Events · AI Act

Events — AI Act: the question of biometric access control

To streamline access, some organisers are considering facial recognition. This use case involves biometric data, heavily regulated under the AI Act and sensitive within the meaning of GDPR. This guide clarifies the classification and available alternatives.

DPO / CISO team — Data Comply One Updated on 15 June 2026

In brief

  • Regulation: AI Act.
  • Organisers deploying biometric devices or smart cameras are deployers; software vendors are providers.
  • Qualify the devices.
  • Prohibiting unauthorised biometrics.
  • Ensure transparency.
  • Up to €35M or 7% for prohibited practices, in addition to GDPR risk on biometric data.

Regulatory deadlines

The key dates of this regulation.

August 2024

Entry into force

In force

February 2025

Ban on prohibited practices

In force

August 2025

General-purpose AI models (GPAI) & governance

In force

August 2026

High-risk system obligations (Annex III)

In force

August 2027

High-risk embedded in products (Annex I)

Upcoming

What does the AI Act cover?

The AI Act places strong restrictions on real-time remote biometric identification in publicly accessible spaces and regulates biometric categorisation. Facial recognition for access control falls within this highly sensitive scope; biometric data is also sensitive data under the GDPR.

Crowd-analysis cameras call for the same level of caution.

Is the 'Events' sector affected?

Organisers deploying biometric devices or smart cameras are deployers; publishers are providers. Maximum caution is required.

Standard access systems (ticketing, QR codes) do not fall under this regime.

Detailed obligations

Qualifying devices

Identify any use of biometrics or smart cameras.

Prohibit unauthorised biometrics.

Ruling out facial recognition for access control outside a strict framework.

Ensure transparency

Inform about the use of AI and video.

Articulate with GDPR

Treat biometric data as sensitive data (exception, DPIA).

Sanctions & risks

Up to €35M or 7% for prohibited practices, in addition to GDPR risk relating to biometric data. A poorly framed biometric system significantly exposes the organiser.

Application timeline

  • 1Entry into force. 1 August 2024.
  • 2Prohibitions. Biometric restrictions since February 2025.

Common mistakes in the sector

  • 1Hazardous biometrics. Deploying access facial recognition without a framework.
  • 2Non-qualified cameras. Using smart cameras without analysis.
  • 3Absent transparency. Failing to disclose AI usage.
  • 4GDPR ignored. Overlook the sensitivity of biometric data.

Practical case

An event organiser was considering facial recognition to speed up access. Given the AI Act restrictions and GDPR sensitivity, they opted for named QR codes and conventional access control, ruling out any biometric processing.

Compliance roadmap

  1. 1

    Inventory. Identify the planned systems.

  2. 2

    Qualify. Identifying biometric use cases.

  3. 3

    Exclude. Prohibiting unauthorised biometrics.

  4. 4

    Alternatives. Prioritise ticketing and QR codes.

  5. 5

    Articulate. Handle biometrics under GDPR.

Frequently asked questions

It is heavily regulated, or even prohibited depending on the context; best avoided as a general rule.

Back to the Events guideEvents & GDPR

Take action on AI Act

Free assessment or a chat with an expert dedicated to events.

Start my free assessment Talk to an expert

They already trust us

See how organisations in the events sector secured their compliance with DCO.

See testimonials