# Law-enforcement deployers must obtain authorisation for post-remote biometric identification and report annually

- **Record type**: Obligation
- **Instrument**: Regulation (EU) 2024/1689 — Artificial Intelligence Act
- **Jurisdiction**: European Union
- **Category**: governance_accountability
- **Binding**: Yes
- **Applies from**: 2026-08-02
- **Provision**: Article 26(10)

## What the duty requires

A deployer using a high-risk post-remote biometric identification system in a criminal investigation must request authorisation from a judicial or independent administrative authority in advance or within 48 hours, unless the use is only the initial identification of a potential suspect on objective and verifiable facts. Use is limited to a targeted search; if authorisation is refused, use stops and the data is deleted. No adverse legal decision may rest solely on the output, each use is documented, and the deployer reports annually to the market surveillance and data protection authorities.

## What an organisation does about it

Build the authorisation request, 48-hour clock and deletion step into the investigation workflow and schedule the annual report.

## Controls that meet this duty

- AI governance policy and accountability structure (supports): https://aipolicytracker.org/controls/ai-governance-policy-and-accountability
- Human oversight design and override procedure (supports): https://aipolicytracker.org/controls/human-oversight-and-override
- Automatic event logging and record retention (supports): https://aipolicytracker.org/controls/record-keeping-and-logging

## Parent instrument

- Regulation (EU) 2024/1689 — Artificial Intelligence Act
  - Record: https://aipolicytracker.org/policies/eu-ai-act
  - Context file: https://aipolicytracker.org/policies/eu-ai-act.md

## Provenance

- **Record page**: https://aipolicytracker.org/obligations/eu-ai-act-art-26-10-post-remote-biometric-identification-authorisation
- **Official source**: https://eur-lex.europa.eu/eli/reg/2024/1689/oj
- **Provision**: Article 26(10)
- **Review status**: pending review
- **Confidence**: medium
- **Facts last confirmed**: never confirmed against the official source
- **Retrieved**: 2026-09-24
- **Licence**: https://creativecommons.org/licenses/by/4.0/

> This record is a structured summary with a link to the official text. It is not legal advice. Open the official source before relying on any date or duty. How current each record type must be is published at https://aipolicytracker.org/verification; what a record must carry at all is published at https://aipolicytracker.org/coverage.