Art.5(1)(h) — Prohibited: real-time remote biometric identification in publicly accessible spaces for law enforcement — unless strictly necessary for one of the narrow listed objectives, and subject to the Art.5(2)-(4) authorisation regime

Official article title: Prohibited AI practices. Source: Regulation (EU) 2024/1689

Examine this duty against your system’s use and your operator role. Keep supporting records, unresolved questions and a named reviewer’s determination together.

See how E-ARI connects evidence and decision review to governance reports.

Who it binds

Every operator — provider, deployer, importer and distributor alike.

Supporting record to examine

a written policy. A record supports review; its presence does not establish that this duty is satisfied. Documentation cannot make a prohibited practice permissible.

Usually owned by

Legal

Severity

Critical — a gap here is the kind regulators act on first, and in the prohibitions it is not curable by documentation.

Does it apply to you?

Applicability under the Act is risk tier × operator role, not tier alone. This grid is computed by running the same function the assessment uses, so it cannot drift from what the product would tell you.

• limited riskprovider, deployer, importer, distributor
• high riskprovider, deployer, importer, distributor

Read against Regulation (EU) 2024/1689 as amended, consolidated text 02024R1689-20260727 (consolidation 001.001, incorporating Regulation (EU) 2026/1744). What we work from