EU AI Act Article 5(1)(e) — Prohibition on building facial recognition databases by untargeted scraping
AI systems that create or expand facial recognition databases by untargeted scraping of facial images from the internet or CCTV footage are prohibited
Where this comes from
Provision: Article 5(1)(e) — Prohibition on building facial recognition databases by untargeted scraping
Instrument: EU Artificial Intelligence Act (Regulation (EU) 2024/1689)
Citation: Article 5(1)(e), Regulation (EU) 2024/1689
Text version: Regulation (EU) 2024/1689 (AI Act), OJ L, 12.7.2024
Checked against the source: 2 September 2026
Who it applies to
AI system in scope of the Act (Art. 2) — all of these:
- Service deploys AI systems in a professional capacity
…unless:
- AI Act scope exclusion is used exclusively for military, defence or national-security purposes or developed and used solely for scientific research and development
- Art. 2(3): the Regulation 'does not apply to AI systems where and in so far as they are placed on the market, put into service, or used with or without modification exclusively for military, defence or national security purposes'. (AI Act Art. 2(3))
- Art. 2(6): the Regulation 'does not apply to AI systems or AI models, including their output, specifically developed and put into service for the sole purpose of scientific research and development'. (AI Act Art. 2(6))
Scope in the source's own terms
- Art. 2(1): the AI system is placed on the market or put into service in the Union, or the provider/deployer is established in the Union, or the output produced by the system is used in the Union
- Art. 5(1): the prohibition binds ANY actor that places the system on the market, puts it into service or uses it — provider, deployer, importer, distributor or authorised representative alike
- Art. 5(1)(e): the system creates or expands facial recognition databases 'through the untargeted scraping of facial images from the internet or CCTV footage'
What engineering work it implies
Sample acceptance criteria Landfall generates for this obligation:
- Every AI system and material feature is checked against this prohibition and the result is recorded per system, with a date and an owner
- A signed attestation states that the practice is not present, naming who is accountable for it
- A design-review gate asks this question before a new AI feature ships, so a future introduction is caught rather than assumed away
- Where the prohibition carries a narrow exception, reliance on it is documented with the specific facts, not asserted generically
- Third-party and vendor AI components are covered by the same check, with the obligation flowed down contractually
Evidence an auditor expects
- Assessment documentDocument review
Prohibited-practice screening attestation for Art. 5(1)(e)
Signed assessment confirming that no facial recognition database is created or expanded through untargeted scraping of facial images from the internet or CCTV footage
- Process recordDocument review
Provenance record for every facial image corpus held
Per-dataset provenance record: source, collection method, lawful basis and licence. Untargeted web or CCTV scraping must be identifiable from the record itself, not from a supplier's assurance
Questions people ask
- Does EU AI Act Article 5(1)(e) — Prohibition on building facial recognition databa… apply to my service?
- It applies when Service deploys AI systems in a professional capacity. It does not apply where AI Act scope exclusion is used exclusively for military, defence or national-security purposes or developed and used solely for scientific research and development.
- When does this become enforceable?
- EU AI Act Article 5(1)(e) — Prohibition on building facial recognition databa… is enforceable from 2 February 2025. Its current status is: in force.
- What evidence does an auditor expect?
- Prohibited-practice screening attestation for Art. 5(1)(e); Provenance record for every facial image corpus held.
Find out whether this one lands on you
Landfall's pre-scan answers the applicability question above for your product in minutes, then turns every obligation that applies into traceable engineering tickets with a citation chain your auditors can follow.
Not legal advice. Landfall maps regulatory obligations to engineering work for planning purposes. Its verdicts are not legal advice and create no attorney-client relationship — verify with qualified counsel before relying on them.