The EU AI Act and people counting
Europe's AI regulation is arriving in stages, and visitor measurement is one of the places it lands. Here is what Regulation (EU) 2024/1689 actually says about counting people, and why the method you choose decides whether it applies to you at all. Orientation, not legal advice.
For a decade, the compliance question in visitor measurement was GDPR. From this year it has a sibling: the EU AI Act, Regulation (EU) 2024/1689, the world’s first comprehensive AI law, and it reaches directly into how organisations may analyse people in physical spaces. If your measurement involves cameras and AI, the Act is now part of your procurement checklist. If it does not, the Act is one more question your method never has to answer. As with everything in our compliance library, this page is orientation, not legal advice.
The dates that matter
The Act arrives in stages. It entered into force on 1 August 2024. Its prohibited-practices rules, the outright bans, have applied since 2 February 2025. And the main body of the regulation, including the high-risk framework that matters for video analytics, applies from 2 August 2026. Any organisation running or procuring camera-based analytics in Europe is inside the compliance window now.
What the Act actually says about analysing people
Three layers are relevant to measurement. First, the prohibitions: the Act bans practices such as real-time remote biometric identification in publicly accessible spaces for law enforcement purposes, with narrow exceptions. Visitor counting is not that, and no counting deployment should ever drift toward it. Second, the high-risk framework: systems that use biometric data to categorise individuals, particularly by sensitive attributes, carry heavy obligations, and AI video analytics that identifies or profiles people is squarely in the conversation. Third, everything else: AI systems that never touch biometric data are simply not what these chapters regulate.
The dividing line, in other words, is not “does it use AI?” but “does it process biometric data about individuals?” A system that extracts faces or body features to classify people must answer for it. A system that counts anonymous signals or shapes has nothing to classify anyone with.
What this means for camera-based counting
Camera-based counting is not banned, and done properly, counting-only camera systems process video without identifying anyone. Modern AI camera counting outputs numbers rather than footage precisely for this reason. But the burden is directional: a camera system must demonstrate what it does not do, in its DPIA yesterday and increasingly in its AI Act assessment tomorrow. That is workable, and it is work. Buyers should expect suppliers of camera analytics to answer AI Act questions in writing, and should treat vague answers as findings.
The methods where the question never arises
Wi-Fi based counting reads anonymous radio signals; cellular analytics reads aggregated network data; LiDAR measures moving geometry with no image at any stage. None of these extract biometric features, so the biometric chapters of the AI Act have nothing to attach to. This is the same architectural logic that carried our Wi-Fi method through a data protection authority’s review under GDPR: compliance that rests on what the system physically cannot do outlives compliance that rests on policy. For a compliance team planning for August 2026, the cheapest AI Act assessment is the one your measurement method never requires. The DPIA guide covers the sibling question under GDPR, and GDPR-compliant footfall analytics the foundation beneath both.
We are very excited by this collaboration with Bumbee Labs as their data expertise will complement our IoT know-how providing an unparalleled service to our clients across several verticals, industries and markets in the Middle East.
Frequently asked questions
Does the EU AI Act ban people counting?
No. The Act's prohibitions target practices like real-time remote biometric identification in publicly accessible spaces for law enforcement purposes, not commercial or municipal visitor measurement. Counting how many people visited a space is not a prohibited practice under the regulation.
When does the AI Act start to apply?
In stages. The regulation entered into force on 1 August 2024; the prohibited-practices rules have applied since 2 February 2025; and the main body of obligations, including the high-risk framework, applies from 2 August 2026. Compliance planning for affected systems is a now-question, not a someday-question.
Are camera-based counting systems high-risk under the Act?
It depends on what the system does, not on the camera itself. Systems that use biometric data to categorise people by sensitive attributes fall under the high-risk framework, and video analytics that identifies or profiles individuals carries obligations accordingly. A camera system that only counts, without extracting biometric features, sits differently, but the assessment burden of proving that is real. This is orientation, not legal advice; the classification of a specific system belongs to its own assessment.
Which counting methods stay outside the AI Act's scope?
Methods that never process biometric data have no biometric classification question to answer. Wi-Fi based and cellular-based counting read anonymous radio signals, and LiDAR measures shapes in 3D without any image, so there is no face, no body-image and no biometric feature at any stage. The scope question is settled by architecture rather than by paperwork.