AI Act prohibition of biometric categorisation for sensitive characteristics

The Future of Privacy Forum (FPF) has published the seventh article in a series exploring the prohibited practices set out in the EU Artificial Intelligence Act (AI Act). 

The seventh article focuses on Article 5(1)(g), which prohibits biometric categorisation used to deduce or infer "certain sensitive characteristics" such as race, political opinions, trade union membership, religious beliefs, sex life, or sexual orientation. A key takeaway is that the AI Act does not ban biometric categorisation entirely; instead, it targets specific inference practices. Systems categorising individuals based on non-sensitive physical traits or for purposes that do not involve the listed protected attributes remain outside the scope of this prohibition.

The analysis clarifies that the intended objective and the system's design are central to determining legality. The ban is triggered by the intent to infer protected attributes rather than the mere presence of biometric analysis. However, FPF noted that the relationship between the AI Act and the EU General Data Protection Regulation (GDPR) requires further clarification. As the AI Act does not override the GDPR, certain biometric processing may remain lawful under strict conditions, creating a complex legal intersection that developers and regulators are required to navigate to ensure compliance.

Training Announcement: Freevacy offers a range of independently recognised professional AI governance qualifications and AI Literacy short courses that enable specialist teams to implement robust oversight, benchmark AI governance maturity, and establish a responsible-by-design approach across the entire AI lifecycle. Find out more.