[{"data":1,"prerenderedAt":613},["ShallowReactive",2],{"uc-facial-recognition-watchlist-matching":3,"uc-regulations":388},{"useCase":4,"evidence":142,"blitsAiDeployments":281,"benchmarks":282,"indicative":173,"related":283,"indexability":386,"includeUnpublished":148},{"title":5,"shortTitle":6,"seoTitle":7,"metaDescription":8,"status":9,"definition":10,"aliases":11,"industries":16,"functions":19,"patterns":21,"channels":24,"audience":25,"autonomy":26,"adoptionStage":27,"problem":28,"problemStats":29,"howItWorks":30,"valueDrivers":31,"kpis":34,"macroEstimates":38,"feasibility":39,"implementation":51,"risk":87,"blitsAi":122,"faq":124,"related":134,"datePublished":137,"dateModified":137,"lastVerified":137,"changelog":138,"slug":141},"AI facial recognition for matching faces against watchlists in policing and retail","Facial recognition watchlist matching","AI facial recognition watchlist matching","AI that matches faces on camera to a watchlist. The UK ICO gave South Wales Police a high assurance rating in an audit; the FTC banned Rite Aid from using it.","published","AI facial recognition watchlist matching compares faces captured by cameras with a list of people of interest, such as people wanted by the police or previously involved in serious harm in a store, and alerts a trained person when it finds a possible match. That person is expected to confirm the alert before anyone is stopped or asked to leave.",[12,13,14,15],"live facial recognition","retrospective facial recognition","facial recognition for law enforcement","face matching against a watchlist",[17,18],"government","retail-and-ecommerce",[20],"security-operations",[22,23],"computer-vision","prediction-and-scoring",[],"back-office","assist","early-adopters","Police forces and retailers each keep a short list of people they want to find or keep out: wanted\noffenders, people in breach of court conditions, people who have seriously harmed staff. Spotting\nthem in a crowd or a queue by eye does not work, and officers or guards cannot memorize hundreds of\nfaces. Retrospective matching has a similar problem: investigators hold images from cameras and\nmust search a large database by hand.\n\nFacial recognition automates the comparison, and that creates a different problem. A wrong match\nleads to a person being stopped, followed or searched. The regulator reports on this page look at the\nsafeguards around the software: the lawful basis for the watchlist, the alert threshold, human review\nof every alert, deletion of the faces that do not match, and monitoring for bias. Of the deployments on\nthis page, two passed a regulator's audit or inquiry (neither regulator called it a general approval),\nand one ended in a five year ban under a settlement with the US Federal Trade Commission.",[],"1. **Build a watchlist.** The organization decides who may be on it, under a documented\n   authorization, and loads their images.\n2. **Capture and compare.** Cameras at a deployment point send faces to a recognition model, which\n   scores each face against the watchlist. Faces below the threshold are deleted straight away.\n3. **Alert a trained person.** A score above the threshold produces an alert with both images, and a\n   trained operator or officer verifies it before anyone is approached.\n4. **Act and record.** The operator decides what to do under a written policy, and the alert, the\n   decision and the outcome are logged.\n5. **Review.** The organization tracks false alerts and checks results by demographic group, and a\n   regulator or auditor reviews the governance.",[32,33],"risk-reduction","speed",[35,36,37],"accuracy","false-positive-reduction","detection-rate-improvement",[],{"complexity":40,"complexityNote":41,"dataPrerequisites":42,"integrations":46},"high","The matching model is bought from a specialist vendor. The build is the legal basis and impact assessment, the watchlist governance, the cameras and their placement, the integration with the verification and incident systems, and the bias and accuracy testing on the local population.",[43,44,45],"A watchlist with a documented lawful basis, an owner and a review date for every entry","Cameras with image quality that meets the model's requirements at the deployment points","A test set of the local population to measure false matches by demographic group",[47,48,49,50],"Camera and video management systems","Case or incident management system for logging alerts and outcomes","Operator verification interface with both images side by side","Retention and deletion controls for non matching faces",{"steps":52,"guardrails":65,"humanInTheLoop":71,"kpisToInstrument":72,"failureModes":77},[53,56,59,62],{"title":54,"detail":55},"Establish the legal basis and assess the impact","Write down why facial recognition is necessary and proportionate, complete the data protection impact assessment and consult the regulator where the law expects it, before buying anything.",{"title":57,"detail":58},"Test accuracy and bias on your population","Measure false matches by age, skin tone and sex on images that look like your own cameras produce, and set the alert threshold from the result, not from the vendor default.",{"title":60,"detail":61},"Run a limited, announced trial","Start at a few