Notifications
Clear all
Topic starter
02/08/2026 12:22 pm
TL;DR: Lower error rates and improved performance around ages 17 to 20 have allowed KJM to reduce the buffer for Yoti’s facial age estimation from 5 years to 3 years for the highest level of age assurance, according to Yoti. The change shows how identity verification controls are becoming more evidence-driven, but also how regulators will keep testing the boundary between usability, assurance, and exclusion.
NHIMG editorial — based on content published by Yoti: Germany’s reduced buffer for facial age estimation
By the numbers:
- Yoti’s current MAE is 1.1 years for ages 13 to 17.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
Questions worth separating out
Q: How should organisations use facial age estimation in regulated identity workflows?
A: Use it as one control in a layered assurance process, not as the only decision maker.
Q: Why do age verification systems need threshold-specific testing?
A: Because the compliance decision happens at the cutoff, not across the whole dataset.
Q: What breaks when facial age estimation is used without liveness checks?
A: The control becomes vulnerable to replay and impersonation attacks.
Practitioner guidance
- Define the exact legal threshold before selecting a model Map the age assurance requirement to the specific regulatory cutoff, then verify that the model’s buffer, false positive rate, and false negative rate are measured at that boundary rather than on broad population averages.
- Require liveness evidence as a separate control Treat anti-spoofing as its own control layer and validate that photo replay, screen capture, and synthetic presentation attacks are blocked before the age estimate is trusted.
- Build regulator-ready assurance packs Keep threshold rationale, test results, audit trails, and exception handling together so compliance teams can show how the control operates in production and not just in test conditions.
What's in the full analysis
Yoti's full article covers the operational detail this post intentionally leaves for the source:
- The specific accuracy metrics Yoti cites for ages 13 to 17, including performance around the 21-plus threshold.
- The regulator context behind the KJM buffer change and how the 3-year threshold is applied in practice.
- The white paper findings on false positive rate, mean absolute error, and true positive rate across age bands.
- The anti-spoofing and liveness detection detail that supports the age estimation workflow.
👉 Read Yoti’s analysis of Germany’s reduced facial age estimation buffer →
Facial age estimation buffer changes: what does this mean for IDV teams?
Explore further
02/08/2026 1:22 pm
Age assurance is becoming a governed control, not a model demo. The KJM decision shows that regulators are increasingly willing to reduce buffer requirements when performance evidence improves, but they are not delegating judgment to the model. For identity verification teams, the control now lives at the intersection of accuracy, policy thresholding, and auditability. Practitioners should treat this as a governance signal: the operational question is whether the assurance boundary can be defended, not whether the model can classify faces in isolation.
A question worth separating out:
Q: Who is accountable when age assurance decisions are challenged by regulators?
A: Accountability sits with the organisation that deploys the control, not with the model or the supplier alone. Legal, product, security and compliance teams should share ownership of the evidence set, because regulators judge the decision process as well as the outcome.
👉 Read our full editorial: Germany eases facial age estimation buffer as accuracy improves
