The EU AI Act became enforceable this month. If your organisation runs AI-powered video surveillance — face recognition, automated vehicle logging, intrusion alerts — you are now operating a high-risk AI system under binding EU law. Most deployments I’ve seen are not ready. Not because the technology is wrong, but because the governance layer was never built.
This article is not a general compliance overview. It’s a specific account of what auditors will actually demand, which parts of a surveillance stack produce that evidence automatically, and where the gaps tend to be.
Listen to the podcast!
What “High-Risk AI” Means for a Surveillance Team
The Act classifies AI systems used in access control, identity verification, and monitoring of individuals as high-risk. That covers face recognition, ANPR, and automated zone-breach alerting — the core detection engines on most enterprise surveillance platforms. High-risk classification triggers three non-negotiable obligations: activity logging, documented risk assessments, and human oversight mechanisms. These aren’t advisory. They’re the framework regulators will use when something goes wrong.
The numbers behind this matter. IBM’s 2025 research shows that 97% of AI-related breaches occur in organisations without proper access controls — which means the governance gap is already costing money before an auditor walks in the door. The Act simply adds a legal price tag to what was already an operational risk.
The Three Audit Demands Most Deployments Fail
1. Continuous, Tamper-Evident Activity Logs
Auditors will ask for logs that show who was detected, when, by which camera, and what action the system took. Under GDPR—which the AI Act layers on top of, not underneath — logging underpins both security and compliance; a well-designed audit trail provides individual accountability, helps reconstruct events, and detects intrusions. Regulators rely on those logs to establish whether access was authorised.
The failure mode here isn’t usually a missing log. It’s an incomplete one. A system that generates an alert but doesn’t attach the video clip, the camera location, and the precise timestamp to the same record leaves the auditor with a number and nothing to verify it against. That’s not an audit trail — it’s a count.
VideoraIQ structures every alert as a payload: video clip, location tag, and timestamp delivered together, as documented in our GDPR procurement analysis. That structure matters legally, not just operationally. The clip is the evidence. The location tag and timestamp are the chain of custody. Separating them — or allowing any one to be absent — breaks the audit record.
There’s a second layer: GDPR compliance requires meta-logs that record who accessed the primary logs, when, and what operations were performed on them. Most surveillance teams have never configured this. The alert log exists; the log of who reviewed the alert log does not.
2. Retention Schedules Set at Configuration, Not at Audit
This is the one that catches even well-run security teams off guard. Alert clips retained indefinitely by default make a system non-compliant by default. The AI Act and GDPR both require that biometric data — and the records generated from processing it — are kept only as long as necessary for the stated purpose.
In practice, this means retention periods need to be defined before the system goes live, not retrofitted when an auditor asks. A face recognition deployment that logs access events has to answer a simple question: how long does an access event record need to exist? The answer depends on your legal basis, your sector, and your jurisdiction. What it cannot be is “until someone deletes it manually.”
Audit-ready systems generate detailed historical access reports showing permission justifications and compliance with frameworks like GDPR, HIPAA, and ISO 27001. That capability has to be built into configuration. It cannot be assembled retrospectively from a pile of unstructured footage.
3. Documented Human Oversight — Not Just Human Presence
The Act requires that high-risk AI systems allow human intervention. In a surveillance context, that means demonstrating that operators can override, pause, or reject system-generated decisions — and that there’s a record when they do.
This is where alert latency intersects with governance. Sub-3-second alert delivery is the gold standard for live response; sub-5-second is the minimum acceptable threshold. VideoraIQ delivers alerts in under 3 seconds. But speed alone doesn’t satisfy the oversight requirement. The operator’s response — acknowledged, escalated, or dismissed — needs to be logged too. A system that sends an alert in 2.8 seconds and has no record of what the operator did next has satisfied the technical requirement and failed the governance one.
Where Face Recognition Creates Specific Exposure
Face recognition is the highest-friction area under the Act. As of December 2025, 13 U.S. states and 23 local jurisdictions have enacted laws specifically targeting facial recognition technology — and that’s before EU obligations apply. The enforcement record is already expensive: Clearview AI has been fined over €100 million across seven EU regulatory actions since 2020, including a €30.5 million fine from the Dutch DPA in 2024.
The practical risk is accuracy. A 200-camera corporate campus running at 95–97% accuracy generates hundreds of false-positive alerts daily — each one a potential wrongful identification event. Under the Act, those events are logged, and the log is evidence. The recommended detection accuracy threshold for 24/7 SOC teams is ≥99%; anything below swamps operators with false alerts. VideoraIQ operates at 99.4% detection accuracy across 10,000+ cameras in live environments across 7+ countries. That number belongs in the compliance record, not just the marketing deck.
Watchlist propagation latency is a documented compliance control gap: a new entry added mid-shift may not propagate to live cameras instantly. The Act’s logging requirements mean that gap now has to be measured and disclosed. A simple pilot test — add a watchlist entry mid-shift and time the propagation — produces the evidence an auditor will eventually ask for anyway. Run it before they do.
What a Compliant Configuration Actually Looks Like
There’s no single checklist that covers every deployment. The structural requirements, though, are consistent. A compliant system will have:
- Structured alert records — every detection event logged with clip, location, and timestamp as a single linked record, not separate data stores
- Defined retention schedules — configured before go-live, applied automatically, documented against the legal basis for processing
- Operator response logs — a record of what action was taken on each alert, by which operator, at what time
- Propagation latency measurement — for face recognition and ANPR, a tested and documented lag time for watchlist and blacklist updates to reach live feeds
- Meta-logs — a record of who accessed the primary logs and when, separate from the event logs themselves
- Accuracy documentation — the platform’s detection accuracy figure, sourced from live deployment data, not lab conditions
VideoraIQ is GDPR and HIPAA compliant, and its detection engines — running across face recognition, ANPR, fire and smoke detection, intrusion detection, and line-cross detection — operate at the accuracy and latency thresholds the Act implicitly demands. But compliance is also configuration. The platform has to be set up to retain the right data for the right duration and to log operator interactions, not just system detections.
Read More!
Face Recognition Pilots: The 20-Camera Test That Matters
The August 2026 Transition Is Not a Grace Period
I’ve heard security managers describe this month as a “transition period”. It isn’t. The Act’s high-risk AI provisions applied on 2 August 2026. Organisations running face recognition, automated access control, or AI-driven zone monitoring are operating under those obligations now. The first enforcement actions will target the easiest failures to document: missing logs, undefined retention, and no evidence of human oversight.
The global AI-powered video analytics market was valued at $5.63 billion in 2025 and is projected to reach $23.03 billion by 2034. Every organisation scaling into that market this year is doing so under the Act’s framework. The ones that treat governance as a configuration task — not an afterthought — are the ones that won’t be spending next year’s budget on regulatory fines.
If you’re unsure where your current deployment stands, start with the alert record structure. If they’re not, that’s the first gap to close — and the first thing an auditor will ask for.
Start your free VideoraIQ trial and see how a platform built for compliance from the ground up handles the governance layer the EU AI Act now requires.