locations with visible signage, count scans, alerts, confirmed matches and false alerts, and publish the findings or share them with the regulator.",{"title":63,"detail":64},"Review and widen only on the results","Expand when false alerts and demographic gaps are within the limits you set, and keep an independent audit on a schedule.",[66,67,68,69,70],"A trained person verifies every alert before any action, and no decision is solely automated","Faces that do not match are deleted straight away and never used to train the model","A watchlist limited to named categories, with an authorization and a review date per entry","Visible notices at every deployment point","Regular bias testing, with the threshold raised when the gap persists","Trained operators confirm or discard every alert and decide the action. A senior officer or manager authorizes each deployment, and an independent person reviews false alerts and complaints.",[73,74,75,76],"Confirmed matches and false alerts per 100,000 faces scanned","False alert rate by demographic group","Time from alert to verification","Complaints and challenges, with the outcomes",[78,81,84],{"title":79,"detail":80},"Unreliable alerts for some groups","A model trained on a different population can misidentify some groups more often. The New Zealand Privacy Commissioner noted that the Foodstuffs software was not trained on the New Zealand population, so bias could not be ruled out. Test locally and monitor by group.",{"title":82,"detail":83},"Staff act on an unverified alert","Following, searching or ejecting a person on an unverified alert is what the FTC alleged at Rite Aid. Require verification by a trained person and a written action policy.",{"title":85,"detail":86},"Watchlist creep","The list grows beyond serious harm or wanted offenders. Give every entry an owner and a review date, and remove stale entries.",{"euAiAct":88,"regulations":90,"guidance":94,"controls":112,"incidents":117},{"tier":40,"basis":89},"Two provisions apply. Article 5(1)(h) prohibits the use of real time remote biometric identification in publicly accessible spaces for law enforcement, a prohibition that applies since 2 February 2025. The only exceptions are a targeted search for specific victims of abduction, trafficking or sexual exploitation and for missing persons, the prevention of a specific, substantial and imminent threat to life or physical safety or of a terrorist attack, and locating a suspect of a serious crime listed in Annex II. Each use needs prior authorization by a judicial or independent administrative authority (Article 5(3); in a duly justified urgency it must be requested within 24 hours) and a national law that allows it (Article 5(5)). Live police watchlist matching in the EU is therefore prohibited outside those exceptions. Every remote biometric identification system that is not prohibited, including retrospective matching by police and live matching by a retailer, is high risk under Annex III point 1(a); Article 26(10) adds an authorization duty for retrospective police searches. The schema has no prohibited tier, so the page is recorded as high. Faces are biometric data, so a retailer also needs a condition under GDPR Article 9.",[91,92,93],"eu-ai-act","gdpr","uk-gdpr",[95,101,106],{"title":96,"issuer":97,"region":98,"url":99,"note":100},"Regulation (EU) 2024\u002F1689 (AI Act), Article 5(1)(h) and Annex III point 1","European Union","europe","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2024\u002F1689\u002Foj","Article 5(1)(h) prohibits real time remote biometric identification in publicly accessible spaces for law enforcement outside narrow exceptions; Annex III point 1(a) makes other remote biometric identification high risk.",{"title":102,"issuer":103,"region":98,"url":104,"note":105},"ICO audit of South Wales Police and Gwent Police, executive summary","Information Commissioner's Office","https:\u002F\u002Fico.org.uk\u002Fmedia2\u002F0hzpqaj5\u002Fexecutive-summary-of-the-south-wales-police-and-gwent-police-audit-report.pdf","Shows what a regulator checked for live and retrospective facial recognition: necessity and proportionality, fairness and accuracy, and human oversight.",{"title":107,"issuer":108,"region":109,"url":110,"note":111},"Supermarket trial of FRT, Privacy Commissioner inquiry results","Office of the Privacy Commissioner (New Zealand)","asia-pacific","https:\u002F\u002Fwww.privacy.org.nz\u002Fnews\u002Fstatements-media-releases\u002Fsupermarket-trial-of-frt-inquiry-results-announced\u002F","A regulator inquiry into a live facial recognition trial in 25 supermarkets, with the safeguards the Commissioner relied on and the improvements it asked for before any permanent use.",[113,114,115,116],"Data protection impact assessment completed and reviewed before each new deployment","Written authorization per deployment with the legal basis, the watchlist and the location","Audit trail of every alert, verification and action","Independent audit or inquiry on a schedule",[118],{"title":119,"url":120,"note":121},"Rite Aid banned from using AI facial recognition after FTC says retailer deployed technology without reasonable