For a business the question is rarely whether the technology works. It is which of two very different jobs you are buying, what happens when it is wrong, and whether the law lets you do it at all.
How does facial recognition actually work?
Every system runs the same short pipeline. A computer vision model detects the face, aligns it so the eyes and mouth sit in standard positions, and a second model converts it into a faceprint: a vector of numbers, an embedding, where similar faces land close together. The system never compares photos. It compares those vectors and returns a similarity score.
The match is a threshold you set, not a fact the model reports. Raise the threshold and the system wrongly accepts fewer strangers but turns away more genuine users. Lower it and the reverse happens. That trade-off is a business decision, and it should be written down before go-live.
1:1 verification vs 1:N identification: what’s the difference?
| 1:1 verification | 1:N identification | |
|---|---|---|
| Question it answers | Is this the person they claim to be? | Who is this person? |
| Compared against | One enrolled template | A gallery of many people |
| Typical use | Phone unlock, onboarding, payment approval | Watchlists, access control, investigations |
| Person’s role | Usually present and consenting | Often unaware |
| Risk profile | Lower, the user starts it | Higher, error and privacy risk grow with the gallery |
Verification and identification are different products with different risk, even when one vendor sells both. Most mid-sized companies need only verification, for example matching a selfie to an ID document during customer onboarding.
Where does the EU restrict facial recognition?
The EU AI Act bans building facial recognition databases through untargeted scraping of images from the internet or CCTV, in Article 5(1)(e), and bans real-time remote biometric identification in publicly accessible spaces for law enforcement except in narrow cases, in Article 5(1)(h); those prohibitions have applied since 2 February 2025 (Regulation (EU) 2024/1689, read 12 November 2026). Remote biometric identification outside those bans is listed as high-risk in Annex III. A face template used to identify someone is special category data under GDPR Article 9, so you need a specific legal ground, usually explicit consent (Regulation (EU) 2016/679, read 12 November 2026). Treat it as a data privacy project first and an AI project second.
What should a buyer ask before deploying it?
Ask four things. Is this 1:1 or 1:N? What false match and false non-match rates did the vendor measure, on which images, and how do they differ across age, sex and skin tone, the AI bias question? Who reviews a match before anyone acts on it? And where are templates stored, for how long, and can a person have theirs deleted? A vendor that cannot answer the error-rate question on your own camera setup has not earned a pilot. Run the pilot on your own images, put a person behind every decision that affects someone’s access or money, and compare it with alternatives such as voice biometrics or a plain document check.