By Antonio Tejeda Encinas, President of Euro-American Committee of Digital Law – CEA Digital Law and CEO of META Channel Corp
The regulation of artificial intelligence in the European Union has been presented as a pioneering effort to ensure that technological development respects fundamental rights. However, an analysis of Article 5 of the EU AI Act raises a legitimate concern: are we really looking at a robust protective framework, or at a regulatory architecture that leaves the door too wide open to dangerous interpretations?
1. The promise of a ban that dissolves into exceptions
At first glance, Article 5 lays down what appears to be an emphatic ban: the use of real-time remote biometric identification systems in public spaces is prohibited. However, this ban quickly turns into an ambiguous statement once the permitted exceptions are examined. Their use is allowed in cases of:
* Searching for missing persons: a legitimate justification, but one with potential for abuse.
* Prevention of serious crime: a criterion that is too broad unless the offences falling into this category are precisely defined.
* Combating terrorism: a recurring argument that has been used in the past to justify invasive surveillance measures.
The essential problem lies in the elasticity of the concept of “strict necessity”, a legally indeterminate term that allows Member States to interpret these exceptions according to their own interests.
When is a threat truly imminent? What does “substantial risk” mean?
Without strict criteria and independent oversight mechanisms, these provisions could end up legitimising the widespread use of mass surveillance technologies under the guise of public safety.
2. Regulatory ambiguity: a crack in legal certainty
The language of the Regulation leaves wide room for discretion. Expressions such as “imminent threat” or “substantial risk” are not clearly defined, which creates uncertainty both for citizens and for the very authorities responsible for applying it. At a time when artificial intelligence is increasingly built into government and police decision-making, a lack of clarity can lead to dangerous arbitrariness.
The possible consequences of this lack of precision are worrying:
* Expansion of mass surveillance: without clear limits, States could justify the use of these facial recognition tools in much broader contexts than anticipated.
* Legal uncertainty: without uniform criteria, each EU country could apply the rules differently, eroding the consistent protection that EU legislation should guarantee.
* Erosion of the right to privacy: the lack of control over the use of biometric identification can lead to ubiquitous surveillance, normalising a society in which every citizen is potentially watched at all times.
3. The role of large corporations: regulation or regulatory capture?
It is important to examine who has been influencing the shape of the AI Act. Large technology companies such as Amazon, Google and OpenAI have voiced support for the Regulation, not because it limits their power but because it allows them to operate within a regulatory framework with ample room for manoeuvre. These companies have advocated the “responsible use” of AI, but in practice they have developed and promoted mass surveillance tools that could benefit from regulatory ambiguities.
In this sense, the Regulation risks becoming an instrument of regulatory capture, in which the rules, rather than limiting the power of these companies, end up legitimising their influence by establishing a legal framework that enables them to expand without real constraints.
4. A real solution or a mere regulatory sham?
For the AI Act to deliver on its promise to protect citizens, substantial improvements must be made to the oversight and enforcement of its provisions. Some essential measures would be:
1. Precise definition of key concepts: terms such as “strict necessity”, “imminent threat” and “substantial risk” must be concrete and leave no room for loose interpretations.
2. Independent scrutiny of exceptions: any use of biometric identification in public spaces must be subject to judicial review or to an independent body with genuine sanctioning powers.
3. Full transparency in implementation: law enforcement and government agencies must be accountable for when, how and why they use these tools.
4. Ensuring that regulation does not become a gateway to mass surveillance: without strict limits, the rules could normalise a state of hyper-surveillance at odds with European democratic principles.
WE CONCLUDE by noting that the regulation needs urgent adjustment
Article 5 of the EU AI Act reflects a necessary regulatory intent, but it falls short in key respects. The exceptions it allows are too broad, the terms used are imprecise and oversight of its application is insufficient. If the European Union genuinely wants to guarantee the protection of fundamental rights in the age of artificial intelligence, it must correct these flaws before the rule becomes yet another tool of mass control instead of a shield for citizens.
