Input data and information sources
Outsiders can obscure, dirty or falsify plates and vehicles in public spaces. A plate links through the vehicle register to its registered keeper.
Automatic number plate recognition (ANPR)
Cameras capture vehicle number plates, and the system automatically checks them against registration or police search data.
Understand the use case
What defines this use case?
Fixed or vehicle-mounted cameras capture passing or parked vehicles; image recognition reads their plates. Dutch municipalities use this to check parking rights, while police check plates against search databases.
This page describes a typical system design. Actual data flows and permissions depend on your implementation.
- System design
- Analysis and processing
- Ability to act
- Action permissions depend on integration
- Fields of use
- local government, law enforcement
- Also known as
- scanning vehicle, number plate reader
How it works, step by step
System design and data flows
Input data
Cameras capture passing or parked vehicles with location and time.
Outsiders can obscure, dirty or falsify plates and vehicles in public spaces. A plate links through the vehicle register to its registered keeper.
Processing
Image recognition reads the plate; the system searches parking rights or police search databases.
Image processing first detects the number-plate region and converts its characters into text. The recognised string may then be checked against a designated database. Image detection, character recognition and database matching are consecutive steps with distinct outputs.
Results
The system reports a match with image, location and time or discards the recording.
The result describes the defined model task. A match, category or forecast acquires its professional significance only in conjunction with the underlying data and intended use.
Use and impact
Enforcement staff or police review matches and impose a penalty, check the vehicle or initiate a search measure.
Integration determines whether the result is simply displayed, adopted after approval or written directly into a business application. These variants differ in their data flows and permissions.
Explore the system design: Select a component to see its task, incoming and outgoing data, and role in the use case. The guided walkthrough explains each phase. Then use Yes, Uncertain and No to represent your specific system variant.
7 review first10 clarify7 baseline threats
- Present
- Depends on your system
- Absent
- Review first
- To clarify
How to use the model
The diagram shows the typical architecture. Select a component to see what happens there and adapt its features to your system. Enable “Analysis guidance” to see which threats need reviewing for this architecture. The page's checklist continues to describe the typical case.
Changes from the typical case
None yet. Each change will appear here.
Where most threats arise
- 1 review first, 3 clarify
- 4 clarify
- 3 review first
- 1 review first, 1 clarify
In this system design: 7 to review first, 10 to clarify, 7 baseline threats.
Architecture as a list
External access: Depends on your system
To clarify
Input: Part of every AI system
Review first
- Adversarial Inputs Review priority
- Sensitive Information Disclosure Review priority
- Privacy Attacks
Third-party content: Present
AI model: Part of every AI system
Baseline for every AI system
Provider service: Present
Review first
To clarify
Document collection: Present
Review first
Training and feedback: Present
Review first
To clarify
Result: Part of every AI system
Baseline for every AI system
Business application or equipment: Depends on your system
To clarify
person: Part of every AI system
Review first
- Overreliance Review priority
Affected person: Present
Unapproved AI services: Depends on your system
To clarify
Supply chain and technical foundations: 5 baseline threats applying to every AI system
Baseline for every AI system
How it differs from similar use cases
Intelligent video analytics in public spaces
Recognises events such as fights or heavy objects on vulnerable bridges
Remote biometric identification (facial recognition)
Identifies people by their faces
Data and information
Processing and operating environment
Cameras and image recognition generally come from a provider.
Storage and further use
The system searches each plate in a parking rights or police search database.
Results and data sharing
Depending on the authority, a match automatically triggers a penalty or first requires an enforcement officer's confirmation.
Using a provider does not automatically determine where processing takes place. Storage location, subcontractors, deletion periods and use for training must be checked for the specific deployment.
Assess risks and determine measures
From understanding the system to analysing risks
- Define the system boundary
Record data, participants, interfaces and permissions. Resolve uncertain characteristics in the model.
- Investigate threats
Relate review candidates to actual data flows: what could happen, and who would be affected?
- Assess risk
Assess impacts and likelihood in the deployment context. The number of review candidates is not a risk score.
- Provide evidence of measures
Select appropriate controls, assign responsibilities and define effectiveness checks. Document residual risks and approvals.