safeguards","https:\u002F\u002Fwww.ftc.gov\u002Fnews-events\u002Fnews\u002Fpress-releases\u002F2023\u002F12\u002Frite-aid-banned-using-ai-facial-recognition-after-ftc-says-retailer-deployed-technology-without","The FTC alleged that the system, used in hundreds of stores from 2012 to 2020, produced thousands of false positive matches, more often in plurality Black and Asian communities, and that staff followed, searched and ejected customers on the strength of alerts. Rite Aid accepted a five year ban.",{"howToBuild":123},"Blits.ai does not provide biometric identification. It does not match faces, process camera images or hold watchlists, and it\nshould not be connected to those systems. What it can do sits outside the identification process: an **agent** on **web chat,\nWhatsApp or voice** answers the public's questions about where and why the technology is used, how long images are kept and how to\nrequest one's data or complain, from a **knowledge base** of the organization's published policies and notices.\n\nA complaint or data request follows a **flow** that records the details and passes the case through **human handover** to the\nresponsible team, so a person handles every complaint. A second agent can answer staff questions about the written policy and the\noversight documentation. **Guardrails** and **PII masking** keep personal identifiers out of prompts, and **test suites** check\nthat the answers stay the same after every policy change. Run Blits.ai in our cloud in the EU, Qatar, Singapore, the UAE, the US or Australia, in your private cloud, or fully on premises.",[125,128,131],{"question":126,"answer":127},"Have regulators accepted any facial recognition deployments?","Some have reviewed specific deployments and found them compliant, with conditions. The UK Information Commissioner's Office gave South Wales Police and Gwent Police a high level of assurance in its 2025 data protection audit, and the New Zealand Privacy Commissioner found the Foodstuffs North Island supermarket trial complied with the Privacy Act 2020. Both findings depend on human review of alerts and written safeguards, and neither is a general approval. In the EU, live police use is prohibited outside narrow exceptions.",{"question":129,"answer":130},"What went wrong at Rite Aid?","The US Federal Trade Commission alleged that Rite Aid used the technology without reasonable safeguards, that it produced thousands of false positive matches and that staff acted on them against customers. Rite Aid agreed to stop using facial recognition for surveillance for five years.",{"question":132,"answer":133},"Is facial recognition for watchlists allowed under the EU AI Act?","Real time remote biometric identification in publicly accessible spaces for law enforcement is prohibited by Article 5(1)(h), except for a few listed purposes with prior judicial or independent authorization and a national law that allows it. Other remote biometric identification, such as retrospective searches or a retailer's system, is high risk under Annex III point 1(a). The UK deployments on this page fall under UK law, not the EU AI Act.",[135,136],"physical-security-video-analytics","self-checkout-and-exit-loss-prevention","2026-11-12",[139],{"date":137,"note":140},"First published","facial-recognition-watchlist-matching",[143,174,198,230,251],{"title":144,"useCases":145,"organization":146,"vendors":151,"summary":152,"stage":153,"year":154,"channels":155,"languages":156,"metrics":158,"outcomeDisclosed":159,"sources":160,"verification":169,"grade":171,"id":172,"organizationSlug":173},"Essex Police: live facial recognition deployments paused over accuracy and bias risks",[141],{"name":147,"anonymized":148,"country":149,"region":98,"industry":17,"wikidata":150},"Essex Police",false,"GB","Q5399777",[],"Essex Police used live facial recognition cameras to match passers by against watchlists. The force paused its live deployments after identifying potential accuracy and bias risks. The Information Commissioner's Office audited the force in November 2025 and noted the pause in its March 2026 commentary, and says it continues to work with the force to make sure these risks are addressed.","paused",2025,[],[157],"en",[],true,[161,166],{"url":162,"title":163,"publisher":164,"date":165},"https:\u002F\u002Fico.org.uk\u002Fabout-the-ico\u002Fmedia-centre\u002Fnews-and-blogs\u002F2026\u002F03\u002Fwhy-data-protection-lies-at-the-heart-of-responsible-police-use-of-facial-recognition-technology\u002F","Why data protection lies at the heart of responsible police use of facial recognition technology","Information Commissioner's Office (ICO)","2026-03-17",{"url":167,"title":168,"publisher":164},"https:\u002F\u002Fico.org.uk\u002Fmedia2\u002Fmucn50y1\u002Fessex-police-frt-audit-executive-summary.pdf","Essex Police data protection audit report, executive summary",{"level":170,"checkedAt":137},"source-verified","A","essex-police-live-facial-recognition-paused",null,{"title":175,"useCases":176,"organization":177,"vendors":180,"summary":181,"stage":182,"year":154,"channels":183,"languages":184,"metrics":185,"outcomeDisclosed":159,"sources":186,"verification":196,"grade":171,"id":197,"organizationSlug":173},"South Wales Police: live and retrospective facial recognition, ICO data protection audit",[141],{"name":178,"anonymized":148,"country":149,"region":98,"industry":17,"wikidata":179},"South