A clear guide to ethical AI surveillance in 2026: the EU AI Act, GDPR and India's DPDPA, bias, transparency, and the privacy controls a modern VMS should give you.
AI surveillance is now regulated in earnest. The EU AI Act's prohibitions have applied since February 2025, and its high risk obligations phase in from August 2026. It bans live remote face identification in public spaces for law enforcement, with narrow exceptions. It treats other biometric identification as high risk, needing a formal assessment. And it bans emotion recognition in workplaces and schools.
Other countries are moving too. India's Digital Personal Data Protection Act requires consent or a recognised lawful purpose before personal data, including biometric data, is processed. Several US states have their own biometric privacy laws. Anyone deploying AI cameras now needs a clear view of which rules apply where.
Privacy by design means the protections are part of the system from day one. In practice: only the right people see sensitive footage, faces and plates are hidden when video is shared, data is kept only as long as needed, and every action leaves a trail.
Visylix is built this way. Video stays on your own servers and never leaves the building. Access is controlled through 46 permissions across 4 roles. Retention rules delete footage on schedule. Exported evidence can have faces, plates and any custom area redacted. And every operator and copilot action lands in a tamper evident audit trail.
Face recognition is designed for accountability. Watchlist matches are raised for an operator to confirm, never acted on blindly. Enrolment includes a liveness check, and built in consent and erasure tools support data subject requests.
AI can inherit the blind spots of the data it learned from. Face recognition in particular has a history of uneven error rates across skin tones and genders. Responsible teams test performance across groups before launch and keep watching after it.
Good practice is simple to state: document how models were evaluated, keep results broken down by relevant groups, and make sure a human reviews any decision with real consequences. Keeping a person in the loop, as Visylix does for watchlist alerts, is the strongest safeguard there is.
People have a right to know when AI cameras are watching, what is collected, and how to challenge a decision. Organisations should keep records of what the system did and what operators decided.
The practical steps are well known: clear signage, a published impact assessment, a public surveillance policy, and regular independent reviews. A platform that logs everything and keeps data in house makes each of these far easier to deliver.
Its prohibitions have applied since February 2025 and high risk obligations phase in from August 2026. Live remote face identification in public spaces for law enforcement is banned with narrow exceptions, other biometric identification is high risk and needs a formal assessment, and emotion recognition is banned in workplaces and schools. Map every use case to these categories before you go live in the EU.
Test accuracy across demographic groups before launch, keep monitoring afterwards, document the evaluation method and keep a human in the loop for consequential decisions. Visylix raises watchlist matches for an operator to confirm rather than acting automatically.
No. Role based access with 46 permissions across 4 roles, scheduled retention, redaction of faces, plates and custom areas on export, and a tamper evident audit trail are part of the platform. Because Visylix runs on your own infrastructure, video never leaves your building in the first place.
Usually: tell people AI cameras are in use, explain what is collected and why, give them a way to contest decisions, and keep audit trails of system and operator actions. Signage, published impact assessments and periodic independent reviews are the common practical steps.