Finding 3 of 18

Demographic estimation at an EU site

Art. 5 of the EU AI Act lists biometric categorisation inferring sensitive attributes, and GDPR Art. 9 lists the special categories. Estimating age alone is not one of the categories Art. 9 lists; a feature that infers any of them is a different matter.

When it is raised: Raised on a camera at an EU site whose analytics read as demographic estimation.
The question: Which characteristics does this feature estimate, and does any of them fall within the categories Art. 9 lists?
For: your lawyer
The column that settles it: the analytics or coverage column
On the row: a numbered delta and the words "demographic estimation" in small capitals; an outlined delta where it rests on a blank column

Clauses by regime

EU AI Act

EU AI Act Art. 5The practices listed in Article 5

Prohibited AI practices. Prohibits a defined set of AI practices, including subliminal/manipulative techniques causing significant harm, exploitation of vulnerabilities, social scoring by public authorities, predictive policing based solely on profiling, untargeted scraping of facial images, emotion recognition in workplace/education, biometric categorisation inferring sensitive attributes, and real-time remote biometric identification (RBI) in publicly accessible spaces by law enforcement (subject to narrow exceptions).

What a reviewer asks to see: Pre-deployment screening against the Art.5 prohibition list; Documented assessment that the system does not fall under a prohibited category

Where camera lists usually fall short: Deploying an Art.5-prohibited practice; Treating exceptions as routine basis

Source: EU AI Act, read 29 Sep 2026

EU AI Act Art. 50Transparency obligations for providers and deployers of certain AI systems

Transparency obligations for providers and deployers of certain AI systems. Providers and deployers of certain AI systems (incl those interacting with natural persons, emotion recognition, biometric categorisation, generative AI producing synthetic content, deepfakes, and AI-generated/manipulated text for public-interest information) shall inform users that they are interacting with AI, label synthetic content in a machine-readable format, and disclose deepfakes and AI-generated public-interest text (subject to free-expression and artistic exceptions).

What a reviewer asks to see: User-facing AI-interaction notification; Machine-readable labelling of synthetic content; Deepfake/AI-text disclosure

Where camera lists usually fall short: No disclosure that the user is interacting with AI; Synthetic content not machine-readably labelled

Source: EU AI Act, read 29 Sep 2026

GDPR (the EU General Data Protection Regulation)

GDPR Art. 9Processing of special categories of personal data

Processing of special categories of personal data. Do not process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, nor genetic data, biometric data processed to uniquely identify a person, data concerning health, or data concerning a person's sex life or sexual orientation, unless one of the Article 9(2) conditions applies: explicit consent, employment and social security law obligations, vital interests where the data subject cannot consent, the legitimate activities of a not-for-profit body, data manifestly made public by the data subject, legal claims or courts acting judicially, substantial public interest under Union or Member State law, preventive or occupational medicine and health or social care under an obligation of professional secrecy, public health, or archiving, research and statistics under Article 89(1). The condition applies in addition to an Article 6 lawful basis, never in place of it.

What a reviewer asks to see: An inventory identifying where special category data is held, including where it is inferred rather than collected; The Article 9(2) condition recorded per activity alongside its separate Article 6 basis; The Union or Member State law relied on where the condition requires one, cited to the provision; Explicit consent records showing the consent was explicit and specific to the special category processing; Professional secrecy or equivalent confidentiality obligations evidenced for staff handling health data under point (h)

Where camera lists usually fall short: Special category data inferred from behaviour, purchases or free text and never recognised as in scope; An Article 6 basis recorded with no Article 9 condition, or the two conflated into a single entry; Explicit consent asserted from the same tick box used for ordinary consent; Substantial public interest claimed without identifying the Union or Member State law that authorises it

Source: GDPR (the EU General Data Protection Regulation), read 29 Sep 2026

See the specimen list run Map your own list