Wales Police","Q3403362",[],"South Wales Police and Gwent Police use live facial recognition, where cameras match the faces of passers by to a watchlist in real time, and retrospective facial recognition, where images from investigations are compared with a database. In August 2025 the UK Information Commissioner's Office published the executive summary of its consensual data protection audit of both forces and gave a high level of assurance for both uses, with recommendations in each. The ICO audit covers governance and use of personal information, not a technical test of the software. It reports that the forces kept human oversight so that no decisions are solely automated.","scaled",[],[],[],[187,190,193],{"url":104,"title":188,"publisher":103,"date":189},"South Wales Police and Gwent Police data protection audit report, executive summary","2025-08-20",{"url":191,"title":192,"publisher":103,"date":189},"https:\u002F\u002Fico.org.uk\u002Fabout-the-ico\u002Fmedia-centre\u002Fnews-and-blogs\u002F2025\u002F08\u002Fico-steps-up-scrutiny-of-police-use-of-facial-recognition-technology-with-audit-of-south-wales-police-and-gwent-police\u002F","ICO steps up scrutiny of police use of facial recognition technology with audit of South Wales Police and Gwent Police",{"url":194,"title":195,"publisher":103},"https:\u002F\u002Fico.org.uk\u002Fmedia2\u002Fuo1cdoxm\u002Fpolice-forces-frt-outcomes-report-202608.pdf","Findings from ICO consensual audits on the use of facial recognition technology by police forces in England and Wales",{"level":170,"checkedAt":137},"south-wales-police-live-facial-recognition-ico-audit",{"title":199,"useCases":200,"organization":201,"vendors":204,"summary":205,"stage":206,"year":207,"channels":208,"languages":210,"metrics":211,"outcomeDisclosed":159,"sources":220,"verification":228,"grade":171,"id":229,"organizationSlug":173},"Foodstuffs North Island: live facial recognition trial reviewed by the Privacy Commissioner",[141],{"name":202,"anonymized":148,"country":203,"region":109,"industry":18},"Foodstuffs North Island","NZ",[],"Foodstuffs North Island ran a live facial recognition trial in 25 of its supermarkets from February to September 2024 to identify people previously involved in seriously harmful behavior. Staff verified every match alert with two trained people before acting. New Zealand's Privacy Commissioner ran an inquiry and found the trial complied with the Privacy Act 2020, with a high level of intrusion reduced by safeguards: the alert threshold was raised from 90 percent to 92.5 percent likelihood of a match, access was restricted and images could not be used for training. The Commissioner found the technology effective at reducing harmful behavior, especially serious violent incidents, but said the software was developed overseas and not trained on the New Zealand population, so bias against Maori and Pacific people could not be ruled out, and asked for monitoring of the effect of skin tone.","pilot",2024,[209],"internal-tools",[157],[212],{"kpi":213,"value":214,"unit":215,"qualifier":216,"period":217,"claimant":218,"quote":219,"sourceUrl":110},"interactions-handled",225972004,"count","exact","8 February to 7 September 2024, 25 supermarkets","regulator","During the trial, 225,972,004 faces were scanned (includes multiple scans of the same person), with 99.999% of these deleted within one minute, and there were 1742 alerts of which 1208 were confirmed matches.",[221,224],{"url":110,"title":222,"publisher":108,"date":223},"Supermarket trial of FRT: Privacy Commissioner Inquiry results announced","2025-06-04",{"url":225,"title":226,"publisher":108,"date":227},"https:\u002F\u002Fwww.privacy.org.nz\u002Fassets\u002FDOCUMENTS\u002F20250603-short-summary-FRT-inquiry-A1076632.pdf","FRT Inquiry: summary of findings","2025-06-03",{"level":170,"checkedAt":137},"foodstuffs-north-island-facial-recognition-trial-inquiry",{"title":231,"useCases":232,"organization":233,"vendors":238,"summary":239,"stage":153,"year":240,"channels":241,"languages":242,"metrics":243,"outcomeDisclosed":159,"sources":244,"verification":249,"grade":171,"id":250,"organizationSlug":173},"Rite Aid: facial recognition in stores banned for five years after FTC complaint",[141],{"name":234,"anonymized":148,"country":235,"region":236,"industry":18,"wikidata":237},"Rite Aid","US","north-america","Q3433273",[],"From 2012 to 2020 Rite Aid used artificial intelligence based facial recognition in hundreds of stores to identify customers who may have shoplifted. The US Federal Trade Commission alleged that the system generated thousands of false positive matches, that it was more likely to flag people in stores in plurality Black and Asian communities, and that Rite Aid never tested the accuracy before deployment, did not monitor false positive rates, used low quality images and did not train staff to treat matches as possibly wrong. Employees followed, searched and ejected customers and called police on the strength of alerts. To settle, Rite Aid agreed to a five year ban on facial recognition for surveillance and to delete the images. The FTC statement describes allegations in a complaint that accompanied a settlement.",2020,[209],[157],[],[245],{"url":120,"title":246,"publisher":247,"date":248},"Rite