EU AI Act Article 5(1)(h) — Prohibition on 'real-time' remote biometric identification in publicly accessible spaces for law en…
'Real-time' remote biometric identification in publicly accessible spaces for law-enforcement purposes is prohibited except for three strictly necessary objectives, and then only with prior judicial authorisation, a fundamental rights impact assessment and EU-database registration
Where this comes from
Provision: Article 5(1)(h) — Prohibition on 'real-time' remote biometric identification in publicly accessible spaces for law enforcement
Instrument: EU Artificial Intelligence Act (Regulation (EU) 2024/1689)
Citation: Article 5(1)(h), Regulation (EU) 2024/1689
Text version: Regulation (EU) 2024/1689 (AI Act), OJ L, 12.7.2024
Checked against the source: 2 September 2026
Who it applies to
AI system in scope of the Act (Art. 2) — all of these:
- Service deploys AI systems in a professional capacity
…unless:
- AI Act scope exclusion is used exclusively for military, defence or national-security purposes or developed and used solely for scientific research and development
- Art. 2(3): the Regulation 'does not apply to AI systems where and in so far as they are placed on the market, put into service, or used with or without modification exclusively for military, defence or national security purposes'. (AI Act Art. 2(3))
- Art. 2(6): the Regulation 'does not apply to AI systems or AI models, including their output, specifically developed and put into service for the sole purpose of scientific research and development'. (AI Act Art. 2(6))
- Art. 5(1)(h)(i): use is permitted in so far as strictly necessary for 'the targeted search for specific victims of abduction, trafficking in human beings or sexual exploitation of human beings, as well as the search for missing persons'. (AI Act Art. 5(1)(h)(i))
- Art. 5(1)(h)(ii): use is permitted in so far as strictly necessary for 'the prevention of a specific, substantial and imminent threat to the life or physical safety of natural persons or a genuine and present or genuine and foreseeable threat of a... (AI Act Art. 5(1)(h)(ii))
- Art. 5(1)(h)(iii): use is permitted in so far as strictly necessary for 'the localisation or identification of a person suspected of having committed a criminal offence, for the purpose of conducting a criminal investigation or prosecution or executing a... (AI Act Art. 5(1)(h)(iii))
Scope in the source's own terms
- Art. 2(1): the AI system is placed on the market or put into service in the Union, or the provider/deployer is established in the Union, or the output produced by the system is used in the Union
- Art. 5(1)(h): the system performs 'real-time' remote biometric identification of natural persons in publicly accessible spaces
- Art. 5(1)(h): the identification is carried out 'for the purposes of law enforcement' by a law-enforcement authority or an actor on its behalf. Private-sector real-time RBI is not caught by this prohibition — it is governed by Annex III pt 1 (high-risk) and by the GDPR
What engineering work it implies
Sample acceptance criteria Landfall generates for this obligation:
- Every AI system and material feature is checked against this prohibition and the result is recorded per system, with a date and an owner
- A signed attestation states that the practice is not present, naming who is accountable for it
- A design-review gate asks this question before a new AI feature ships, so a future introduction is caught rather than assumed away
- Where the prohibition carries a narrow exception, reliance on it is documented with the specific facts, not asserted generically
- Third-party and vendor AI components are covered by the same check, with the obligation flowed down contractually
Evidence an auditor expects
- Assessment documentDocument review
Prohibited-practice screening attestation for Art. 5(1)(h), and — where an exception is relied on — the Art. 5(2) fundamental rights impact assessment
Signed assessment recording whether real-time remote biometric identification is used in publicly accessible spaces for law-enforcement purposes; where it is, the Art. 27 FRIA required by Art. 5(2), the Art. 49 registration, and the record of the seriousness, probability and scale of harm and of the consequences for the rights of all persons concerned
- Process recordDocument reviewRetain per the national implementing law; not fixed by the Regulation
Prior-authorisation and notification file under Art. 5(3) and Art. 5(5)
Per-use authorisation by a judicial authority or an independent administrative authority (or, in duly justified urgency, the authorisation requested within 24 hours), the national authorising law relied on, and the notification made to the market surveillance authority and the national data protection authority
Questions people ask
- Does EU AI Act Article 5(1)(h) — Prohibition on 'real-time' remote biometric ident… apply to my service?
- It applies when Service deploys AI systems in a professional capacity. It does not apply where AI Act scope exclusion is used exclusively for military, defence or national-security purposes or developed and used solely for scientific research and development.
- When does this become enforceable?
- EU AI Act Article 5(1)(h) — Prohibition on 'real-time' remote biometric ident… is enforceable from 2 February 2025. Its current status is: in force.
- What evidence does an auditor expect?
- Prohibited-practice screening attestation for Art. 5(1)(h), and — where an exception is relied on — the Art. 5(2) fundamental rights impact assessment; Prior-authorisation and notification file under Art. 5(3) and Art. 5(5).
Find out whether this one lands on you
Landfall's pre-scan answers the applicability question above for your product in minutes, then turns every obligation that applies into traceable engineering tickets with a citation chain your auditors can follow.
Not legal advice. Landfall maps regulatory obligations to engineering work for planning purposes. Its verdicts are not legal advice and create no attorney-client relationship — verify with qualified counsel before relying on them.