- 18 Nov 2026 UK Have your directors and PSCs verified with Companies House?
- 1 Dec 2026 AU Will your onboarding accept private-sector Digital IDs?
- 10 Dec 2026 AU Does your privacy policy explain your automated KYC decisions?
- End 2026 EU Is your ID verification ready for EUDI Wallets?
- 1 Jan 2027 US Can your age checks keep up state by state?
- 1 Apr 2027 JP Is your eKYC ready for the IC-chip mandate?
- 10 Jul 2027 EU Is your CDD flow ready for the AMLR?
- 1 Jan 2028 US Are your adviser clients ready for FinCEN’s AML rule?
- 31 Mar 2029 AU Is your initial CDD on the new AUSTRAC model?
- Now AU Tranche 2 is live. Is your AML/CTF program running?
AI Act biometrics: remote identification, KYC verification and the 2027 deadline
The EU AI Act bans some biometric uses, treats others as high-risk and excludes one-to-one verification that confirms a person is who they claim to be. The Digital Omnibus moved the high-risk start to 2 December 2027.
- Remote biometric identification systems are high-risk under Annex III, point 1(a). Systems used only to confirm that a person is who they claim to be are excluded.
- The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026 and moved the Annex III high-risk rules from 2 August 2026 to 2 December 2027.
- Real-time remote biometric identification in public spaces for law enforcement, untargeted scraping of facial images and biometric categorisation by sensitive traits have been banned since 2 February 2025, with narrow exceptions.
- Fines for prohibited practices reach EUR 35 million or 7% of worldwide annual turnover, whichever is higher (Art 99(3)).
What it is
The AI Act, Regulation (EU) 2024/1689, regulates AI systems by risk. It entered into force on 1 August 2024 and became generally applicable on 2 August 2026, with some parts earlier and later. The Commission's AI Act page sets out the current timeline after the Digital Omnibus.
The Act draws a line that matters for KYC. Biometric identification recognises a person by comparing their biometric data with a database of many people (one-to-many). Biometric verification is automated one-to-one checking, including authentication, by comparing a person's biometric data with data they provided earlier (Art 3(35) and (36)). A selfie matched to the photo on the ID document the same person has just presented is the second kind.
Annex III, point 1 lists three biometric uses as high-risk: remote biometric identification, biometric categorisation by sensitive or protected attributes, and emotion recognition. Point 1(a) says it does not include systems intended for biometric verification whose sole purpose is to confirm that a specific person is the person they claim to be.
Who it applies to
The Act binds providers that place AI systems on the EU market, wherever they are based, and deployers in the EU. It also reaches providers and deployers outside the EU when the output of their system is used in the EU (Art 2(1)).
- Identity verification and biometrics vendors that sell into the EU (providers)
- Firms in the EU that use those systems to onboard clients (deployers)
- Firms outside the EU whose system output is used in the EU
For an accounting, legal or real estate firm in Australia, the UK or New Zealand that verifies clients with a document and selfie check, the AI Act is mostly indirect. The duties sit mainly with the vendor, and one-to-one verification sits outside the Annex III biometric category. The firm's question is whether its vendor has classified its system and can show it.
What you have to do
These steps apply to a firm that uses biometric checks with EU clients, and to its vendors. Each one is matched to the kind of work it concerns.
- Confirm your check is one-to-one verification
Check that the face match compares the person only with the ID document they present, to confirm a claimed identity. Searching a face against a database of many people is identification, and remote identification is high-risk.
- Stay clear of banned practices
Do not use systems that build facial recognition databases by untargeted scraping, or that categorise people by biometric data to infer race, political opinions, religion, sex life or sexual orientation (Art 5(1)(e) and (g)).
Vendor due diligence - Check the other biometric categories
Biometric categorisation by sensitive or protected attributes and emotion recognition are high-risk under Annex III, points 1(b) and 1(c). Ask your vendor whether any feature, such as a fraud or liveness model, falls into either.