Aid Banned from Using AI Facial Recognition After FTC Says Retailer Deployed Technology without Reasonable Safeguards","US Federal Trade Commission","2023-12-19",{"level":170,"checkedAt":137},"rite-aid-facial-recognition-ftc-order",{"title":252,"useCases":253,"organization":254,"vendors":258,"summary":259,"stage":153,"year":260,"channels":261,"languages":262,"metrics":263,"outcomeDisclosed":159,"sources":264,"verification":278,"grade":279,"id":280,"organizationSlug":173},"Kmart Australia: facial recognition against refund fraud found to breach the Privacy Act",[141],{"name":255,"anonymized":148,"country":256,"region":109,"industry":18,"wikidata":257},"Kmart Australia","AU","Q6421682",[],"From June 2020 Kmart ran a facial recognition system in 28 stores to detect refund fraud and to identify people suspected of earlier theft or refund fraud, capturing the faces of everyone entering those stores. It ran until the Australian privacy regulator opened an investigation in July 2022. According to iTnews and the law firm Clayton Utz, the Privacy Commissioner determined in 2025 that collecting this biometric information without consent breached the Privacy Act, because less privacy intrusive methods existed, and directed Kmart to stop using the system in its existing form. Wesfarmers said Kmart was disappointed and reviewing its options to appeal.",2022,[],[157],[],[265,269,273],{"url":266,"title":267,"publisher":268},"https:\u002F\u002Fwww.oaic.gov.au\u002Fnews\u002Fmedia-centre\u002F18-kmarts-use-of-facial-recognition-to-tackle-refund-fraud-unlawful,-privacy-commissioner-finds","Kmart's use of facial recognition to tackle refund fraud unlawful, Privacy Commissioner finds","Office of the Australian Information Commissioner (OAIC)",{"url":270,"title":271,"publisher":272},"https:\u002F\u002Fwww.itnews.com.au\u002Fnews\u002Fkmart-australias-use-of-facial-recognition-breached-privacy-620377","Kmart Australia's use of facial recognition breached privacy","iTnews",{"url":274,"title":275,"publisher":276,"date":277},"https:\u002F\u002Fwww.claytonutz.com\u002Finsights\u002F2025\u002Fnovember\u002Ffrom-cameras-to-compliance-oaics-kmart-determination-highlights-facial-recognition-technology-privacy-risks","From cameras to compliance: OAIC's Kmart determination highlights facial recognition technology privacy risks","Clayton Utz","2025-11-01",{"level":170,"checkedAt":137},"C","kmart-australia-facial-recognition-refund-fraud-determination",0,[],[284,322,347,362],{"slug":135,"title":285,"shortTitle":286,"definition":287,"status":9,"industries":288,"functions":291,"patterns":292,"audience":295,"autonomy":26,"adoptionStage":27,"evidenceCount":296,"publicEvidenceCount":296,"organizations":297,"bestGrade":311,"headline":312,"lastVerified":321,"indexable":159},"AI video analytics and screening for physical security","Physical security video analytics","Physical security video analytics is AI that watches camera feeds or walk through sensors at a site and flags a likely weapon, intrusion or theft. It works in real time or on search, and leaves the verification and every response action to a human guard or investigator, rather than acting on its own.",[18,289,17,290],"education","cross-industry",[20],[22,293,294],"anomaly-detection","classification-and-routing","employee-facing",13,[298,299,300,301,302,303,304,305,306,307,308,309,310],"Tepper Sports & Entertainment","Charlotte-Mecklenburg Schools","Chelsea School District","East Baton Rouge Parish Schools","Ministry of the Interior (France)","GAIL's Bakery","Gwinnett County Public Schools","Harry Rosen","Jumbo","Kogan","Old Cannery Furniture Warehouse","Riyadh Municipality","Utica City School District","B",{"kpi":313,"label":314,"unit":315,"n":316,"nUpTo":281,"kind":317,"value":318,"qualifier":319,"claimant":320,"organization":307,"vendorReported":159},"search-time-reduction","Search time reduction","percent",2,"reported",90,"at-least","vendor","2026-09-29",{"slug":136,"title":323,"shortTitle":324,"definition":325,"status":9,"industries":326,"functions":327,"patterns":330,"audience":331,"autonomy":332,"adoptionStage":27,"segment":333,"evidenceCount":334,"publicEvidenceCount":334,"organizations":335,"bestGrade":311,"headline":340,"lastVerified":346,"indexable":159},"AI loss prevention at self checkout and store exit","Self checkout loss prevention","AI loss prevention at self checkout uses cameras and computer vision to spot items that were not scanned and to prompt the shopper to fix them. Some retailers also check the cart against the receipt at the exit, leaving final checks to staff.",[18],[328,329],"fraud-prevention","operations",[22,293],"customer-facing","supervised-agent","store-operations",5,[306,336,337,338,339],"Kroger","Morrisons","Sam's Club","Tesco",{"kpi":341,"label":342,"unit":315,"n":343,"nUpTo":281,"kind":317,"value":344,"qualifier":319,"claimant":345,"organization":336,"vendorReported":148},"automation-rate","Automation rate",1,75,"organization","2026-10-14",{"slug":348,"title":349,"shortTitle":350,"definition":351,"status":9,"industries":352,"functions":355,"patterns":356,"audience":295,"autonomy":26,"adoptionStage":357,"evidenceCount":358,"publicEvidenceCount":358,"organizations":359,"bestGrade":311,"headline":173,"lastVerified":346,"indexable":159},"crowd-density-and-flow-monitoring","AI