By use case · Biometrics and facial recognition
Biometric AI is where prohibitions live. Real-time remote identification in public spaces, biometric categorisation by sensitive traits and emotion recognition in workplaces and schools are banned or tightly conditioned in several jurisdictions; where a biometric use is allowed it is almost always high-risk, with the full set of provider and deployer duties on top of data-protection rules for biometric data.
The prohibited-use gate is a control of its own below: an inventory question answered before any risk assessment, because a prohibited use has no compliant configuration.
Accuracy across demographic groups, human verification of matches, logging and a data-protection impact assessment are the duties that follow. The controls are listed with the incident history of the risk areas they address.
Sorted by how many of the duties on this page each control satisfies, so the ones worth building first are at the top. A control page lists every other duty it serves, in every jurisdiction.
| Control | Satisfies | Supports | Owner · frequency |
|---|---|---|---|
| Privacy and data-protection controls for AI Process | 4 | 2 | Data protection officer · once per ai system |
| Automatic event logging and record retention Technical measure | 2 | 3 | Engineering lead · continuous |
| Prohibited and unacceptable-use screening gate Process | 2 | 1 | AI governance lead · once per ai system |
| Accuracy, robustness, fairness and security testing Technical measure | 2 | 0 | Quality or testing lead · at launch and on material change |
| AI governance policy and accountability structure Policy | 1 | 2 | Executive sponsor for AI · annual |
| Conformity assessment, declaration and registration Process | 1 | 1 | Regulatory compliance lead · once per ai system |
| Human oversight design and override procedure Process | 1 | 1 | AI system owner · once per ai system |
| Data governance and dataset documentation Process | 1 | 0 | Data governance lead · once per ai system |
| AI interaction and use disclosure notices Process | 1 | 0 | Product owner · at launch and on material change |
| Contractual allocation of AI duties across the supply chain Contractual term | 1 | 0 | Legal counsel · once per ai system |
| AI risk assessment and lifecycle risk register Process | 1 | 0 | AI system owner · once per ai system |
| Public-sector AI use-case register and algorithmic transparency Process | 1 | 0 | Agency AI officer · annual |
| AI incident management and regulatory reporting Process | 1 | 0 | Incident coordinator · continuous |
| AI impact and fundamental-rights impact assessment Process | 0 | 3 | AI system owner · once per ai system |
| Adversarial and red-team testing for generative AI Technical measure | 0 | 2 | AI security or safety lead · at launch and on material change |
| Post-deployment monitoring and drift detection Technical measure | 0 | 2 | AI system owner · continuous |
| Training-data provenance and copyright register Process | 0 | 2 | Model development lead · at launch and on material change |
| Technical documentation, model cards and instructions for use Process | 0 | 2 | Product or model owner · at launch and on material change |
| Quality management system for AI development and supply Policy | 0 | 2 | Quality lead · annual |
| AI system inventory and classification Process | 0 | 2 | AI governance lead · continuous |
| AI literacy and role-based training programme Training programme | 0 | 1 | Learning and development lead · annual |
| Vendor and third-party AI due diligence Process | 0 | 1 | Procurement or vendor risk lead · once per ai system |
Every published duty whose record names this audience. It is the recorded set, not every rule in the world; a jurisdiction missing here may simply not be mapped yet (open gaps).
Informational only, not legal advice. Verify every claim against the linked official sources and consult qualified counsel before acting.