Key threats in the application context
- 3 particularly important
- 4 typical
- 10 depending on the system
- 7 additional threats for every AI system
A total of 24 threats from the threat catalogue may be relevant to this use case.
Also review: whether the system disadvantages groups
Check whether selection, ranking or assessment disadvantages people with protected characteristics, such as sex, age or origin.
Priority review points
The system misreads a dirty, partly obscured or film-altered plate. Another vehicle receives the penalty, or a wanted vehicle escapes detection.
Enforcement staff see many matches each day and may begin confirming them without close inspection. A misread digit then produces a notice against an uninvolved person.
Sensitive Information Disclosure
The system stores location and time for each plate. Leaked or over-retained records reveal who was where and when.
4 further review candidates in the typical design
Other relevant threats
Targeted Poisoning / Label Poisoning
Falsified training labels can deliberately shift model outputs.
Listed because of this characteristic
- Learns from examples with correct answers
Training data or an adopted base model can introduce hidden triggers for misbehaviour.
Listed because of this characteristic
- Uses another provider's model
Targeted queries can recover some personal or protected training data from the model.
Listed because of this characteristic
- Processes personal data
RAG-Specific Attacks (Document Poisoning)
Content entering the retrievable knowledge collection can influence answers and subsequent steps.
Listed because of this characteristic
- Searches its own document collection
Up to 10 further threats may apply, depending on your system design. Nine threats need to be reviewed for every AI system. Two of these are particularly important here and are therefore listed above.
System features and open questions
Each Yes adds further threats to your checklist, up to 10 in total. If you cannot yet answer a question, include its threats in your review.
- Added by this Yes
- Also requires a Yes to another question
How your system is built
- Learns from your own data1 threat, plus 1 only in combination with other characteristics
- Changes data or triggers processes1 threat
- Processes confidential data1 threat
- Uses operational feedback1 threat
How you operate the system
- Accepts queries directly through an interface4 threats
- Accessible over a network2 threats, plus 1 only in combination with other characteristics
- Incurs costs with each query1 threat
- Passes content to services outside your environment1 threat
- Shares computing resources with other customers or applications1 threat
- Used alongside unapproved AI services1 threat
How your system is built
Can the system change things itself, such as storing data, sending messages, initiating transactions or granting permissions?
Depending on the authority, a match automatically triggers a penalty or first requires an enforcement officer's confirmation.
If yes, add
Does the system process confidential information such as trade secrets, health or financial data?
Stored locations and times form movement profiles; police search databases are confidential.
If yes, add
Does your organisation train or fine-tune the model itself using its own data?
If yes, add
Does operational feedback or output later feed into analysis or training?
If yes, add
How you operate the system
These questions arise for almost every AI system.
Can people or programs query the model directly, for example through an interface?
If yes, add
Is the system accessible over a network or dependent on network services?
A scanning vehicle checking plates over a network against a central database depends on that service.
If yes, add
Do you pay per query or unit of computing time, so costs increase with use?
If yes, add
Can content leave your environment, for example to a cloud provider, web search or email?
If yes, add
Does the system share servers or computing resources with other customers or applications?
If yes, add
Do staff also use AI services for this task that your organisation has not approved?
If yes, add
Controls and implementation
Measures for the priority review areas are expanded. Each linked measure explains how to implement it.
Review priorityAdversarial Inputs2 measures
Review priorityOverreliance3 measures
Review prioritySensitive Information Disclosure3 measures
Targeted Poisoning / Label Poisoning3 measures
Backdoor ML Model2 measures
Privacy Attacks3 measures
RAG-Specific Attacks (Document Poisoning)3 measures
Controls for the remaining threats are available on their pages in the threat catalogue.
AI Act provisions
-
Art. 4: AI literacy
For every AI system Applies since 2 February 2025.
-
Annex III no. 6: Law enforcement
Depending on use Review trigger from 2 December 2027.
Applies to every AI system
Art. 4: AI literacy
Applies if staff or appointed representatives operate or use AI systems.
Applies since 2 February 2025.
