AI and Biometric Data Transparency

1. What does the system do?

Visentry detects faces in camera footage, compares them with numerical templates derived from authorized reference faces, and may create events or alerts based on configured thresholds. Raw images and numerical templates are different data types, but both may constitute personal or biometric data in context.

2. Purpose and limits

The system supports Customer-defined uses such as organizational security, authorized-access verification, missing or wanted-person scenarios, and event review. It does not determine a person's intent, character, emotions, or legal guilt.

Results are not conclusive proof of identity. Thresholds, camera conditions, and reference-image quality affect performance.

3. Human oversight

• Every critical match or alert should be verified in context by authorized personnel.
• No legal, disciplinary, or similarly significant decision should be based solely on an automated result.
• Organizations should provide an accessible channel for appeal and human reconsideration.
• Incorrect outcomes should be logged, and thresholds, cameras, and data quality should be reviewed regularly.

4. EU AI Act classification and prohibited uses

Classification under the EU AI Act depends on the intended purpose and the Customer's actual deployment. Remote biometric identification may be high-risk under Annex III, while biometric verification used solely to confirm a person's claimed identity may be treated differently. Real-time remote biometric identification by law enforcement in publicly accessible spaces is permitted only within the Act's narrow exceptions and safeguards; Visentry is not offered for prohibited uses.

Where the high-risk classification applies, provider and deployer duties may include risk management, data governance, technical documentation, logging, human oversight, accuracy/robustness/cybersecurity, conformity, and post-market monitoring. A FRIA is not automatic for every private company; it is required for the deployer and use categories specified in Article 27. A GDPR DPIA or equivalent assessment may still be separately required.

5. Organization responsibilities

• Determine the legal basis and AI Act role/classification before use; complete a DPIA and FRIA where required.
• Provide clear, layered notices in camera areas and obtain separate, valid explicit consent where necessary.
• Keep reference lists current, accurate, purpose-limited, and access-controlled.
• Apply enhanced safeguards and consider less intrusive alternatives for vulnerable groups, children, publicly accessible spaces, and large-scale monitoring.
• For high-risk remote biometric identification, implement applicable human-confirmation requirements, competent-personnel training, and event records.

6. Performance, accuracy, and fairness

Performance may vary with the environment, camera quality, threshold, and population group. No single general accuracy percentage is promised for every deployment. The test method, dataset scope, threshold, false-accept and false-reject rates, and known limitations for a release and intended purpose must be supplied in validated product documentation.

Before a high-risk use is activated, applicable accuracy, robustness, cybersecurity, and—where relevant—group performance metrics are declared in the instructions for use. Unvalidated bias or accuracy figures are not published. The Customer must conduct acceptance testing under real conditions, monitor errors and adverse effects, and change the threshold, increase human review, or stop use where impact becomes unacceptable.

7. Impact-assessment support and records

Within the contract scope, Visentry provides reasonable DPIA/FRIA support using available information about intended purpose, data flow, capabilities, limitations, human oversight, configurable thresholds, and existing test results. The Customer-specific context, affected groups, legal basis, and final deployment decision remain for the deployer/controller to complete.

If the technical file, release records, performance report, or conformity work required for a high-risk use has not been completed, this page alone is not an EU AI Act declaration of conformity or a substitute for CE marking.