Article 5 of the EU AI Act: genuine regulation or a regulatory mirage?

The regulation of artificial intelligence in the European Union has been presented as a pioneering effort to ensure that technological development respects fundamental rights. Yet a closer look at Article 5 of the EU Artificial Intelligence Act (Regulation (EU) 2024/1689) raises a legitimate concern: are we really looking at a robust protective framework, or at a regulatory architecture whose doors are left too wide open to dangerous interpretations?

At first sight, Article 5 lays down what appears to be an emphatic ban: the use of real-time remote biometric identification systems in public spaces is prohibited. Once the permitted exceptions are examined, however, this prohibition quickly turns into an ambiguous statement. Use of these systems is allowed in cases involving:

* The search for missing persons: a legitimate justification, but one that carries potential for abuse.

* The prevention of serious crime: an overly broad criterion unless the offences falling into this category are precisely defined.

* The fight against terrorism: a familiar argument that has been used in the past to justify invasive surveillance measures.

The core problem lies in the elasticity of the concept of ‘strict necessity’, a legally indeterminate term that allows Member States to interpret these exceptions to suit their own interests.

Without strict criteria and independent oversight mechanisms, these provisions could end up legitimising the widespread use of mass surveillance technologies on the pretext of public security.

The wording of the regulation leaves wide room for discretion. Expressions such as ‘imminent threat’ or ‘substantial risk’ lack a clear definition, creating uncertainty both for citizens and for the very authorities responsible for applying them. At a time when artificial intelligence is increasingly built into government and police decision-making, a lack of clarity can lead to dangerous arbitrariness.

The possible consequences of this lack of precision are worrying:

* Expansion of mass surveillance: without clear limits, states could justify using these facial recognition tools in far broader contexts than intended.

* Legal uncertainty: without uniform criteria, each EU country could apply the rules differently, eroding the consistent protection that EU law ought to guarantee.

* Erosion of the right to privacy: a lack of control over the use of biometric identification could lead to ubiquitous surveillance, normalising a society in which every citizen is potentially being watched at all times.

It is important to examine who has been influencing the shape of the AI Act. Big tech companies such as Amazon, Google and OpenAI have voiced their support for the legislation, not because it limits their power, but because it allows them to operate within a regulatory framework that gives them ample room for manoeuvre. These companies have championed the ‘responsible use’ of AI, yet in practice they have developed and promoted mass surveillance tools that could benefit from the regulatory ambiguities.

In this sense, the regulation risks becoming an instrument of regulatory capture, in which the law, instead of curbing these companies’ power, ends up legitimising their influence by establishing a legal framework that facilitates their expansion without any real restrictions.

For the AI Act to deliver on its promise to protect citizens, substantial improvements must be made to the oversight and enforcement of its provisions. Some essential measures would be:

1. Precise definition of key concepts: terms such as ‘strict necessity’, ‘imminent threat’ and ‘substantial risk’ must be specific and leave no room for loose interpretation.

2. Independent oversight of the exceptions: any use of biometric identification in public spaces must be subject to judicial review or to an independent body with real powers to impose sanctions.

3. Full transparency in implementation: law enforcement and government bodies must be held accountable for when, how and why they use these tools.

4. A guarantee that regulation does not become a gateway to mass surveillance: without strict limits, the legislation could normalise a state of hyper-surveillance that runs counter to European democratic principles.

Article 5 of the EU AI Act reflects a necessary regulatory intention, but its execution falls short in key respects. The exceptions it allows are too broad, the terms it uses are imprecise and oversight of its application is insufficient. If the European Union genuinely wants to guarantee the protection of fundamental rights in the age of artificial intelligence, it must correct these flaws before the law becomes yet another tool of mass control rather than a shield for citizens.