A camera watches a warehouse loading bay. Initially, it records footage so that incidents can be investigated. A software upgrade adds alerts when pedestrians approach moving forklifts. Another feature tracks workers across the building. A dashboard then shows how long each person spends in different areas.
The cameras may be the same, but the processing of personal data has changed considerably.
We are seeing growing interest in these capabilities in workplaces, warehouses, distribution centres and shopping centres. AI video analytics can help identify hazards, detect unscanned products or locate relevant footage more quickly. They also make it possible to observe and assess people in ways that conventional recording alone would not.
For businesses, the challenge is understanding when a useful operational feature introduces a new form of surveillance, and what that means under the GDPR and the AI Act.
A Good Objective Does Not Justify Every Method
Safety is a compelling reason to consider new technology. However, a recent Swedish case shows why the objective and the means must be assessed separately.
On 16 June 2026, Sweden’s data protection authority, IMY, reprimanded Securitas for monitoring drivers through cameras inside company vehicles. The system analysed behaviour while employees drove and could send warnings to both drivers and the employer. Recording also occurred during part of the pilot.
IMY found that the monitoring lacked a lawful basis. The authority took account of the limited pilot and the fact that monitoring had stopped when deciding to issue a reprimand. The full decision examines the employer’s reliance on legal obligations and legitimate interests.
The lesson extends beyond vehicle cameras. A business introducing analytics to prevent accidents still needs to establish why the particular monitoring is necessary and proportionate. Could a restricted detection zone achieve the objective? Does the employer need individual histories, or would an immediate safety alert suffice?
The same questions arise in retail. Last year, in its May 2025 guidance on AI cameras at self-service checkouts, France’s CNIL recognises that preventing scanning errors and losses can constitute a legitimate interest. It nevertheless calls for consideration of less intrusive alternatives, restricted camera coverage and safeguards against disproportionate consequences.
That guidance concerns checkout systems. It does not provide general approval for behavioural surveillance throughout a shop.
The Upgrade That Changes the Assessment
Businesses should also look beyond the functions they initially intend to use. A system purchased to detect safety hazards may include options to track individuals across cameras or analyse their behaviour. Before enabling those options, the business should assess whether they serve a justified purpose, what additional personal data they generate and whether the existing safeguards remain sufficient. The same review should take place when software updates introduce new analytical capabilities.
For example, using a safety dashboard to assess individual productivity introduces a further purpose. The business would need to examine whether that use is lawful and proportionate, who should have access and what employees must be told.
Under the GDPR, processing likely to result in high risk requires a DPIA before it begins. The assessment should cover the relevant functions together with their interaction. It should also translate into operational limits, including camera positioning, access permissions, retention periods and review before new analytics are enabled.
Deleting footage alone may be insufficient if the system retains identifiable movement histories, alerts or other derived information. Similarly, a supplier’s “anonymous analytics” label needs checking against whether individuals can actually be identified or singled out.
Where the AI Act Draws Additional Lines
The AI Act adds requirements that depend on what the system is intended to do.
AI intended to monitor and evaluate workers’ performance and behaviour is listed in Annex III, point 4 lit. b. A system used to assess individual working pace or behaviour therefore requires examination under the high-risk classification rules, including any applicable exception.
Some capabilities face a prohibition. The Commission’s official explanation confirms that workplace emotion recognition is prohibited, subject to the exception for medical or safety reasons. Its guidelines distinguish physical states such as fatigue from emotions, so the precise function matters.
Facial recognition introduces a separate GDPR hurdle where biometric data are used to identify people uniquely: an Article 9 condition is needed alongside an Article 6 lawful basis. A security objective alone does not satisfy both requirements. The EDPB’s video-surveillance guidelines explain this distinction.
The Commission’s current timeline gives 2 December 2027 as the application date for the Annex III high-risk rules. Existing GDPR duties and applicable AI Act prohibitions already require attention today.
Meanwhile, ordinary CCTV enforcement continues. In July 2026, the CNIL reported sanctions involving continuous employee filming and reiterated that such filming requires exceptional justification. Those cases were not presented as AI-camera cases, but they underline that adding analytical capabilities does not remove existing limits on surveillance.
Before purchasing or upgrading a system, businesses should bring operations, security, IT, HR and privacy teams together to assess its actual capabilities. Employees and customers should receive information that explains the analysis and its consequences, while staff acting on alerts need to understand the possibility of error.
The decisive question is how much observation the stated objective requires. Establishing that boundary early, and keeping it in place through subsequent updates, allows businesses to gain useful safety and security benefits without gradually introducing unjustified monitoring.
If you are considering AI video analytics or reviewing an existing system, FIRST PRIVACY can help you assess the requirements and put appropriate safeguards in place. Please feel free to get in touch.
No comments