile AI Risk Assessment
Biometrics and emotion recognition

Remote biometric identification (facial recognition)

Also known as: Remote biometric identification and facial recognition

The system compares faces in camera images or photographs with a database to identify unknown people.

Explore the interactive model

Export handout

A concise PDF covering how the system works, its data flows and points to investigate, ready to share.

The explanations and measures describe the typical system design. Extensive personal changes add an appendix.

Understand the use case

What defines this use case?

The person does not actively participate: the system searches for their face among many stored images and returns the closest matches. Germany's Federal Criminal Police Office uses retrospective matching in routine operations; real-time matching was tested at Berlin Südkreuz station.

This page describes a typical system design. Actual data flows and permissions depend on your implementation.

System design
Analysis and processing
Ability to act
Action permissions depend on integration
Fields of use
law enforcement
Also known as
facial recognition, photograph matching, face search engine

How it works, step by step

System design and data flows

  1. Input data

    The process begins with a photograph or camera image of an unknown person.

    Camera images, wanted persons' photographs and online images originate outside the organisation operating the system. The system processes facial images of identifiable people and links them to identities.

  2. Processing

    The system calculates a facial feature representation and compares it with stored images.

    The system detects a biometric characteristic in a recording and produces a comparable feature representation. It compares this against a reference collection to find possible identities. Recording quality, the reference collection and the decision threshold influence the matches.

  3. Results

    The system returns the most similar people and their similarity scores.

    The result describes the defined model task. A match, category or forecast acquires its professional significance only in conjunction with the underlying data and intended use.

  4. Use and impact

    Experts or officers review the matches and decide on investigation, a stop or arrest.

    Integration determines whether the result is simply displayed, adopted after approval or written directly into a business application. These variants differ in their data flows and permissions.

Explore the system design: Select a component to see its task, incoming and outgoing data, and role in the use case. The guided walkthrough explains each phase. Then use Yes, Uncertain and No to represent your specific system variant.

8 review first10 clarify7 baseline threats

InputProcessingResultImpact Externalaccess 04 Input 40 Third-partycontent 00 AI model 00 Providerservice 12 Documentcollection 11 Memory 00 Training andfeedback 11 OtherAI agents 00 Tools andinterfaces 00 Result 00 Business appor equipment 01 person 10 Affectedperson 00 AI serviceswithout approval 01 Externalaccess 04 Input 40 Third-partycontent 00 AI model 00 Providerservice 12 Documentcollection 11 Memory 00 Training andfeedback 11 OtherAI agents 00 Tools andinterfaces 00 Result 00 Business appor equipment 01 person 10 Affectedperson 00 AI serviceswithout approval 01
  • Present
  • Depends on your system
  • Absent
  • Review first
  • To clarify
Architecture as a list

How it differs from similar use cases

Data and information

Input data and information sources

Camera images, wanted persons' photographs and online images originate outside the organisation operating the system. The system processes facial images of identifiable people and links them to identities.

Processing and operating environment

Recognition methods generally come from specialist providers.

Storage and further use

The system searches stored photographs for the face and returns the closest matches.

Results and data sharing

Depending on the operation, a match triggers an alert to officers automatically or first goes to experts for review.

Using a provider does not automatically determine where processing takes place. Storage location, subcontractors, deletion periods and use for training must be checked for the specific deployment.

Assess risks and determine measures

From understanding the system to analysing risks

  1. Define the system boundary

    Record data, participants, interfaces and permissions. Resolve uncertain characteristics in the model.

  2. Investigate threats

    Relate review candidates to actual data flows: what could happen, and who would be affected?

  3. Assess risk

    Assess impacts and likelihood in the deployment context. The number of review candidates is not a risk score.

  4. Provide evidence of measures

    Select appropriate controls, assign responsibilities and define effectiveness checks. Document residual risks and approvals.

Key threats in the application context

  • 3 particularly important
  • 5 typical
  • 10 depending on the system
  • 7 additional threats for every AI system

A total of 25 threats from the threat catalogue may be relevant to this use case.

Also review: whether the system disadvantages groups

Check whether selection, ranking or assessment disadvantages people with protected characteristics, such as sex, age or origin.

Priority review points

  1. Overreliance

    The system returns the closest match even if the person sought is absent from the database. Investigators who rely on it can place an uninvolved person under suspicion, as the Detroit incidents show.

  2. Adversarial Inputs

    Glasses, make-up, masks or edited photographs change the features the system compares. The person sought may go unrecognised or be mistaken for someone else.

  3. Privacy Attacks

    Repeated image queries can reveal whether a particular person is stored in the database. That information alone may disclose that someone has been investigated.

5 further review candidates in the typical design

Other relevant threats

  1. Targeted Poisoning / Label Poisoning

    Falsified training labels can deliberately shift model outputs.

    Listed because of this characteristic

    • Learns from examples with correct answers

  2. Backdoor ML Model

    Training data or an adopted base model can introduce hidden triggers for misbehaviour.

    Listed because of this characteristic

    • Uses another provider's model

  3. Sensitive Information Disclosure

    Confidential content can appear in answers, supplied context or logs.

    Listed because of these characteristics

    • Processes personal data
    • Processes confidential data

  4. Exfiltration from ML Application

    Protected data can leak through tools, network connections, storage or insiders.

