Forensic Facial Recognition Risk Management Workflow for Law Enforcement under the European AI Act

The use of facial recognition technology is becoming a pervasive method of gaining key biometric information from people, often without their knowledge. One of the many issues with the collection of this sensitive data is regulating what use can be made of it. Building on that issue in the European context, I was a co-author of an article published in the European Journal of Criminal Law Policy and Research in April 2026 on managing the risks of forensic facial recognition technology under the European Artificial Intelligence Act. The article is entitled Forensic Facial Recognition Risk Management Workflow for Law Enforcement under the European AI Act. For those people who are interested in this topic and have access to the journal, it can be found at https://doi.org/10.1007/s10610-026-09667-y. Below is the abstract of the article.

Law enforcement agencies (LEAs) routinely leverage the capabilities of facial recognition (FR) technology to identify individuals of interest from various image or video sources. Despite its potential, FR technology presents significant challenges and risks that must be carefully considered. These include the possibility of false positive or negative identifications, variations in image quality and resolution, the presence of occlusions or alterations, and the potential for bias or discrimination in the results. Furthermore, the EU AI Act classifies FR technology as a high-risk AI system, subjecting it to stringent requirements and obligations for development and deployment. To effectively manage FR technologies for forensic purposes, LEAs must adopt a risk-based, human-centric and human-in-the-loop approach that balances its potential and limitations within a defined legal framework. This risk-based approach would be a key element in the governance of this technological innovation. This paper proposes a workflow for LEAs utilizing FR technology in forensic applications that includes risk management, which consists of three main stages: 1) forensic FR method preparation, 2) forensic FR method validation, and 3) case-specific application and interpretation. For this workflow, we evaluate the applicability and suitability of different AI model types for FR—ranging from closed boxes to glass boxes, and the in-between middle ground of translucent boxes—combined with likelihood ratios (LRs) used in forensic decision-making processes to obtain trustworthy results. Additionally, recommendations and best practices are provided to assist LEAs in ensuring the validity, reliability, and admissibility of FR technology evidence while adhering to ethical and legal principles.