What is biometric categorisation?
Biometric categorisation means assigning natural persons to specific categories on the basis of their biometric data, such as faces, voices, gait or fingerprints, as defined in Article 3(40) of the EU AI Act. The red line: systems that categorise people to deduce or infer race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation are a prohibited practice under Article 5, applicable since 2 February 2025, with a narrow carve-out for the lawful labelling of datasets in law enforcement contexts.
Below the red line
- Other sensitive-adjacent attributes, such as age, gender or health indicators, generally make the system high-risk under Annex III;
- Notification: persons exposed to categorisation must be informed under Article 50;
- Ancillary filtering: detecting a face merely to apply a photo filter is not categorisation in this sense.
The legal dimension
The prohibition attaches to the inference, not to the developer’s stated intent. Ad-tech, retail analytics and camera-based products flirt with this definition more often than teams realise: an “audience insights” feature inferring demographics from faces sits directly on the boundary, and moving from age or gender to, say, likely political leaning crosses from high-risk into prohibited territory. Neighbouring regimes bite too: an emotion recognition system in workplaces or education, and social scoring, sit in the same Article 5 cluster.
Turkish context
Türkiye has no AI-specific statute in force, but the same biometric inputs trigger KVKK’s special-category regime: biometric data may only be processed under the law’s narrow conditions, and that analysis applies whether or not the AI Act reaches the product. A Turkish retailer running camera analytics, or a startup shipping a face-based feature, should therefore run two tests: KVKK for the data, and the AI Act’s Article 5 and Annex III ladder where EU users are in scope.
Do: document exactly which attributes your system infers from biometric data, and re-check whenever a model update adds new outputs. Don’t: assume aggregate or “anonymous” audience statistics take you outside the regime; the inference itself is what is regulated.
Sources. Regulation (EU) 2024/1689 (AI Act).