EU AI Act and CCTV: what applies in the UK, and the 2027 dates

The EU AI Act is not UK law. It reaches a UK installer in two cases: the business is established in the EU, or the output of the system it supplies or runs is used in the EU (Article 2). For a site in Manchester, the rules that apply are UK GDPR, the Data Protection Act 2018, the ICO’s guidance and, for local authorities and the police, the Surveillance Camera Code.

Some UK integrators have EU clients, and the EU side has just changed. The delay to the AI Act’s high-risk rules is no longer a proposal. Regulation (EU) 2026/1744, the digital omnibus on AI, was published in the Official Journal on 24 July 2026 and has been in force since 27 July. It moves the high-risk obligations, biometric systems included, from 2 August 2026 to 2 December 2027.

The bans did not move. They have applied since 2 February 2025.

What applies in the UK

The ICO’s guidance on facial recognition technology (FRT) and surveillance sets the bar. You complete a data protection impact assessment, and treat it as a living document, before every deployment. You need to be able to demonstrate and document each case on its own merits. The guidance also walks through the conditions for processing in Article 9 of UK GDPR.

The ICO also says that in places such as shopping centres you still have to strongly justify that the use is lawful. In a July 2026 piece aimed at small businesses, it called facial recognition an area of growing interest and said there is “a high bar to be met” for lawful use in public places. The FRT guidance carries a notice that it is under review after the Data (Use and Access) Act, so check the live page before quoting it to a client.

For local authorities and the police there is the Surveillance Camera Code, in its updated form since 12 January 2022. It reflects the Court of Appeal’s Bridges v South Wales Police judgment on live facial recognition. The Biometrics and Surveillance Camera Commissioner’s role is to encourage compliance with it. The commissioner’s page lists a valedictory report from the Biometrics Commissioner on 19 May 2026, and it does not say what that means for the role, so I would not describe the oversight structure beyond that.

On the police side, the Home Office consulted from 4 December 2025 to 12 February 2026 on a new legal framework for law enforcement use of biometrics and facial recognition. Its response, on a page updated on 4 November 2026, says the government intends to introduce a new statutory framework. No bill text has been read for this piece.

Retention of recordings is a separate question, covered in our guide to CCTV footage retention. For when an impact assessment is required, see DPIAs for CCTV.

EU dates as of 12 November 2026

Date	What applies	Status today
2 February 2025	Article 5 bans and AI literacy measures (Article 4)	Applying
2 August 2025	Governance and penalties: up to EUR 35 million or 7% of worldwide turnover for the bans (for SMEs the lower of the two applies, Article 99(6))	Applying
2 August 2026	General date of the regulation. Anyone using emotion recognition or biometric categorisation must inform the people exposed (Article 50(3))	Applying, on our reading of the text
2 December 2026	Two new bans, on non-consensual intimate content and child sexual abuse material generated by AI	In 20 days, not about cameras
2 December 2027	High-risk obligations for Annex III systems, biometrics included	Delayed by the omnibus, already in force
2 August 2028	High-risk rules for products under Annex I	Delayed by the omnibus
2 August 2030	Deadline for high-risk systems already in service with public authorities	New Article 111

There are 385 days from today to 2 December 2027. The text gives the delay of technical standards, guidance and national authorities as the reason (recital 40). The dates moved for the Article 26 duties listed here, which the omnibus leaves unchanged; it does amend other articles (for example 4, 25 and 27).

What the EU bans

The ban closest to CCTV is Article 5(1)(h): “real-time” remote biometric identification in publicly accessible spaces for law enforcement. The definition of publicly accessible space includes privately owned places open to an undetermined number of people.

There are three exceptions: searching for victims of abduction, trafficking or sexual exploitation and for missing persons; a specific, substantial and imminent threat to life or a terrorist attack; locating a suspect of an Annex II offence punishable by at least four years. Prior authorisation by a judge or an independent authority is required. In an emergency use can start and the request follows within 24 hours.

Private operators fall outside it, according to the Commission’s guidelines, which are not binding. A supermarket using live facial recognition to spot known shoplifters, a stadium identifying banned fans, a school: none of them is law enforcement (point 426). The same guidelines add that those uses must still comply with data protection rules (point 428). One case does fall in. A shopping mall searching for shoplifters on the police’s behalf is acting for the authority, and the guidelines give it as an example of a prohibited use because shoplifting is not one of the three exceptions (point 386).

