Face recognition at the door: are your controls keeping up?

TL;DR: Face recognition used for workplace access sits at the intersection of biometric verification, GDPR special-category data, and AI Act carve-outs, with necessity, fallback access and template custody determining legality and risk, according to Crayonic. The control problem is not the face itself but whether the identity check is proportionate, auditable and backed by hardened device administration.

Editorial analysis by NHI Mgmt Group, based on content published by Crayonic: “A face can open the ward door. The rules say what has to stand beside it.”.

By the numbers:

• The company had clocked its 128 staff in and out with facial recognition terminals.

Key questions

Q: How should organisations govern facial recognition so it remains defensible?

A: Treat facial recognition as a governed identity control, not a standalone AI output.

Q: Why does biometric verification reduce access risk compared with badge-based entry systems?

A: Biometric verification reduces access risk because it confirms that the person presenting for entry is the authorised individual, not just someone holding a credential.

Q: What are the signs that facial recognition access control is failing?

A: Warning signs include default credentials on the terminal, no documented fallback, no recent privacy impact assessment, vague template storage arrangements and staff using the system without clear consent or legal basis.

Practitioner guidance

• Define the necessity test before deployment Document why a biometric is required for the specific access point and record why badges, cards or other less intrusive options do not meet the use case.
• Map template custody and retention Specify whether templates remain on the user's device or in a central store, who can access them, and how deletion and revocation are handled.
• Enforce authenticated device administration Remove default credentials, require strong admin authentication and verify that every reader or terminal has a protected management path.

Bottom line: Facial recognition at workplace doors raises a governance question about necessity, not just a technology choice.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →