Biometric AI is the most heavily regulated category in Regulation (EU) 2024/1689. Three overlapping regimes apply: Article 5 prohibits four biometric practices outright — untargeted facial-image scraping (5(1)(e)), workplace/education emotion recognition (5(1)(f)), biometric categorisation by sensitive attributes (5(1)(g)) and real-time remote biometric identification by law enforcement (5(1)(h)) with narrow exceptions. Annex III point 1 classifies three biometric categories as high-risk: remote biometric identification (excluding verification), biometric categorisation by sensitive or protected attributes, and emotion recognition. Article 26(10) sets ex-ante authorisation rules for post-remote biometric identification by law enforcement. The penalty for Art. 5 breach is up to €35M or 7% of turnover; for high-risk biometric, up to €15M or 3%.
€249 one-time payment · 12 PDF documents in ZIP · 45 minutes · 100% in your browser
Biometric AI moves between regimes depending on what it does, where it does it, and who is using it. The same hardware can be prohibited in one context, high-risk in another and out of scope in a third.
Annex III 1(a) excludes "AI systems intended to be used for biometric verification the sole purpose of which is to confirm that a specific natural person is the person he or she claims to be". Face-unlock, fingerprint-unlock and similar one-to-one verification — confirming identity rather than identifying from a database — are out of Annex III 1(a). The exclusion does not extend to biometric categorisation (1(b)) or emotion recognition (1(c)).
Art. 5(1)(e) prohibits the placing on the market, the putting into service or the use of AI systems that create or expand facial-recognition databases through untargeted scraping of facial images from the internet or CCTV footage. The Art. 5(1)(e) prohibition is unconditional — there is no law-enforcement carve-out. The carve-outs in Art. 5(1)(h) (real-time RBI) and the categorisation language in 5(1)(g) do not extend to the scraping prohibition.
GDPR Art. 9 covers processing of biometric data as a special category of personal data and requires a lawful basis under Art. 9(2). The AI Act adds independent obligations: Art. 5 prohibitions for the four practices, Annex III 1 high-risk classification triggering Art. 11 + Annex IV documentation, Art. 27 FRIA where applicable, Art. 26(10) authorisation for post-RBI by law enforcement. Both regulations apply in parallel under Art. 2(7) of the AI Act.
Answer these four questions to determine your obligations.
12 PDF documents generated from your inputs. Each cites the article of Regulation (EU) 2024/1689 it fulfils.
Identifies whether your system is prohibited (Art. 5), high-risk (Art. 6 + Annex III) or subject to transparency obligations (Art. 50).
The 9 blocks of Annex IV in full: system description, training data, validation, performance metrics, risk management, human oversight. Art. 11 + Annex IV.
Signable document conforming to Art. 47 and Annex V.
Key application dates: 2 Feb 2025, 2 Aug 2025, 2 Aug 2026, 2 Aug 2027. Art. 113.
Executive summary of compliance status for authorities or commercial buyers. Art. 43 procedure.
QMS structure covering the 13 aspects required by Art. 17.
Document for the entity deploying your system, conforming to Art. 13.
Verifiable evidence list, cross-referenced to every Annex IV block.
Notification protocol conforming to Art. 73 (15 days general / 10 days death / 2 days widespread).
Training plan conforming to Art. 4, in force since 2 February 2025.
Plan structure required by Art. 72 and integrated into the technical documentation under Annex IV(9).
Template under Art. 27 for public bodies, private entities providing public services, and Annex III 5(b)(c) deployers.
See before you buy — Download a sample dossier (PDF, fictional company) — Real structure, real articles, real format. Fictional data.
Generated from your inputs, in your browser. No data leaves your machine.
12 documents. 45 minutes. €249. The documentation your system needs before being placed on the market.
If your system falls under Art. 43(1) (Annex III point 1 biometrics with notified-body route, or Annex I products), you will need third-party conformity assessment. That is a separate process. AICheck does not replace it.
We do not sell audits. We do not sell consultancy. We sell the tool that structures your documentation under Annex IV.
Article 99 of Regulation (EU) 2024/1689. Chapter XII (Penalties) applies from 2 August 2025.
Art. 99(3). Up to €35 million or 7% of total worldwide annual turnover, whichever is higher. For SMEs and start-ups: whichever is lower (Art. 99(6)).
Art. 99(4). Includes failure to draw up technical documentation under Art. 11 + Annex IV. Covers obligations of providers (Art. 16), deployers (Art. 26), authorised representatives (Art. 22), importers (Art. 23), distributors (Art. 24), notified bodies (Art. 31, 33, 34) and transparency under Art. 50.
Art. 99(5). Applies when information provided to notified bodies or national competent authorities is wrong or misleading.
If you operate multiple AI systems and need to document them all under Annex IV, contact us for volume pricing at hello@solidwaretools.com.
Request volume pricingAICheck produces a document structured under Article 11 and Annex IV of Regulation (EU) 2024/1689 from the information you provide. The accuracy, truthfulness and completeness of that information is your responsibility as provider of the AI system.
We guarantee that the document structure follows Article 11 and Annex IV of Regulation (EU) 2024/1689 and that the legal references cited are correct as of the last verification date. We do not guarantee that a specific document will be accepted by a market surveillance authority in a given case, nor by a commercial buyer in a procurement process.
AICheck is not legal advice. For specific situations, consult a lawyer or specialised regulatory consultancy.
Twelve documents. Annex IV fully structured. Regulation (EU) 2024/1689. Your data does not leave your machine. The ZIP you download is yours to keep.