crowd density and flow monitoring for venues, transport hubs and pilgrimage sites","Crowd density and flow monitoring","Crowd density and flow monitoring is AI that counts people on camera feeds and flags crowding, movement against the flow and congestion points so operators can act early. It estimates how many people are in a zone and which way they move, and leaves every decision, such as opening a gate, redirecting a stream or sending staff, to the operators in the control room.",[17,353,354],"logistics-and-transportation","media-and-entertainment",[20,329],[22,293,23],"emerging",4,[302,360,361],"New York University (C2SMART Center)","Saudi Data and Artificial Intelligence Authority (SDAIA)",{"slug":363,"title":364,"shortTitle":365,"definition":366,"status":9,"industries":367,"functions":370,"patterns":371,"audience":295,"autonomy":375,"adoptionStage":27,"evidenceCount":358,"publicEvidenceCount":358,"organizations":376,"bestGrade":311,"headline":381,"lastVerified":385,"indexable":159},"threat-intelligence-collection-and-reporting","AI for threat intelligence collection and reporting","Threat intelligence reporting","Threat intelligence collection and reporting is AI that gathers threat reports, extracts the indicators and drafts summaries and briefings for a human analyst to check and send. It watches news, vendor blogs, advisories and filings against the organization's own priorities, pulls out threat actors, vulnerabilities and indicators of compromise, and writes the first version of the daily digest, the incident report or the customer newsletter.",[290,18,17,368,369],"technology","professional-services",[20],[372,373,294,374],"summarization","rag-knowledge-assistant","content-generation","copilot",[377,378,379,380],"Elastic","gematik","RH-ISAC","Sopra Steria Scandinavia",{"kpi":382,"label":383,"unit":315,"n":343,"nUpTo":281,"kind":317,"value":384,"qualifier":319,"claimant":320,"organization":379,"vendorReported":159},"handling-time-reduction","Handling time reduction",70,"2026-10-13",{"indexable":159,"reasons":387},[],[389,393,398,406,413,418,424,431,438,445,451,457,464,470,477,484,490,496,501,507,512,517,524,529,535,542,549,554,559,566,571,577,583,590,595,601,607],{"id":91,"label":390,"issuer":97,"region":98,"url":99,"description":391,"useCases":392,"indexable":159},"EU AI Act","Regulation (EU) 2024\u002F1689: risk based rules for AI systems, with obligations for high risk systems listed in Annex III and transparency duties under Article 50.",306,{"id":92,"label":394,"issuer":97,"region":98,"url":395,"description":396,"useCases":397,"indexable":159},"GDPR","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2016\u002F679\u002Foj","General Data Protection Regulation, including Article 22 on decisions based solely on automated processing.",276,{"id":399,"label":400,"issuer":401,"region":402,"url":403,"description":404,"useCases":405,"indexable":159},"iso-42001","ISO\u002FIEC 42001","ISO and IEC","global","https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F81230.html","The international management system standard for AI.",149,{"id":407,"label":408,"issuer":409,"region":236,"url":410,"description":411,"useCases":412,"indexable":159},"nist-ai-rmf","NIST AI Risk Management Framework","NIST","https:\u002F\u002Fwww.nist.gov\u002Fitl\u002Fai-risk-management-framework","Voluntary US framework to map, measure, manage and govern AI risk, with a generative AI profile.",114,{"id":93,"label":414,"issuer":103,"region":98,"url":415,"description":416,"useCases":417,"indexable":159},"UK GDPR","https:\u002F\u002Fico.org.uk\u002Ffor-organisations\u002Fuk-gdpr-guidance-and-resources\u002F","The UK's version of the GDPR, including rules on solely automated decisions.",87,{"id":419,"label":420,"issuer":97,"region":98,"url":421,"description":422,"useCases":423,"indexable":159},"dora","DORA","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2022\u002F2554\u002Foj","Digital Operational Resilience Act for financial entities: ICT risk, incident reporting and third party risk, including AI providers.",72,{"id":425,"label":426,"issuer":427,"region":98,"url":428,"description":429,"useCases":430,"indexable":159},"uk-consumer-duty","FCA Consumer Duty","Financial Conduct Authority","https:\u002F\u002Fwww.fca.org.uk\u002Ffirms\u002Fconsumer-duty","UK rules that require firms to deliver good outcomes for retail customers, including through automated channels.",50,{"id":432,"label":433,"issuer":434,"region":109,"url":435,"description":436,"useCases":437,"indexable":159},"mas-ai-risk-management","MAS AI risk management guidelines","Monetary Authority of Singapore","https:\u002F\u002Fwww.mas.gov.sg\u002Fnews\u002Fmedia-releases\u002F2025\u002Fmas-guidelines-for-artificial-intelligence-risk-management","Singapore's supervisory expectations for AI risk management at financial institutions, building on the FEAT principles.",36,{"id":439,"label":440,"issuer":441,"region":109,"url":442,"description":443,"useCases":444,"indexable":159},"apra-cps-230","APRA CPS 230","Australian Prudential Regulation Authority","https:\u002F\u002Fwww.apra.gov.au\u002Foperational-risk-management","Australian operational risk standard