Obligations and details for Art. 4: AI literacy
- Who bears the obligations
- Provider, Deployer, Product manufacturer, Provider of a general-purpose AI model
Detailed obligations
May apply in particular uses
Annex III no. 6: Law enforcement
Applies if police use matches to assess people or evidence in an investigation.
Applies from 2 December 2027.
Obligations and details for Annex III no. 6: Law enforcement
- The general condition is
- Applies if law enforcement authorities or bodies acting for them use the system, for example to assess evidence or people.
- Who bears the obligations
- Provider, Deployer, Product manufacturer
Detailed obligations
Generally does not apply
Annex III no. 1 point a: Remote biometric identification
The system reads vehicle plates and does not analyse people's biometric features.
Obligations and details for Annex III no. 1 point a: Remote biometric identification
- The general condition is
- Applies if the system identifies people remotely using biometric features.
- Exception
- Systems that only confirm a person's claimed identity.
- Who bears the obligations
- Provider, Deployer, Product manufacturer
Detailed obligations
Classify your system with the quick checker All obligations in the obligations compass
Cross-cutting threats
Review these threats for every AI system, whatever its purpose.
Atypical system features
View 17 further questions
If any of these features does apply to your system, add the listed threats.
Does the system generate its own text, such as answers, drafts or summaries?
The system returns a recognised plate and a match, rather than text.
If yes, add
Does the system generate or edit images, sounds, voices or videos?
If yes, add
Does the system create new content from open-ended requests that people read, see or hear directly? Translation, reading aloud and transcription do not count.
If yes, add
Can users give the system natural language tasks that it then performs?
If yes, add
Does the system formulate answers from retrieved documents?
If yes, add
Does the system use a knowledge graph storing concepts and their relationships?
If yes, add
Does the system remember content from earlier conversations or tasks and reuse it later?
If yes, add
Does the system call other programs, interfaces or search services itself, even if only to read?
If yes, add
Does the system determine its next steps itself based on earlier results?
If yes, add
Does the system delegate tasks to other AI agents or incorporate their results?
If yes, add
Is the system connected to tools or data sources through the Model Context Protocol (MCP)?
If yes, add
Do documents from several customers, departments or permission groups share one search store?
If yes, add
Can people outside your organisation use the system, including without login?
Only authorities operate the system; the people captured do not use it.
If yes, add
Does the system process several input types together, such as text with images or speech?
If yes, add
Does the system generate code, scripts or database queries for further use?
If yes, add
Does the system execute programs, scripts or commands itself?
If yes, add
Is the system intended to maximise a specified metric, such as revenue, utilisation or clicks?
If yes, add
Sources
- Register or case collection
Dutch Algorithm Register, Parkeerhandhaving door middel van een scanauto, Gemeente Delft
The entry describes plate image recognition, human review of matches and deletion of non-violation images within 72 hours.
- Register or case collection
Dutch Algorithm Register, Scanauto, Gemeente Breda
The entry describes cameras reading plates for parking enforcement since 2020.
- Authority, court or parliament
Federal Constitutional Court, Order of 18 December 2018, 1 BvR 142/15 (Press release No 8/2019)
The Court describes use in Bavaria and finds that every check interferes with fundamental rights, even without a match.
Related use cases
Also in the field of Administration, justice and public safety
- Risk-based review selection for applications and benefitsAuthorities assess applications or payments for error or fraud risk and use this to select cases for closer review.
- Automated property valuation (AVM)A model estimates residential property market values from property characteristics and comparable sales.
- Police data analysis platformsPolice analysis platforms combine data from different sources and display links between people, incidents and cases as graphs, tables or maps.
- AI assistance in high-volume court proceedingsIn high-volume proceedings, the system organises pleadings, extracts each case's features and prepares draft decisions.
- Language and dialect recognition in asylum proceduresFrom a short speech sample, the system estimates which language and dialect an asylum seeker is likely to speak.
- Intelligent video analytics in public spacesThe system detects specific events or objects in camera images and alerts a control centre without identifying people.
Updated: 30 September 2026. Review checklist rules version 0.3.2, threat catalogue version 2026.10.24.2. How these pages are structured