Unlawful surveillance and biometric use
AI is used for biometric identification, emotion recognition, social scoring or tracking that the law forbids or restricts.
NIST AI 600-1 · Data PrivacyEU AI Act Art. 5
incidents (primary) · 1 more as secondary
0read for controls · 0 not yet
0fixes reported
0repeats after a fix
Incidents per month
No rise: 0 in Oct 2026, against an average of 0 over the 3 months before.
Developers
Developer not named in the sources.
Where the chain broke
| Part of the system | Incidents where the control was not effective or did not exist | Incidents where the control was effective | Incidents where sources don't mention the control | Incidents not yet checked for controls |
|---|---|---|---|---|
| L1 Model Model provider | ||||
| L2 Harness Agent framework vendor | ||||
| L3 Application Deployer | ||||
| L4 Infrastructure / target Organisation hit |
Controls for this risk, by layer
| Control | Incidents where the control was not effective or did not exist | Incidents where the control was effective | Incidents where sources don't mention the control | Most common reason it was not effective |
|---|---|---|---|---|
| A person confirms biometric matches L3 Application | ||||
| Data minimisation L3 Application | ||||
| Legal check against prohibited uses L3 Application | ||||
| Risk assessment per deployment L3 Application | ||||
| Bias testing L3 Application |
5 of 5 controls for this risk not yet recorded as effective.
Fixes reported and what followed
No remediation reported for incidents of this risk.
Incidents
EffectiveNot effectiveNot effective (bypassed)Did not existNot stated in sourcesNot yet checkedAttacker's ownOrder: model · harness · application · target
| Date | Incident | Risk | Where it failed | Controls mentioned in sources |
|---|---|---|---|---|
| No incidents match. | ||||
Also under this risk as a secondary risk: LR-2026-0559