Same camera, four laws — Case files

The scenario

A startup builds a loss-prevention system for retailers: cameras in every store, an AI model watching the footage, and alerts sent to staff when something looks wrong.

The founders see one product. They ask a simple question before signing their first chain of stores: is it legal in the EU?

The honest answer is another question: what exactly does the camera look at?

Roles and classification

The startup is the provider Art. 3(3): it develops the system and places it on the market under its name.
Each retailer is a deployer Art. 3(4): it uses the system under its authority in its stores. If a retailer changes the system's purpose, for example by switching on face matching the startup did not provide for, it can itself become a provider Art. 25.
On the data side, the retailer is normally the controller and the startup a processor GDPR Arts. 24, 28, unless the startup reuses the footage for its own purposes, such as training its model.
Classification depends on the intended purpose of each function, not on the hardware.

The variants

The same product, described four ways. The answer changes with what the system actually does.

Variant	What the system does	EU AI Act	GDPR	From
1	Detects gestures, such as an item slipped into a bag, without identifying anyone	Minimal risk. Not in Annex III.	Video surveillance: lawful basis, notice, retention limits; a DPIA is likely, since it is systematic monitoring of a publicly accessible area Art. 35(3)(c)	Now
2	Matches faces against a list of known shoplifters	High-risk, remote biometric identification Annex III, 1(a). Not banned: the Art. 5 ban on real-time identification covers law enforcement.	Biometric data used to identify people is a special category Art. 9; retail rarely has a valid exception. Spain's AEPD fined a supermarket chain €2.52 million in 2021 for this.	AI Act: 2 Dec 2027 · GDPR: now
3	Scores customers on how likely they are to steal, based on profile or appearance	Close to a prohibited practice: risk assessment of committing an offence based solely on profiling Art. 5(1)(d). Where the line falls for private actors needs a legal assessment.	Profiling; right to object and safeguards on automated decisions Arts. 21, 22	2 Feb 2025
4	Reads the emotions of the staff at the till	Prohibited. Emotion recognition in the workplace Art. 5(1)(f)	Employee monitoring rules on top	2 Feb 2025

Reading the emotions of customers instead of staff is not prohibited, but it is high-risk Annex III, 1(c) and the people exposed must be informed Art. 50(3).

What the company did

The startup chose the first variant: gestures only, no faces, no scores. Then it installed as many cameras as it could.

Every store became a customer, a dataset and a test of the approach, and revenue started straight away. If the rules soften, as the Digital Omnibus showed they can, the hardware is already on the wall. If they do not, the same cameras may find other uses: queues, stock on the shelves, footfall.

A reasonable strategy, with one consequence: from that day on, the risk class of every store is a software update away. Turning on face matching, or aggregating gestures into a per-person suspicion score, moves the product to another line of the table without touching the hardware.

Lessons for teams

Classify each function, not the product. One feature flag can move a system from minimal risk to high-risk.
Re-assess at every release. Medical-device teams know this as change control under IEC 62304: the question is asked before each version ships, not once at launch.
Write down what the system does not do, and why. A documented scope is what lets a provider show it sits in variant 1.
Put the limits in the contract with retailers. If a deployer changes the purpose, the obligations follow the change.
Do the GDPR work now. The AI Act dates move; the data protection rules already apply.

Open questions

Where exactly does Art. 5(1)(d) stop for a private retailer that flags individuals as likely offenders?
When does a sequence of gesture alerts about the same person become profiling?
For a Swiss startup selling only in Switzerland, the AI Act does not apply, but biometric data is sensitive personal data under the revised Federal Act on Data Protection. What changes when the first EU customer signs?

Questions

A case like yours?

If your product sits close to one of these lines, the first question is what exactly it does. Write to me if you want to talk it through.

Start a conversation

Case files are study material, not legal advice. Cases are composite or anonymised; any resemblance to a specific company is not intended.