European UnionAI Act, Article 26(10) (post-remote biometric identification authorisation)
Regulation (EU) 2024/1689, Article 26(10)
An AI risk obligations rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Place of effect
- Obligation class
- Biometric, Governance, Reporting
- Audit expectation
- periodic
- Who audits it
- Regulator, Self
What it requires
- This duty takes effect on for a high-risk AI system classified under Article 6(2) and Annex III, and on for one classified under Article 6(1) and Annex I, other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by if it is intended for use by public authorities.
- If you are a law enforcement deployer using a high-risk AI system for post-remote biometric identification in a targeted search for a suspected or convicted person, request authorisation from a judicial authority or a binding, judicially reviewable administrative authority, in advance or without undue delay and no later than 48 hours, unless you are using the system only for the initial identification of a potential suspect on objective and verifiable facts directly linked to the offence.NIST AI RMFGOVERN 1.1
- Limit each use to what is strictly necessary for the investigation of a specific criminal offence.NIST AI RMFMAP 3.3
- If the authorisation is rejected, stop the linked use immediately and delete the personal data the use generated.NIST AI RMFMANAGE 2.4
- Never use such a system in an untargeted way, without any link to a criminal offence, a criminal proceeding, a genuine threat of one, or the search for a specific missing person.NIST AI RMFMAP 3.3
- Do not take, or let a law enforcement authority take, any decision producing an adverse legal effect on a person based solely on the system's output.NIST AI RMFMAP 3.5
- Document every use in the relevant police file, and make it available to the market surveillance authority and the national data protection authority on request, excluding sensitive operational data.NIST AI RMFMEASURE 2.4
- Submit annual reports to the relevant market surveillance and data protection authorities on your use of post-remote biometric identification systems.NIST AI RMFGOVERN 1.1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- GOVERN 1.1Legal and regulatory requirements involving AI are understood, managed, and documented.
- MAP 3.3Targeted application scope is specified and documented based on the system’s capability, established context, and AI system categorization.
- MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.
- MEASURE 2.4The functionality and behavior of the AI system and its components – as identified in the MAP function – are monitored when in production.
- MANAGE 2.4Mechanisms are in place and applied, and responsibilities are assigned and understood, to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use.
- NIST AI 600-1
- GAI-RISK-04Data Privacy
- GAI-RISK-07Human-AI Configuration
- GAI-RISK-09Information Security
- NIST AI 200-2 Draft
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI09Human-Agent Trust Exploitation
- MIT mitigations Draft
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.DM-P5Data are destroyed according to policy.
- CT.DM-P8Audit/log records are determined, documented, implemented, and reviewed in accordance with policy and incorporating the principle of data minimization.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ETSI EN 304 223
- 5.1.4-1Capability for human oversight designed in and maintained.
- 5.1.4-3Where oversight is a risk control, the technical measures behind it are built, verified and maintained.
- 5.2.1-1Full inventory of assets, including their dependencies and connections.
- 5.2.2-5AI-specific incident management and recovery plans that are created, tested and maintained.
- 5.2.4-1Developers keep an audit trail of system design and post-deployment maintenance plans and offer it downstream.
- 5.4.2-1Operators log system and user actions.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Private right of actionNo
Penalty structure
Article 99(4)(e): non-compliance with the obligations of deployers under Article 26 is fined up to EUR 15,000,000 or 3% of worldwide annual turnover, whichever is higher. Article 99(6) requires the lower of the two amounts for an SME, including a start-up; Article 99(6a), inserted by Regulation (EU) 2026/1744, gives the same lower-of treatment to a small mid-cap enterprise, since both apply to paragraph 4 fines.
- Rule
- Lower of for SME
- As of
- Currency
- EUR
- Fixed cap
- 15,000,000
- Turnover percentage cap
- 3
Who enforces it
Settledness
- As of
- Open questions
- What counts as 'the initial identification of a potential suspect based on objective and verifiable facts directly linked to the offence' under Article 26(10), the one use of post-remote biometric identification that needs no authorisation?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Decision basis, Affected person reference
Logging duty
Every use of a post-remote biometric identification system must be documented in the relevant police file, made available to the market surveillance authority and the national data protection authority on request (excluding sensitive operational data), and reported annually to those authorities. The article does not say what the police-file documentation or the annual reports must contain; the basis for the use and a reference to the person sought are the nearest fit for a record of a use in a targeted search for a person, and the article itself names neither.
- Kind
- Explicit
- As of
- Provision
- Article 26(10), fifth and sixth subparagraphs
- Trigger
- high_risk_systems
Also on the record
EEA status
- Status
- Pending
- Source link
- https://www.efta.int/eea-lex/32024r1689
What this law does
In the framework of a targeted search for a suspected or convicted person, a law-enforcement deployer of a high-risk AI system for post-remote biometric identification must request authorisation, in advance or without undue delay and no later than 48 hours, from a judicial authority or a binding, judicially reviewable administrative authority, except when the system is used for the initial identification of a potential suspect on objective and verifiable facts directly linked to the offence.
Use is limited to what is strictly necessary for a specific criminal investigation; a rejected authorisation request stops the linked use immediately and requires deletion of the personal data it used; untargeted use unconnected to a specific offence, proceeding or threat is never permitted; and no adverse legal decision may rest solely on such a system's output.
Every use must be documented in the relevant police file and made available to the market surveillance authority and the national data protection authority on request, and deployers must submit annual reports on their use of post-remote biometric identification systems.
Article 26 sits in Chapter III, Section 3, so it takes effect on the schedule the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since ) wrote into Article 113: for a system classified as high-risk under Article 6(2) and Annex III, and for one classified under Article 6(1) and Annex I. Under Article 111(2), as the Digital Omnibus on AI rewrote it, the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before the date Chapter III applies only if, from that date, the system's design changes significantly; in any case, the providers and deployers of a high-risk AI system intended to be used by public authorities must take the necessary steps to comply with the Regulation's requirements and obligations by .
Article 26(10) does not apply to a high-risk AI system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.
Recitals (40) and (41) record that, to the extent Article 26(10) relates to the processing of personal data by Member States in activities within Chapter 4 or Chapter 5 of Title V of Part Three of the TFEU, Denmark is not bound by it under Protocol No 22, and Ireland is not bound by it under Protocol No 21 where Ireland is not bound by the rules governing the forms of judicial cooperation in criminal matters or police cooperation that require compliance with provisions laid down on the basis of Article 16 TFEU.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions or processes biometric data.
Back to the example · Lint your app
Page updated .