Input data and information sources
The person supplies the ID and camera image; they may be impersonating someone else. The system processes the person's facial image, name and identity document data.
Biometric verification and video identification
Also known as: Biometric verification and remote identity proofing
The system checks whether a person is who they claim to be, for example by comparing a live image with their ID photograph.
Understand the use case
What defines this use case?
The person shows their ID and face to the camera. The system compares the images and checks that a real person is present, rather than a photograph, mask or replayed video. Border controls and government portals use this approach; Germany's BSI publishes a technical guideline for video identification.
This page describes a typical system design. Actual data flows and permissions depend on your implementation.
- System design
- Analysis and processing
- Ability to act
- Action permissions depend on integration
- Fields of use
- border control, digital public services
- Also known as
- face-to-ID matching, liveness check, video identification, eGate
How it works, step by step
System design and data flows
Input data
The person presents or photographs their ID and shows their face to the camera.
The person supplies the ID and camera image; they may be impersonating someone else. In video identification, the system checks live images, ID photographs and often audio together.
Processing
The system checks that a live person is present and compares their face with the ID photograph.
The system compares a captured biometric characteristic with the reference for a claimed identity. Unlike searching an entire population database, this verifies a single identity claim. Liveness detection may be an additional check, where it is integrated.
Results
The system reports whether the images show the same person, usually with a match score.
The result describes the defined model task. A match, category or forecast acquires its professional significance only in conjunction with the underlying data and intended use.
Use and impact
A match opens the barrier, creates the account or enables login; otherwise, a person investigates further.
Integration determines whether the result is simply displayed, adopted after approval or written directly into a business application. These variants differ in their data flows and permissions.
Explore the system design: Select a component to see its task, incoming and outgoing data, and role in the use case. The guided walkthrough explains each phase. Then use Yes, Uncertain and No to represent your specific system variant.
13 review first4 clarify7 baseline threats
- Present
- Depends on your system
- Absent
- Review first
- To clarify
How to use the model
The diagram shows the typical architecture. Select a component to see what happens there and adapt its features to your system. Enable “Analysis guidance” to see which threats need reviewing for this architecture. The page's checklist continues to describe the typical case.
Changes from the typical case
None yet. Each change will appear here.
Where most threats arise
- 5 review first
- 5 review first
- 1 review first, 1 clarify
- 1 review first, 1 clarify
In this system design: 13 to review first, 4 to clarify, 7 baseline threats.
Architecture as a list
External access: Present
Review first
Input: Part of every AI system
Review first
- Adversarial Inputs Review priority
- Multimodal Attacks Review priority
- Privacy Attacks
- Sensitive Information Disclosure
- Exfiltration from ML Application
Third-party content: Present
AI model: Part of every AI system
Baseline for every AI system
Provider service: Present
Review first
To clarify
Training and feedback: Present
Review first
To clarify
Result: Part of every AI system
Review first
- Insecure Output Handling Review priority
Business application or equipment: Depends on your system
To clarify
person: Part of every AI system
Baseline for every AI system
Affected person: Present
Unapproved AI services: Depends on your system
To clarify
Supply chain and technical foundations: 5 baseline threats applying to every AI system
Baseline for every AI system
How it differs from similar use cases
Remote biometric identification (facial recognition)
Searches for an unknown person among many stored faces without their active participation
Data and information
Processing and operating environment
Deployers generally purchase face matching and liveness detection from specialist providers, such as iProov for GOV.UK One Login.
Storage and further use
Logging, retention periods and possible use for training must be established for the specific implementation.
Results and data sharing
Depending on the procedure, a positive result activates an account directly or requires human confirmation first. If checks run in a provider's cloud, facial images and ID data leave the organisation's environment.
Using a provider does not automatically determine where processing takes place. Storage location, subcontractors, deletion periods and use for training must be checked for the specific deployment.
Assess risks and determine measures
From understanding the system to analysing risks
- Define the system boundary
Record data, participants, interfaces and permissions. Resolve uncertain characteristics in the model.
- Investigate threats
Relate review candidates to actual data flows: what could happen, and who would be affected?
- Assess risk
Assess impacts and likelihood in the deployment context. The number of review candidates is not a risk score.