covering critical operations and material service providers.",26,{"id":446,"label":447,"issuer":97,"region":98,"url":448,"description":449,"useCases":450,"indexable":159},"nis2","NIS2 Directive","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Fdir\u002F2022\u002F2555\u002Foj","Directive (EU) 2022\u002F2555 on cybersecurity for essential and important entities, including telecom networks, energy and public administration.",23,{"id":452,"label":453,"issuer":454,"region":402,"url":455,"description":456,"useCases":450,"indexable":159},"pci-dss","PCI DSS","PCI Security Standards Council","https:\u002F\u002Fwww.pcisecuritystandards.org\u002F","Security standard for any system that stores, processes or transmits cardholder data.",{"id":458,"label":459,"issuer":460,"region":236,"url":461,"description":462,"useCases":463,"indexable":159},"hipaa","HIPAA","US Department of Health and Human Services","https:\u002F\u002Fwww.hhs.gov\u002Fhipaa\u002Findex.html","US rules for the privacy and security of protected health information.",21,{"id":465,"label":466,"issuer":467,"region":236,"url":468,"description":469,"useCases":463,"indexable":159},"us-sr-11-7","SR 11-7 model risk management","Federal Reserve and OCC","https:\u002F\u002Fwww.federalreserve.gov\u002Fboarddocs\u002Fsrletters\u002F2011\u002Fsr1107.htm","US supervisory guidance on model risk management, applied by banks to AI and machine learning models.",{"id":471,"label":472,"issuer":473,"region":98,"url":474,"description":475,"useCases":476,"indexable":159},"uk-atrs","UK Algorithmic Transparency Recording Standard","UK Government","https:\u002F\u002Fwww.gov.uk\u002Fgovernment\u002Fcollections\u002Falgorithmic-transparency-recording-standard-hub","Mandatory transparency records for algorithmic tools used by UK central government.",18,{"id":478,"label":479,"issuer":480,"region":236,"url":481,"description":482,"useCases":483,"indexable":159},"us-tcpa","Telephone Consumer Protection Act","Federal Communications Commission","https:\u002F\u002Fwww.fcc.gov\u002Fconsumers\u002Fguides\u002Fstop-unwanted-robocalls-and-texts","US consent rules for automated and prerecorded calls and texts; the FCC has confirmed AI generated voices count as artificial voices.",17,{"id":485,"label":486,"issuer":97,"region":98,"url":487,"description":488,"useCases":489,"indexable":159},"eu-accessibility-act","European Accessibility Act","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Fdir\u002F2019\u002F882\u002Foj","Directive (EU) 2019\u002F882: accessibility requirements for banking services, ecommerce and other digital services, applicable since June 2025.",14,{"id":491,"label":492,"issuer":493,"region":402,"url":494,"description":495,"useCases":489,"indexable":159},"fatf-recommendations","FATF Recommendations","Financial Action Task Force","https:\u002F\u002Fwww.fatf-gafi.org\u002Fen\u002Fpublications\u002FFatfrecommendations\u002FFatf-recommendations.html","Global standards for anti money laundering and counter terrorist financing that national rules implement.",{"id":497,"label":498,"issuer":97,"region":98,"url":499,"description":500,"useCases":489,"indexable":159},"solvency-ii","Solvency II","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Fdir\u002F2009\u002F138\u002Foj","Directive 2009\u002F138\u002FEC: risk based capital, governance and model requirements for insurers.",{"id":502,"label":503,"issuer":504,"region":402,"url":505,"description":506,"useCases":489,"indexable":159},"telecom-consumer-rules","Telecom consumer protection rules","National telecom regulators","https:\u002F\u002Fwww.berec.europa.eu\u002F","National rules on telecom contracts, switching, billing disputes and marketing consent.",{"id":508,"label":509,"issuer":97,"region":98,"url":510,"description":511,"useCases":296,"indexable":159},"eu-amlr","EU Anti Money Laundering Regulation","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2024\u002F1624\u002Foj","Regulation (EU) 2024\u002F1624: the single EU rulebook for customer due diligence, beneficial ownership and suspicious transaction reporting.",{"id":513,"label":514,"issuer":97,"region":98,"url":515,"description":516,"useCases":296,"indexable":159},"eu-psd2","PSD2","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Fdir\u002F2015\u002F2366\u002Foj","Payment Services Directive 2: strong customer authentication, transaction risk analysis exemptions and open banking access.",{"id":518,"label":519,"issuer":520,"region":236,"url":521,"description":522,"useCases":523,"indexable":159},"us-bsa","Bank Secrecy Act","FinCEN","https:\u002F\u002Fwww.fincen.gov\u002Fresources\u002Fstatutes-and-regulations\u002Fbank-secrecy-act","US anti money laundering law: customer due diligence, suspicious activity reports and record keeping.",12,{"id":525,"label":526,"issuer":97,"region":98,"url":527,"description":528,"useCases":523,"indexable":159},"eecc","European Electronic Communications Code","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Fdir\u002F2018\u002F1972\u002Foj","Directive (EU) 2018\u002F1972: consumer protection, contract, switching and security rules for telecom operators.",{"id":530,"label":531,"issuer":97,"region":98,"url":532,"description":533,"useCases":534,"indexable":159},"mifid-ii","MiFID