    Listed because of this characteristic

    • Processes confidential data

  5. RAG-Specific Attacks (Document Poisoning)

    Content entering the retrievable knowledge collection can influence answers and subsequent steps.

    Listed because of this characteristic

    • Searches its own document collection

Up to 10 further threats may apply, depending on your system design. Nine threats need to be reviewed for every AI system. Two of these are particularly important here and are therefore listed above.

System features and open questions

Each Yes adds further threats to your checklist, up to 10 in total. If you cannot yet answer a question, include its threats in your review.

How many threats a Yes adds
  • Added by this Yes
  • Also requires a Yes to another question

How your system is built

  1. Learns from your own data1 threat, plus 1 only in combination with other characteristics
  2. Changes data or triggers processes1 threat
  3. One search store for several permission groups1 threat
  4. Uses operational feedback1 threat

How you operate the system

  1. Available to people outside the organisation5 threats
  2. Accepts queries directly through an interface4 threats
  3. Accessible over a network2 threats, plus 1 only in combination with other characteristics
  4. Incurs costs with each query1 threat
  5. Shares computing resources with other customers or applications1 threat
  6. Used alongside unapproved AI services1 threat

How your system is built

Can the system change things itself, such as storing data, sending messages, initiating transactions or granting permissions?

Depending on the operation, a match triggers an alert to officers automatically or first goes to experts for review.

If yes, add

Do documents from several customers, departments or permission groups share one search store?

With commercial services, many customers search the same image collection.

If yes, add

How you operate the system

These questions arise for almost every AI system.

Do staff also use AI services for this task that your organisation has not approved?

Investigators who upload images to a freely available face search engine do so without approval.

If yes, add

Controls and implementation

Measures for the priority review areas are expanded. Each linked measure explains how to implement it.

Review priorityOverreliance3 measures
Review priorityAdversarial Inputs2 measures
Review priorityPrivacy Attacks3 measures
Targeted Poisoning / Label Poisoning3 measures
Backdoor ML Model2 measures
Sensitive Information Disclosure3 measures
Exfiltration from ML Application3 measures
RAG-Specific Attacks (Document Poisoning)3 measures

Controls for the remaining threats are available on their pages in the threat catalogue.

AI Act provisions

When AI Act provisions apply
  1. Art. 4: AI literacy

    For every AI system Applies since 2 February 2025.

  2. Art. 5 para. 1 point e, f, g, h: Prohibited biometric practices

    In typical use Review trigger since 2 February 2025.

  3. Annex III no. 1 point a: Remote biometric identification

    In typical use Review trigger from 2 December 2027.

  4. Annex III no. 6: Law enforcement

    Depending on use Review trigger from 2 December 2027.

  5. Annex III no. 7: Migration, asylum and border control

    Depending on use Review trigger from 2 December 2027.

Applies to every AI system

Art. 4: AI literacy

Applies if staff or appointed representatives operate or use AI systems.

Applies since 2 February 2025.

Obligations and details
Who bears the obligations
Provider, Deployer, Product manufacturer, Provider of a general-purpose AI model

Detailed obligations

May apply in typical use

Art. 5 para. 1 point e, f, g, h: Prohibited biometric practices

Applies if facial images are collected indiscriminately from the internet or video recordings to build the database, or police identify people in public spaces in real time.

Applies since 2 February 2025.

Obligations and details
The general condition is
Applies if the system indiscriminately collects facial images from the internet or video, recognises workplace or educational emotions, categorises people biometrically by sensitive attributes, or identifies people in public spaces in real time for law enforcement.
Exception
Workplace and educational emotion recognition is permitted for medical or safety reasons. Real-time law enforcement identification has narrowly defined exceptions.
Who bears the obligations
Provider, Deployer, Importer, Distributor, Authorised representative, Product manufacturer, Provider of a general-purpose AI model

Detailed obligations

Annex III no. 1 point a: Remote biometric identification

Applies if the system identifies people remotely from their faces, including retrospectively from stored recordings.

Applies from 2 December 2027.

Obligations and details
The general condition is
Applies if the system identifies people remotely using biometric features.
Exception
Systems that only confirm a person's claimed identity.
Who bears the obligations
Provider, Deployer, Product manufacturer

Detailed obligations

May apply in particular uses

Annex III no. 6: Law enforcement

Applies if law enforcement authorities use the matches to assess evidence or people in an investigation.

Applies from 2 December 2027.

Obligations and details
The general condition is
Applies if law enforcement authorities or bodies acting for them use the system, for example to assess evidence or people.
Who bears the obligations
Provider, Deployer, Product manufacturer

Detailed obligations

Annex III no. 7: Migration, asylum and border control

Applies if border authorities use the system to recognise or identify people beyond checking travel documents.

Applies from 2 December 2027.

Obligations and details
The general condition is
Applies if the system is used in examining asylum, visa or residence applications or at border controls.
Who bears the obligations
Provider, Deployer, Product manufacturer

Detailed obligations

Classify your system with the quick checker All obligations in the obligations compass

Cross-cutting threats

Review these threats for every AI system, whatever its purpose.

Why these threats always belong on the checklist

Atypical system features

View 15 further questions

If any of these features does apply to your system, add the listed threats.

Sources

Related use cases

Also in the field of Biometrics and emotion recognition

Often used together with

Updated: 30 September 2026. Review checklist rules version 0.3.2, threat catalogue version 2026.10.24.2. How these pages are structured