Biometric categorisation
A biometric categorisation system that individually categorises natural persons based on their biometric data in order to infer their race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation is prohibited. The prohibition targets inference of protected characteristics.
The prohibition is set out in Article 5(1)(g), read together with point 1(b) of Annex III. It has a narrow material scope: it does not prohibit biometric categorisation as such, but specifically the individual inference of the listed protected characteristics (race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation). Biometric categorisation for other purposes — e.g. commercial age or gender estimation that does not touch the listed protected categories — may be high-risk under Annex III point 1(b), but is not necessarily prohibited. In practice the prohibition is most likely to arise for marketing or security systems that perform sensitive profiling; it applies alongside, and independently of, the special-category data restriction under GDPR Article 9.
When procuring commercial or security-related facial or voice analysis tools, it is worth clarifying with the supplier that the system does not infer the listed protected characteristics — if it does, the prohibition applies automatically, regardless of documentation.
Need documented AI-literacy training?
Article 4 is a duty of diligence: what counts is not knowledge in the abstract, but demonstrable, documented effort. Our starter package lets you begin free.
Start freeRelated terms
- Prohibited AI practiceArticle 5(1) prohibits eight AI practices outright: subliminal or deceptive manipulation, exploitation of vulnerabilities, social scoring, predicting criminal offending from profiling alone, untargeted scraping of facial images, emotion recognition in the workplace and education, biometric categorisation to infer protected characteristics, and real-time remote biometric identification in public spaces. There is no compliance pathway for these.
- Real-time remote biometric identificationReal-time remote biometric identification in publicly accessible spaces for law enforcement purposes is, as a general rule, prohibited. It may exceptionally be permitted for three exhaustively listed purposes — such as averting a terrorist threat — but only where the Member State has enacted enabling national legislation and prior judicial or independent administrative authorisation has been obtained for each individual use.
- Emotion recognitionInferring emotions or intentions from biometric data is prohibited in the workplace and in educational institutions, except for medical or safety purposes — the concept of "workplace" extends to the recruitment process and the probationary period. In other contexts an emotion-recognition system is not prohibited, but under Article 50(3) the deployer must inform the individuals concerned about how the system operates.
Related questions in the knowledge base (Hungarian)
- Mit tilt az AI Act a biometrikus kategorizálásról?Az 5. cikk (1) bekezdés g) pontja tiltja azt a biometrikus kategorizálási rendszert, amely természetes személyeket egyénileg sorol be a biometrikus adataik alapján azért, hogy faji hovatartozásukra, politikai véleményükre, szakszervezeti tagságukra, vallási vagy világnézeti meggyőződésükre, szexuális életükre vagy irányultságukra következtessen.
- Tiltja az AI Act az arcképek internetes lekaparását?Igen, szűk körben. Az 5. cikk (1) bekezdés e) pontja tiltja azt az AI-rendszert, amely arcfelismerő adatbázisokat hoz létre vagy bővít az internetről vagy zártláncú kamerafelvételekből történő célzatlan arcképlekaparás útján. A tilalom a létrehozásra és a bővítésre irányul, nem magára az azonosításra.