II","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Fdir\u002F2014\u002F65\u002Foj","Directive 2014\u002F65\u002FEU on markets in financial instruments: suitability and appropriateness of advice, record keeping and product governance.",11,{"id":536,"label":537,"issuer":538,"region":236,"url":539,"description":540,"useCases":541,"indexable":159},"us-ecoa-reg-b","ECOA and Regulation B","Consumer Financial Protection Bureau","https:\u002F\u002Fwww.consumerfinance.gov\u002Frules-policy\u002Fregulations\u002F1002\u002F9\u002F","US fair lending rules, including specific reasons in adverse action notices, which also apply when credit decisions use AI models.",10,{"id":543,"label":544,"issuer":545,"region":98,"url":546,"description":547,"useCases":548,"indexable":159},"eba-loan-origination","EBA Guidelines on loan origination and monitoring","European Banking Authority","https:\u002F\u002Fwww.eba.europa.eu\u002Fregulation-and-policy\u002Fcredit-risk\u002Fguidelines-on-loan-origination-and-monitoring","Expectations for credit decisioning, including the use of automated models.",9,{"id":550,"label":551,"issuer":97,"region":98,"url":552,"description":553,"useCases":548,"indexable":159},"eu-idd","Insurance Distribution Directive","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Fdir\u002F2016\u002F97\u002Foj","Directive (EU) 2016\u002F97: conduct rules for selling insurance, including demands and needs testing and advice.",{"id":555,"label":556,"issuer":434,"region":109,"url":557,"description":558,"useCases":548,"indexable":159},"mas-notice-626","MAS Notice 626","https:\u002F\u002Fwww.mas.gov.sg\u002Fregulation\u002Fnotices\u002Fnotice-626","Singapore's anti money laundering and counter terrorism financing requirements for banks.",{"id":560,"label":561,"issuer":562,"region":236,"url":563,"description":564,"useCases":565,"indexable":159},"us-fcra","Fair Credit Reporting Act","Federal Trade Commission","https:\u002F\u002Fwww.ftc.gov\u002Flegal-library\u002Fbrowse\u002Fstatutes\u002Ffair-credit-reporting-act","US rules on consumer reports, their accuracy and permissible use, relevant to credit scoring and screening.",7,{"id":567,"label":568,"issuer":97,"region":98,"url":569,"description":570,"useCases":334,"indexable":159},"eu-mortgage-credit-directive","EU Mortgage Credit Directive","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Fdir\u002F2014\u002F17\u002Foj","Directive 2014\u002F17\u002FEU: creditworthiness assessment, disclosure and advice rules for residential mortgage lending.",{"id":572,"label":573,"issuer":574,"region":98,"url":575,"description":576,"useCases":334,"indexable":159},"uk-psr-app-reimbursement","UK APP scam reimbursement rules","Payment Systems Regulator","https:\u002F\u002Fwww.psr.org.uk\u002Four-work\u002Fapp-scams\u002F","Mandatory reimbursement of authorised push payment scam victims by UK payment firms, which shifts scam losses onto banks.",{"id":578,"label":579,"issuer":580,"region":109,"url":581,"description":582,"useCases":358,"indexable":159},"au-scams-prevention-framework","Australian Scams Prevention Framework","Australian Treasury","https:\u002F\u002Ftreasury.gov.au\u002Fconsultation\u002Fc2024-573813","Economy wide obligations for banks, telcos and digital platforms to prevent, detect, disrupt and respond to scams.",{"id":584,"label":585,"issuer":586,"region":587,"url":588,"description":589,"useCases":358,"indexable":159},"cbuae-ai-guidance","CBUAE guidance on AI and ML","Central Bank of the UAE","middle-east","https:\u002F\u002Fwww.centralbank.ae\u002F","UAE central bank expectations for the enabling technologies, AI and machine learning used by licensed financial institutions.",{"id":591,"label":592,"issuer":434,"region":109,"url":593,"description":594,"useCases":358,"indexable":159},"mas-shared-responsibility-framework","MAS Shared Responsibility Framework","https:\u002F\u002Fwww.mas.gov.sg\u002Fregulation\u002Fguidelines\u002Fguidelines-on-shared-responsibility-framework","Singapore's framework that assigns banks and telcos duties and loss sharing for phishing scams.",{"id":596,"label":597,"issuer":598,"region":98,"url":599,"description":600,"useCases":358,"indexable":159},"pra-ss1-23","PRA SS1\u002F23 model risk management","Prudential Regulation Authority","https:\u002F\u002Fwww.bankofengland.co.uk\u002Fprudential-regulation\u002Fpublication\u002F2023\u002Fmay\u002Fmodel-risk-management-principles-for-banks-ss","UK model risk management principles for banks, covering AI and machine learning models.",{"id":602,"label":603,"issuer":97,"region":98,"url":604,"description":605,"useCases":606,"indexable":159},"eu-mar","EU Market Abuse Regulation","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2014\u002F596\u002Foj","Regulation (EU) 596\u002F2014: insider dealing and market manipulation, including the duty to detect and report suspicious orders and transactions.",3,{"id":608,"label":609,"issuer":610,"region":236,"url":611,"description":612,"useCases":606,"indexable":159},"nyc-local-law-144","NYC Local Law 144","New York City","https:\u002F\u002Fwww.nyc.gov\u002Fsite\u002Fdca\u002Fabout\u002Fautomated-employment-decision-tools.page","Bias audits and notices for automated employment decision tools used in hiring and promotion in New York City.",1794572841392]