The EU AI Act and people counting
Europe's AI regulation is arriving in stages, and visitor measurement is one of the places it lands. This guide sets out what Regulation (EU) 2024/1689 says about counting people, and why the method you choose decides whether it applies to you at all. Orientation, not legal advice.
On this page
For a decade, the compliance question in visitor measurement was GDPR. Now the EU AI Act, Regulation (EU) 2024/1689, sits beside it. It is the world’s first comprehensive AI law, and it reaches directly into how organisations may analyse people in physical spaces. If your measurement involves cameras and AI, the Act is now part of your procurement checklist. If it does not, the Act is one more question your method never has to answer. As with everything in our compliance library, this page is orientation, not legal advice.
The dates that matter
The Act applies in stages. It entered into force on 1 August 2024, and its prohibited practices, the outright bans, have applied since 2 February 2025. The transparency rules in Article 50 apply from 2 August 2026. One of them touches camera analytics directly: deployers of emotion recognition or biometric categorisation systems must inform the people exposed to them.
The high-risk framework, the part that matters most for video analytics, was also due on 2 August 2026. The Digital Omnibus on AI, Regulation (EU) 2026/1744, which entered into force in July 2026, moved it to 2 December 2027 for stand-alone high-risk systems and to 2 August 2028 for AI built into products covered by EU product-safety law. The obligations were postponed, not removed, so organisations running or procuring camera-based analytics in Europe still need to plan for them.
What the Act actually says about analysing people
Three layers are relevant to measurement. First, the prohibitions: the Act bans practices such as real-time remote biometric identification in publicly accessible spaces for law enforcement purposes, with narrow exceptions. Visitor counting is not that, and no counting deployment should ever drift toward it. Second, the high-risk framework: systems that use biometric data to categorise individuals, particularly by sensitive attributes, carry heavy obligations, and AI video analytics that identifies or profiles people is squarely in the conversation. Third, everything else: AI systems that never touch biometric data are not what these chapters regulate.
The dividing line, in other words, is not “does it use AI?” but “does it process biometric data about individuals?” A system that extracts faces or body features to classify people must answer for it. A system that counts anonymous signals or shapes has nothing to classify anyone with.
What this means for camera-based counting
Camera-based counting is not banned, and done properly, counting-only camera systems process video without identifying anyone. Modern AI camera counting outputs numbers rather than footage for exactly this reason. But the burden falls on the camera system: it must demonstrate what it does not do, already in its DPIA and increasingly in its AI Act assessment. That is workable, though it takes effort. Buyers should expect suppliers of camera analytics to answer AI Act questions in writing, and should treat vague answers as findings.
The methods where the question never arises
Wi-Fi based counting reads anonymous radio signals, cellular analytics reads aggregated network data, and LiDAR measures moving geometry with no image at any stage. None of these extract biometric features, so the biometric chapters of the AI Act have nothing to attach to. The same architectural logic carried our Wi-Fi method through a data protection authority’s review under GDPR: compliance that rests on what the system physically cannot do lasts longer than compliance that rests on policy. For a compliance team planning for December 2027, the cheapest AI Act assessment is one the measurement method never requires. The DPIA guide covers the related question under GDPR, and GDPR-compliant footfall analytics sets out the GDPR position behind both.
Curious what this looks like for your venue?
Frequently asked questions
Does the EU AI Act ban people counting?
No. The Act's prohibitions target practices like real-time remote biometric identification in publicly accessible spaces for law enforcement purposes, not commercial or municipal visitor measurement. Counting how many people visited a space is not a prohibited practice under the regulation.
When does the AI Act start to apply?
In stages. The regulation entered into force on 1 August 2024, the prohibited-practices rules have applied since 2 February 2025, and the transparency rules in Article 50 apply from 2 August 2026. The high-risk obligations were due the same day, but the Digital Omnibus on AI, Regulation (EU) 2026/1744, moved them to 2 December 2027 for stand-alone high-risk systems and to 2 August 2028 for AI built into products covered by EU product-safety law. The obligations were postponed, not removed.
Are camera-based counting systems high-risk under the Act?
It depends on what the system does, not on the camera itself. Systems that use biometric data to categorise people by sensitive attributes fall under the high-risk framework, and video analytics that identifies or profiles individuals carries obligations accordingly. A camera system that only counts, without extracting biometric features, sits differently, but the assessment burden of proving that is real. This is orientation, not legal advice; the classification of a specific system belongs to its own assessment.
Which counting methods stay outside the AI Act's scope?
Methods that never process biometric data have no biometric classification question to answer. Wi-Fi based and cellular-based counting read anonymous radio signals, and LiDAR measures shapes in 3D without any image, so there is no face, body image or biometric feature at any stage. How these methods are built settles the scope question.