AI Facial Recognition: What German Companies Need to Know
Facial recognition is among the most regulated AI applications under the EU AI Act. Some uses are outright prohibited. Others are high-risk with comprehensive compliance requirements. The distinctions matter enormously.
What’s Prohibited
Real-time biometric identification in public spaces for law enforcement is prohibited, with narrow exceptions. So is scraping facial images from the internet to build recognition databases. And untargeted facial recognition surveillance is banned.
For commercial applications: you cannot build facial recognition databases by scraping social media or other online sources. This prohibition targets the Clearview AI model—and it’s already in effect.
High-Risk Applications
Facial recognition for access control, identity verification, and authentication is generally high-risk, not prohibited. But it faces the strictest compliance requirements: risk management systems, bias testing, human oversight, and transparency.
This includes building access systems, payment authentication, age verification, and identity verification for regulated services.
Workplace Considerations
Using facial recognition to monitor employees requires works council approval under §87 BetrVG. Even for access control, the Betriebsrat has co-determination rights. Expect detailed questions about data retention, false positive rates, and alternative authentication methods.
Facial recognition for employee surveillance or performance monitoring faces both AI Act restrictions and German employment law barriers.
GDPR Intersection
Facial data is biometric data under GDPR—special category data with heightened protection. You need explicit consent or another legal basis from Article 9(2). Legitimate interest isn’t sufficient.
This means facial recognition for customers typically requires explicit, informed consent before enrollment.
How Compound Law Helps
- Classification of facial recognition use cases
- High-risk compliance framework for permitted applications
- GDPR biometric data compliance
- Works council negotiation for workplace systems
- Audit of existing systems against new requirements
Frequently Asked Questions
Is building access facial recognition prohibited? No, but it’s high-risk. Full compliance requirements apply, plus GDPR consent for biometric processing.
Can we use facial recognition for customer identity verification? Yes, with proper compliance. High-risk requirements, GDPR consent, and transparency obligations all apply.
What about facial recognition from security cameras? Untargeted surveillance is problematic. Specific, justified use cases may be permissible with proper compliance.
