Sector guide
The EU AI Act for the public sector and law enforcement
The densest part of the Act. Four Annex III areas and most of the Article 5 prohibitions are aimed at public authorities, and several of the bans apply to law enforcement specifically rather than to everyone.
What the Act actually names in this sector
These are the provisions that reach public sector and law enforcement, quoted from the Official Journal. Everything below follows from them.
AI systems intended to be used by public authorities or on behalf of public authorities to evaluate the eligibility of natural persons for essential public assistance benefits and services
Annex III, 5(a) →the use of 'real-time' remote biometric identification systems in publicly accessible spaces for the purposes of law enforcement
Article 5(1)(h) →AI systems intended to be used by a judicial authority or on their behalf to assist a judicial authority in researching and interpreting facts and the law
Annex III, 8(a) →
Common use cases, classified
Prohibited
Banned outright. There is no compliance route — the practice has to stop or change.
- Predicting who will commit a crime
Risk assessment of a natural person committing a criminal offence, based solely on profiling or on personality traits, is prohibited.
The prohibition does not reach systems supporting a human assessment already grounded in objective, verifiable facts directly linked to criminal activity.
Article 5(1)(d) → - Real-time face recognition in public spaces
Real-time remote biometric identification in publicly accessible spaces for law enforcement is prohibited as a rule.
Article 5(1)(h) lists exhaustive exceptions — targeted search for victims, an imminent threat to life, and locating a suspect for certain serious offences — each subject to authorisation.
Article 5(1)(h) →
High-risk
Permitted, but carries the full Chapter III obligations: risk management, data governance, documentation, logging, human oversight, accuracy and cybersecurity.
- Retrospective biometric identification
Remote biometric identification systems are high-risk under point 1(a); only the real-time law-enforcement use is prohibited.
Annex III, 1(a) → - Public benefits eligibility and fraud
Point 5(a) covers evaluating eligibility for essential public assistance benefits and services, and granting, reducing, revoking or reclaiming them.
Annex III, 5(a) → - Visa, asylum and border risk assessment
Point 7 covers risk assessment, examination of asylum, visa and residence applications, and identification in the migration context.
Annex III, 7 → - Assisting judicial decisions
Point 8(a) covers systems assisting a judicial authority in researching and interpreting facts and law and applying the law to a concrete set of facts.
Ancillary administrative activity is outside the point; the target is the decision-making itself.
Annex III, 8(a) →
What gets misread here
Over-classification is the quieter failure: treating something as high-risk when the Act carves it out costs real money and never triggers a complaint, so nobody catches it.
“Facial recognition is banned, full stop.”
The prohibition is specific: real-time, remote, in publicly accessible spaces, for law enforcement — subject to listed exceptions. Retrospective identification is high-risk under Annex III point 1(a), not prohibited.
Article 5(1)(h) →“Any crime-risk tool is prohibited.”
The ban covers assessing the risk of a person committing an offence based solely on profiling or personality traits. It does not reach systems supporting a human assessment already grounded in objective, verifiable facts linked to criminal activity.
Article 5(1)(d) →
Dates that matter in this sector
- 2 Feb 2025Prohibited practices and AI literacy apply — Since 2 February 2025 the first eight prohibited AI practices in Article 5 have been unlawful across the EU, and every provider and deployer has owed an AI literacy duty under Article 4. Two further prohibitions were added later and apply from 2 December 2026.
- 2 Dec 2027Annex III high-risk obligations apply — Providers of Annex III high-risk systems (including AI used in employment, education, credit scoring, life and health insurance pricing, essential services, law enforcement and migration) must meet the full Chapter III requirements from 2 December 2027. (date changed by the Omnibus)
Dates are as amended by the Digital Omnibus. See the full timeline for what each one covers.
What the Commission has said
These guidelines are not binding, but they are the Commission’s own reading of the provisions above, and they are the first place a supervisory authority will look. Where they and this guide differ, follow them.
- Guidelines on prohibited AI practices ↗European Commission, February 2025 — interprets Article 5
What to do next
Screen your own systems with the scope finder, run a single system through the risk classifier, or work the obligations in order with the checklist.
This guide points you at the provisions that govern your sector. It is not legal advice, and whether a particular system meets a provision turns on facts about that system and on whether you hold it as provider or deployer — see Article 3 and Article 25.