- Provide evidence of measures
Select appropriate controls, assign responsibilities and define effectiveness checks. Document residual risks and approvals.
Key threats in the application context
- 3 particularly important
- 10 typical
- 4 depending on the system
- 7 additional threats for every AI system
A total of 24 threats from the threat catalogue may be relevant to this use case.
Also review: whether the system disadvantages groups
Check whether selection, ranking or assessment disadvantages people with protected characteristics, such as sex, age or origin.
Priority review points
An impersonator presents a photograph, mask or synthetic video to the camera. If it defeats liveness detection, the system opens an account or barrier for the wrong person.
Downstream processes treat the result as a verified identity. Accepting it without further checks means a single error can create an account or grant access under a false name.
Injecting a synthetic video directly into the camera stream bypasses liveness detection without anyone standing before the camera. The system then confirms an identity nobody has physically presented.
10 further review candidates in the typical design
Other relevant threats
Targeted Poisoning / Label Poisoning
Falsified training labels can deliberately shift model outputs.
Listed because of this characteristic
- Learns from examples with correct answers
Training data or an adopted base model can introduce hidden triggers for misbehaviour.
Listed because of this characteristic
- Uses another provider's model
Anyone able to query the model can replicate it through many queries. Internally trained weights can be stolen through network access.
Listed because of this characteristic
- Available to people outside the organisation
Complex or high-volume inputs can exhaust model computing resources.
Listed because of these characteristics
- Available to people outside the organisation
- Processes text, images and speech together
Paid or publicly triggered queries can be abused to consume computing resources and money.
Listed because of this characteristic
- Available to people outside the organisation
Targeted queries can recover some personal or protected training data from the model.
Listed because of these characteristics
- Processes personal data
- Processes confidential data
- Recognises or compares people by physical features
Sensitive Information Disclosure
Confidential content can appear in answers, supplied context or logs.
Listed because of these characteristics
- Processes personal data
- Processes confidential data
Exfiltration from ML Application
Protected data can leak through tools, network connections, storage or insiders.
Listed because of this characteristic
- Processes confidential data
A network-accessible application can be overwhelmed by mass requests.
Listed because of this characteristic
- Available to people outside the organisation
Targeted queries can reveal the model's architecture and safeguards.
Listed because of this characteristic
- Available to people outside the organisation
Up to 4 further threats may apply, depending on your system design. Nine threats need to be reviewed for every AI system. Two of these are particularly important here and are therefore listed above.
System features and open questions
Each Yes adds further threats to your checklist, up to 4 in total. If you cannot yet answer a question, include its threats in your review.
- Added by this Yes
How your system is built
- Changes data or triggers processes1 threat
- Controls physical processes1 threat
- Learns from your own data1 threat
- Uses operational feedback1 threat
How you operate the system
How your system is built
Can the system change things itself, such as storing data, sending messages, initiating transactions or granting permissions?
Depending on the procedure, a positive result activates an account directly or requires human confirmation first.
If yes, add
Does the system directly move or control something physical, such as motors, valves, vehicles or temperatures?
At an automated border gate, a positive result opens the barrier.
If yes, add
Does your organisation train or fine-tune the model itself using its own data?
If yes, add
Does operational feedback or output later feed into analysis or training?
If yes, add
How you operate the system
These questions arise for almost every AI system.
Does the system share servers or computing resources with other customers or applications?
If yes, add
Do staff also use AI services for this task that your organisation has not approved?
If yes, add
Controls and implementation
Measures for the priority review areas are expanded. Each linked measure explains how to implement it.
Review priorityAdversarial Inputs2 measures
Review priorityInsecure Output Handling3 measures
Review priorityMultimodal Attacks2 measures
Targeted Poisoning / Label Poisoning3 measures
Backdoor ML Model2 measures
Model Theft3 measures
Model Denial of Service3 measures
Cost Harvesting / Repurposing3 measures
Privacy Attacks3 measures
Sensitive Information Disclosure3 measures
Exfiltration from ML Application3 measures
Application Denial of Service3 measures
Model Reconnaissance3 measures
Controls for the remaining threats are available on their pages in the threat catalogue.
AI Act provisions
-
Art. 4: AI literacy
For every AI system Applies since 2 February 2025.
