What is facial recognition?
Facial recognition is a biometric technology that identifies people from images of their faces. A model detects a face, aligns it, and converts it to a template, a vector of a few hundred numbers that captures the geometry of the face. Comparing two templates gives a similarity score. Verification (one-to-one) checks whether a face matches a claimed identity, as when a phone confirms that the person holding it is its owner. Identification (one-to-many) searches a database for a match, as when a camera scans a crowd against a watch list.
Face detection, which finds faces without identifying them, is a separate and less sensitive capability.
Facial recognition in the EU AI Act
The EU AI Act treats facial recognition as one of the highest-risk uses of AI. Real-time remote biometric identification in publicly accessible spaces for law enforcement is prohibited except in narrowly defined cases with prior authorization. Untargeted scraping of facial images from the internet or CCTV to build databases is banned, as are inferring race, political opinions, or sexual orientation from biometric data and emotion recognition in workplaces and schools. Other remote biometric identification systems are high-risk AI systems, which brings conformity assessment, logging, human oversight, and registration duties.
Outside the EU, the Illinois Biometric Information Privacy Act (BIPA) and similar state laws require written consent before collecting face templates and allow individuals to sue. The General Data Protection Regulation (GDPR) classes biometric data used for identification as special category data that needs an explicit legal basis.
Facial recognition in practice
A county government considers replacing badge readers at a records office with face-based entry. The lower-risk design is one-to-one verification: an employee presents a badge, and the camera confirms the face matches the template enrolled for that badge with the person’s written consent. Templates are stored on premises, encrypted, and deleted when employment ends. A one-to-many system that identified anyone entering the lobby would carry far higher legal exposure. In Kirk Tech Solutions engagements, facial recognition is treated as a governance decision first, with a data protection impact assessment and a documented legal basis completed before any camera is installed.
What to watch for
- Error rates differ by age, sex, and skin tone in many models, so demand test results broken down by demographic group.
- Face templates cannot be reissued like a password, so storage, encryption, and deletion rules deserve the same care as payment data.
- Ask whether the vendor trained on scraped images, which may make the product unlawful to deploy in some jurisdictions.
- Prefer verification over identification wherever the business need allows, and keep a human decision in every match that affects a person.