In Sweden, a prosecutor holds the switch

Since 1 July, Swedish police have had a statute that lets them point live facial recognition at public places. The Riksdag passed it on 26 May by 317 votes to 28, a vote Biometric Update covered at the time. Three months on, it is less news than a template. The EU's AI Act bans real-time remote biometric identification by police in public, then lets member states lift the ban for a short list of purposes if they write detailed rules of their own. Sweden has written them, a worked answer to a question being asked in Edinburgh and London: what would a statute for this technology actually say?

The default in the AI Act is prohibition. Article 5 forbids "the use of 'real-time' remote biometric identification systems in publicly accessible spaces for the purposes of law enforcement, unless and in so far as such use is strictly necessary" to find victims of abduction, trafficking or sexual exploitation and missing persons, to prevent an imminent threat to life or a terrorist attack, or to locate suspects of serious offences listed in its Annex II. Each use needs prior authorisation from "a judicial authority or an independent administrative authority whose decision is binding". None of it is available unless a member state writes the detailed rules into national law, which it must then notify to the Commission within 30 days.

Sweden's Lag (2026:806) follows that structure closely. It covers the Police Authority and the Security Service, and use must be "absolutely necessary" (our translation) to locate or identify a specific person: a suspected victim of abduction, trafficking or sexual exploitation; a missing person thought to be a crime victim; someone at imminent risk of committing a serious crime that endangers life or physical safety; or someone suspected or convicted of an Annex II offence carrying four years or more. A permit must name the person, purpose, period and area, may not run longer than a month, and may cover no more ground than absolutely necessary. In an emergency the police may start without one if they apply within 24 hours; if refused, use stops and the data is deleted. Under an accompanying ordinance, every use must be reported to the Swedish Authority for Privacy Protection (IMY), which says it became the supervising authority on 1 July and will report annually to the Commission.

The clause that sets Sweden apart is who grants the permit. Biometric Update reported that a court must approve; the statute is more selective. When the purpose is to investigate or prosecute a crime, a court decides, on a written application from a prosecutor and without the public representative that Swedish courts appoint in some secret-surveillance cases. When the purpose is to prevent, stop or detect crime, or to enforce a sentence, a prosecutor decides alone, and the Riksdag's justice committee agreed with the government that a prosecutor's decision should not be open to appeal. The government's reasoning, in Proposition 2025/26:150, is that prosecutors are already treated as independent of the police when they approve covert measures for intelligence work, are on call for quick decisions, and that intelligence work is "typically alien to the general courts" (our translation).

Not everyone consulted was persuaded. The Chancellor of Justice said that, from an EU-law perspective, it appeared uncertain that a prosecutor should be the deciding body, according to the proposition's summary of the consultation. The Swedish Bar Association said courts were best placed to handle every permit, that without a public representative the individual had no adversarial process, risking conflict with fair-trial guarantees in the European Convention, and that prosecutors' decisions should be appealable. The Council on Legislation, which vets bills, did not object to the technology but called for a more restrictive view of its use; the government accepted some of its points. Article 5 leaves room for that instinct: "Member States may introduce, in accordance with Union law, more restrictive laws on the use of remote biometric identification systems." Sweden did not add a sunset clause, and plans a review about three years in.

Only the Centre Party opposed the bill outright; its 24 members, three independents and one Left Party member voted to reject it, according to the committee report's voting record. The Left and Green parties voted yes while filing reservations asking for a court to approve every use and for the law to be time-limited.

Whether the police have used it yet is not public. On 10 August Sveriges Radio's P4 Malmöhus reported that police in the southern region would start using the technology in the autumn to identify people suspected of serious crimes in real time, in a piece featuring Jimmy Lindin, who heads the region's camera surveillance and analysis section. Five days later, according to Omni's summary of an interview he gave Dagens Nyheter, the eastern police region was introducing it and the southern region would have access toward winter. We found no police announcement of a first deployment, and IMY's page, last updated on 8 July, gives no count of notifications. Emelie Pramberg Stiernströmer, a Malmö University criminologist, found only eleven studies on the method and limited evidence that it reduces crime, Sveriges Radio reported on 11 August.

Britain has no equivalent statute. The framework the Home Office has proposed for England and Wales would replace what FutureScot called "an outdated patchwork of common law powers and data protection rules" with statutory limits and a single oversight body. The Home Office consultation on a legal framework closed on 12 February, and no outcome has been published. In Scotland, where Police Scotland does not yet have the technology but British Transport Police use it, the biometrics commissioner, Brian Plastow, used his annual report to ask ministers for a bill, The Herald reported on 30 September. "LFR technology is highly intrusive and constitutes mass public surveillance, so it is my view that primary legislation is the best route to deliver safeguards capable of ensuring both public acceptance and legitimacy," he said. The Scottish Government's reply was that deployment is an operational matter for the chief constable, scrutinised by the Scottish Police Authority.

Western Australia shows what a public ledger looks like. Its police began an overt trial on 22 June, and an update first published on 22 September and revised on 6 October counts 77 deployments at 36 locations, 905,117 faces scanned, 209 alerts, eight of them incorrect, and 79 arrests. The force puts its error rate at 0.0009 per cent, measured against faces scanned. Measured against alerts, which is what an officer acts on, eight in 209 is 3.8 per cent, by our calculation.

That is what Sweden's design leaves for later. The statute is precise about who may ask and who may approve, but the evidence of what the technology does will sit in notifications to IMY and in the annual reports to Brussels that Article 5 requires, which the Commission is to publish only in aggregate, without sensitive operational data. Western Australia has published a scorecard after three months of its trial. Sweden has a fully written permit regime and, so far, no public count. When Holyrood or the Home Office drafts its own bill, the Swedish text shows how to constrain the switch. It does not yet show how often anyone has used it.