Vendor due diligence - Plan for 2 December 2027
If any system you provide or deploy is high-risk under Annex III, its obligations apply from 2 December 2027. Systems in products covered by Annex I follow from 2 August 2028.
Planning - Handle biometric data under the GDPR
Leaving the high-risk list does not lift data protection rules. Biometric data used to uniquely identify a person is special category data under GDPR Article 9. See the GDPR hub.
What firms get wrong
Most mistakes come from treating every face check as the same thing.
Annex III, point 1(a) excludes biometric verification whose sole purpose is to confirm a person is who they claim to be. One-to-one matching against the document the person presents is the kind of check the exclusion describes.
The ban in Article 5(1)(h) covers real-time remote biometric identification in publicly accessible spaces for law enforcement, with narrow exceptions. Other bans target untargeted scraping and sensitive categorisation.
The Digital Omnibus moved them. Annex III systems now follow from 2 December 2027, according to the Commission.
What happens when
- In force
AI Act enters into force Source
- In force
Prohibited practices apply, including the biometric bans in Art 5 Source
- In force
Digital Omnibus on AI, Regulation (EU) 2026/1744, enters into force Source
- In force
AI Act generally applicable, including transparency rules Source
- Delayed
Annex III high-risk rules apply, including remote biometric identification (moved from 2 Aug 2026) Source
- Delayed
High-risk rules for AI in products covered by Annex I Source
Also on the regulatory timeline.
Related guides
Questions people ask
Is biometric identity verification high-risk under the AI Act?
Not when its sole purpose is to confirm a person is who they claim to be. Annex III, point 1(a) excludes that kind of one-to-one verification. Remote biometric identification against a database is high-risk.
What is the difference between biometric identification and verification?
Identification compares a person's biometric data with a database of many people to find out who they are. Verification compares it one-to-one with data the same person provided earlier, to confirm a claimed identity (Art 3(35) and (36)).
When do the AI Act high-risk rules apply?
Annex III systems from 2 December 2027, and AI in products covered by Annex I from 2 August 2028, after the Digital Omnibus on AI.
Which biometric uses are banned?
Untargeted scraping of facial images to build recognition databases, biometric categorisation to infer sensitive traits such as race or religion, and real-time remote biometric identification in public spaces for law enforcement, except in narrow cases (Art 5). See biometric identity verification.
Primary sources
Checked 5 Nov 2026. We review this page every 90 days and when the rules change.
- European Commission, AI Act regulatory framework page (timeline after the Digital Omnibus)
- Regulation (EU) 2024/1689 (AI Act), Official Journal ELI link. EUR-Lex blocks automated reading, so article text was checked on the artificialintelligenceact.eu mirror
- AI Act mirror, Annex III (high-risk biometrics and the verification exclusion)
- AI Act mirror, Art 3 (definitions 35, 36, 41, 42)
- AI Act mirror, Art 5 (prohibited practices)
- AI Act mirror, Art 2 (scope) and Art 99 (penalties)
- Hunton Andrews Kurth, EU Digital Omnibus on AI enters into force (Regulation (EU) 2026/1744; secondary)
Where StackGo fits
StackGo is compliance middleware. IdentityCheck's biometric check matches a live selfie to the photo on the ID document the same person presents, which is one-to-one verification of a claimed identity. Whether a given setup sits inside the Annex III exclusion is for the firm and its own advisers to confirm.
- Biometric identity verification: a photo of a government ID document plus a live selfie with liveness, covering 12,500 document types from 230+ countries and territories.
- PEP, sanctions and adverse media screening, with ongoing monitoring of screened clients.
- It gives no legal advice on how the AI Act classifies your setup. Ask any vendor, StackGo included, for its own classification in writing.
Ready to make onboarding minutes, not hours?
Start free and run your first check today, or book a demo and we will walk you through it.