-
Annex III no. 7: Migration, asylum and border control
Depending on use Review trigger from 2 December 2027.
Applies to every AI system
Art. 4: AI literacy
Applies if staff or appointed representatives operate or use AI systems.
Applies since 2 February 2025.
Obligations and details for Art. 4: AI literacy
- Who bears the obligations
- Provider, Deployer, Product manufacturer, Provider of a general-purpose AI model
Detailed obligations
May apply in particular uses
Annex III no. 7: Migration, asylum and border control
Applies if border authorities use the system to recognise or identify people beyond checking travel documents.
Applies from 2 December 2027.
Obligations and details for Annex III no. 7: Migration, asylum and border control
- The general condition is
- Applies if the system is used in examining asylum, visa or residence applications or at border controls.
- Who bears the obligations
- Provider, Deployer, Product manufacturer
Detailed obligations
Generally does not apply
Annex III no. 1 point a: Remote biometric identification
The system only confirms the identity claimed by an actively participating person. Annex III, point 1(a), expressly excludes this verification.
Obligations and details for Annex III no. 1 point a: Remote biometric identification
- The general condition is
- Applies if the system identifies people remotely using biometric features.
- Exception
- Systems that only confirm a person's claimed identity.
- Who bears the obligations
- Provider, Deployer, Product manufacturer
Detailed obligations
Classify your system with the quick checker All obligations in the obligations compass
Cross-cutting threats
Review these threats for every AI system, whatever its purpose.
Atypical system features
View 16 further questions
If any of these features does apply to your system, add the listed threats.
Does the system generate its own text, such as answers, drafts or summaries?
The system returns “match” or “no match” with a score and does not generate text.
If yes, add
Does the system generate or edit images, sounds, voices or videos?
If yes, add
Does the system create new content from open-ended requests that people read, see or hear directly? Translation, reading aloud and transcription do not count.
If yes, add
Can users give the system natural language tasks that it then performs?
If yes, add
Does the system search its own collection of documents or records for relevant content?
The system compares two images of the same person and does not search a collection of faces.
If yes, add
Does the system formulate answers from retrieved documents?
If yes, add
Does the system use a knowledge graph storing concepts and their relationships?
If yes, add
Does the system remember content from earlier conversations or tasks and reuse it later?
If yes, add
Does the system call other programs, interfaces or search services itself, even if only to read?
If yes, add
Does the system determine its next steps itself based on earlier results?
If yes, add
Does the system delegate tasks to other AI agents or incorporate their results?
If yes, add
Is the system connected to tools or data sources through the Model Context Protocol (MCP)?
If yes, add
Do documents from several customers, departments or permission groups share one search store?
If yes, add
Does the system generate code, scripts or database queries for further use?
If yes, add
Does the system execute programs, scripts or commands itself?
If yes, add
Is the system intended to maximise a specified metric, such as revenue, utilisation or clicks?
If yes, add
Sources
- Report of a deployment
Federal Police, Partially automated border control with EasyPASS According to the deployer
The Federal Police describes partially automated border checks in which travellers place their passport on a reader and look into a camera.
- Register or case collection
UK Algorithmic Transparency Record, GOV.UK One Login Liveness and Likeness Checks
The entry describes selfie matching with liveness detection for government login.
- Legislation, norm or standard
BSI, Technical Guideline TR-03147
The BSI guideline sets out how to verify people's identities remotely, for example through video identification.
- Legislation, norm or standard
EU AI Act, Annex III, point 1(a)
The Act excludes verification that merely confirms a claimed identity from remote biometric identification.
Related use cases
Also in the field of Biometrics and emotion recognition
- Remote biometric identification (facial recognition)The system compares faces in camera images or photographs with a database to identify unknown people.
- Emotion recognitionThe system infers a person's emotions or intentions from their face, voice or behaviour.
Often used together with
- Money laundering detection and sanctions screeningBanks search account and payment data for money laundering patterns and check all parties against sanctions lists.
- Payment fraud detectionA model assesses each payment for suspected fraud in real time and stops suspicious payments or refers them for review.
Updated: 30 September 2026. Review checklist rules version 0.3.2, threat catalogue version 2026.10.24.2. How these pages are structured