Two more bans matter for smart cameras:

• emotion recognition at work and in education, unless for medical or safety reasons (point (f)). The guidelines say supermarket cameras tracking employees’ emotions are prohibited. The same cameras used to spot suspicious customers are not, provided no employee is tracked and there are safeguards;
• biometric categorisation that infers race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation (point (g)).

Installing biometric-ready cameras is not banned as such. Some uses are, such as indiscriminate identification of people.

High-risk from 2027 and the user’s duties

Annex III, point 1, lists three families of biometric systems, so far as their use is allowed by EU or national law: remote biometric identification, biometric categorisation by sensitive attributes, and emotion recognition. Biometric verification, the one-to-one check that a person is who they say they are, is left out.

The text defines remote identification as done without the person’s active involvement. A door reader you walk up to has, on our reading, a different profile from a camera watching a crowd. How a given product is classified is for the manufacturer to state, so ask for it in writing before you quote.

The user of the system (the “deployer”, usually your client) has its own duties under Article 26:

• use the system according to the provider’s instructions, with suitable technical and organisational measures;
• give human oversight to people with competence, training and authority;
• keep the logs the system generates, where under its control, for at least six months, unless other EU or national data protection law says otherwise;
• inform workers and their representatives before using it in the workplace;
• use the provider’s information for the data protection impact assessment;
• if a public body or a private entity providing public services, carry out a fundamental rights impact assessment first (Article 27).

The six months apply to the system’s logs, not to video recordings. Employers should also read our guide to CCTV at work.

Integrators should read Article 25. You become the provider, with all the provider’s duties, if you put your name or trademark on a high-risk system already on the market, modify it substantially, or change its purpose so that it becomes high-risk. Third-party software with the integrator’s logo on it is the case to avoid.

Systems already in service

This is the point first-page guides skip. The new Article 111(2) says high-risk systems put into service before the date of application fall under the regulation only if, from that date, they undergo major changes in design. For systems meant for public authorities there is in any case a deadline of 2 August 2030.

Two cases. A company’s installation with high-risk biometric analytics, commissioned in October 2027, is outside the regulation on 2 December 2027. It comes in if the design is changed in a big way in 2029. The same installation, if it belongs to a council in an EU country, must be brought into line by 2 August 2030 regardless. The article does not explain what counts as a major change, and until guidance arrives it is worth writing into the contract who decides and who answers.

The rule is for high-risk systems. Article 111 leaves Article 5 untouched, so an old installation that carries out a banned practice stays banned.

Spain and Italy for UK firms working there

As of the last check (August 2026), Spain was still building its enforcement. The Council of Ministers approved a draft organic law on AI governance on 26 May 2026 and sent it to Congress. Under the official note, systems not covered by product law, biometrics among them, go mainly to the AI supervision agency AESIA, with the data protection agency AEPD and the judiciary’s council depending on the area. On 8 June 2026 the Congress bureau sent it to the economy and digital transformation committee, and an August dossier says no more. I could not check whether it has passed since.

Italy has legislated. Legislative Decree 160/2026, in force since 30 September 2026, covers AI in policing. Its Article 10 lets AI components be added to CCTV that the law already allows, but facial recognition is switched on only after the images are captured, with a gap that rules out real-time identification, and with a judge’s authorisation within 48 hours when a suspect is being searched for. Paragraph 13 is about site work: the installation and maintenance of those components can be carried out by the operators of venues and the organisers of events, and the systems are lent free of charge to the police. A separate moratorium keeps facial recognition in public or publicly accessible places suspended in Italy until a law is passed and in any case no later than 31 December 2027, private operators included.

What to do in practice

• Before proposing video analytics on faces or emotions, ask the manufacturer in writing for the AI Act classification of the product, the instructions for use and where the logs end up.
• Do not fit emotion recognition on employees in EU work. It has been banned since 2 February 2025, with fines of up to EUR 35 million or 7% of turnover.
• For a UK client who asks for facial recognition at the door, start from UK GDPR and the ICO’s guidance: impact assessment first, justification written down.
• For EU clients, put in the contract which system is supplied, who configures it and who answers if its purpose changes. Article 25 can shift provider duties onto the integrator.
• For public installations going live before 2 December 2027, note the date of commissioning. It is the evidence for the Article 111 regime.
• Keep the system’s logs apart from video recordings, which have different retention logic. Our note on CCTV signage requirements covers what the public is told.