{"slug":"eu-ai-act-art-26-10-post-remote-biometric-identification-authorisation","id":"AIPT-OBL-0037","permanent_url":"https://aipolicytracker.org/id/AIPT-OBL-0037","title":"Law-enforcement deployers must obtain authorisation for post-remote biometric identification and report annually","short_title":"Post remote biometric identification","category":"governance_accountability","summary":"A deployer using a high-risk post-remote biometric identification system in a criminal investigation must request authorisation from a judicial or independent administrative authority in advance or within 48 hours, unless the use is only the initial identification of a potential suspect on objective and verifiable facts. Use is limited to a targeted search; if authorisation is refused, use stops and the data is deleted. No adverse legal decision may rest solely on the output, each use is documented, and the deployer reports annually to the market surveillance and data protection authorities.\n","practical_action":"Build the authorisation request, 48-hour clock and deletion step into the investigation workflow and schedule the annual report.\n","is_binding":true,"applies_from":"2027-12-02","section":"Articles 16–27","source_reference":"Article 26(10)","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","review_status":"verified","confidence_level":"medium","last_verified_at":"2026-09-26","reviewed_by":null,"actors":["deployer","public_authority"],"sectors":["law_enforcement"],"use_cases":["biometrics","law_enforcement"],"applicability":[{"description":"Law enforcement authorities deploying post-remote biometric identification in criminal investigations; real-time use is governed by Article 5.","actors":["deployer","public_authority"],"conditions":null}],"evidence_examples":[{"title":"Authorisation request and decision record","description":null,"artifact_type":"record"},{"title":"Annual report on post-remote biometric identification use","description":null,"artifact_type":"report"}],"framework_mappings":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Annex A.9.2, A.9.4","note":"Processes for responsible use and intended use.","confidence_level":"low","is_original":true},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"GOVERN 1.1, MANAGE 1.3","note":"Legal requirements and documented use decisions.","confidence_level":"low","is_original":true}],"controls":[{"slug":"record-keeping-and-logging","title":"Automatic event logging and record retention","kind":"technical","relationship":"supports","note":"Per-use documentation and annual reporting data.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/record-keeping-and-logging"},{"slug":"ai-governance-policy-and-accountability","title":"AI governance policy and accountability structure","kind":"policy","relationship":"supports","note":"Authorisation workflow ownership.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/ai-governance-policy-and-accountability"},{"slug":"human-oversight-and-override","title":"Human oversight design and override procedure","kind":"process","relationship":"supports","note":"No adverse decision solely on the system's output.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/human-oversight-and-override"}],"url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-10-post-remote-biometric-identification-authorisation","policy":{"slug":"eu-ai-act","title":"Regulation (EU) 2024/1689 — Artificial Intelligence Act","status":"partially_applicable","jurisdiction":"eu","url":"https://aipolicytracker.org/policies/eu-ai-act"}}