A face can open the ward door. The rules say what has to stand beside it.

In April 2026 the Italian data protection authority fined a food company €55,000 for having clocked its 128 staff in and out with facial recognition terminals. Two details stand out. The company had relied on the vendor's assurance that the product was GDPR-compliant, and the terminals were still running the admin password printed in the manual: 12345. By the time the decision landed the firm had long since replaced them with RFID badges. That was attendance, not a secured door, but the two failures it shows, a biometric that was not necessary and a device nobody hardened, follow face recognition everywhere. Here is what the rules ask for when a face opens a door or unlocks a workstation in a hospital.

Verification is not identification

The EU AI Act draws a line that many buyers miss. "Biometric verification" is the "one-to-one verification, including authentication" of a person against their own previously provided data. A "remote biometric identification system" identifies people "without their active involvement", by comparing them against a reference database. Recital 17 excludes from that second category systems whose sole purpose is to confirm "that a specific natural person is the person he or she claims to be", including "having security access to premises". Annex III, the high-risk list, repeats the carve-out in its first line. A reader at a ward door that checks a claimed identity is therefore not high-risk under the biometrics heading of Annex III; it would only come back in if its logs were turned into a tool for monitoring staff behaviour, which is a separate line in the Annex. The Digital Omnibus on AI (Regulation (EU) 2026/1744), which pushed the Annex III deadline to 2 December 2027, left the carve-out untouched.

What the AI Act leaves alone, the GDPR picks up. Biometric data processed "for the purpose of uniquely identifying a natural person" is special category data under Article 9, so the door needs an Article 9(2) ground (for staff, usually one anchored in national employment law), a data protection impact assessment and a documented reason a badge would not do.

What NIST asks of the reader

The US digital identity guideline, SP 800-63B-4 (July 2025), is written for sign-in to information systems rather than doors, but it is the benchmark buyers quote and its logic transfers. Its starting point is that "biometric characteristics do not constitute secrets", so "biometrics SHALL only be used as part of multi-factor authentication with a physical authenticator". The face confirms who is holding the card or the phone; it does not replace them.

From there the requirements are specific: a false match rate of one in 10,000 "for all demographic groups", at a fixed threshold; PAD, which the system "SHALL implement" for face, with a target impostor attack presentation accept rate below 0.07; five consecutive failures, or ten with PAD, before delays kick in. Comparison "SHOULD be performed locally"; if it is central, the sensor "SHALL be authenticated" before it captures a sample, because a camera is only as trustworthy as the channel behind it. An alternative non-biometric method "SHALL always be provided". And voice "SHALL NOT be used".

Where the template lives decides the legal answer

European regulators converge on one design choice: who holds the template. The EDPB's Opinion 11/2024 on face recognition at airports found that a template stored on the person's own device, or stored centrally but encrypted with a key only the person holds, "could be considered in principle compatible" with the GDPR subject to safeguards, while a central database under the operator's control (used there for one-to-many matching) "cannot be compatible with Article 25". The reasoning is plain: a breach of a central biometric store outweighs the convenience.

France's CNIL reached the same point in 2019 with a binding standard for biometric access control at work: templates under the person's control by default, a central database only with a documented risk analysis, raw images never kept, and a fallback "de secours" at no cost to the employee. The UK's ICO ordered Serco Leisure in February 2024 to stop using face and fingerprint for more than 2,000 staff at 38 sites, because it could not show the biometrics were necessary when less intrusive means existed and staff had no clear way to opt out.

Both enforcement cases are about attendance, where a badge does the job. A locked drug store, a data centre or a neonatal unit carries a different necessity argument, and the standards above describe how to make it: second factor, template on the card or phone, alternative route, impact assessment.

Masks, demographics and cameras that lie

A ward is a hard environment for a face. NIST's first mask study (July 2020) found the best algorithms went from about 0.3% false non-matches unmasked to about 5% masked, with errors rising as masks covered more of the nose; vendors retrained, and NIST stopped running the 1:1 mask benchmark in 2024. Demographics matter too: NIST's 2019 evaluation found false positives "often vary by factors of 10 to beyond 100 times" across groups, and noted that in access control false positives "allow access to imposters". That is why the guideline demands one threshold and one error rate for everyone.

The attack that worries evaluators most is no longer a printed photo. ENISA's remote identity proofing report (March 2024) repeated its 2022 finding that video injection is "the most promising attack method" and cited industry data putting injection incidents in 2022 at about five times the frequency of presentation attacks. Hence NIST's push for sensor authentication and attestation. For presentation attacks, ask for the test letter: iBeta tests to ISO/IEC 30107-3 at three levels (no artefact may pass at Level 1, 1% at Level 2, 5% at Level 3), and the FIDO Alliance's Biometrics Requirements v4.1 set the same 7% impostor rate at BioLevel 2 that NIST's 0.07 target implies. A version 5.0 is in review draft as of September 2026.

What to write down before the reader goes on the wall

The second factor the face is paired with. Where the template is stored and who holds the key. The PAD test level and the letter that proves it. The false match rate the vendor will commit to, for every group. The non-biometric route for staff who decline. The impact assessment. And the admin password, changed from whatever the manual says.