France led push to weaken EU AI Act surveillance bans before February deadline

When the European Artificial Intelligence Act takes effect on 2 February, it will carry a set of exemptions that effectively permit governments to deploy AI-powered surveillance in public spaces, at borders and against political or religious minorities, provided they invoke national security. The loopholes were not accidents of drafting. They were engineered in closed-door negotiations by France, backed by a coalition of member states, and ratified in the final weeks of 2023 before the European Parliament could mount effective resistance.

The national security exemption that rewrote the rules

The AI Act's core prohibition bars the use of AI systems for biometric identification in publicly accessible spaces. But Article 2.3, inserted at the insistence of Paris, removes all restrictions, including the requirement for national agency approval or public registration, whenever a member state deems surveillance necessary on national security grounds. The exemption applies regardless of the entity carrying out the activity, meaning private contractors or even foreign governments could operate the systems on behalf of European police forces.

A jurist from the centre-right European People's Party group in the Parliament, speaking anonymously, called the provision unconstitutional. "This article [2.3] goes against every constitution, against fundamental rights, against European law," the jurist said. "France could for instance ask the Chinese government to use their satellites to make pictures and then sell the data to the French government." The text was finalised despite warnings from the European Court of Justice, which ruled in 2020 and 2022 that French telecommunications firms had breached EU law by retaining customer data on national security grounds. The court held that private companies involved in such activities remain subject to EU law and that the national security exception must be interpreted restrictively.

How France engineered the amendments

Investigate Europe obtained more than 100 documents from meetings of the Committee of Permanent Representatives (Coreper), where ambassadors from the 27 member states negotiate Council positions. The minutes show France's representative was unequivocal at a session on 18 November 2022: "The exclusion of security and defence ... must be maintained at all costs." The reference was to a proposal limiting public-space surveillance to military authorities. Paris wanted the exemption extended to all law enforcement and border agencies.

A French government document sent to the Council on 24 November 2023 argued it was "very important to preserve the possibility of searching for a person... expressing a religious belief or political opinion, such as the wearing of a badge or accessory, when that person is involved in violent extremism or presents a terrorist risk." The language effectively allows biometric systems to target individuals based on protected characteristics. Plixavra Vogiatzoglou, a postdoctoral researcher at the University of Amsterdam, said the exemption contradicts the Court of Justice jurisprudence: "The EU court said that private companies involved in national security activities are not exempted, they are still subject to EU law, and the national security exception has to be interpreted very restrictively and the member state has to really justify."

The coalition that backed Paris

France did not act alone. At subsequent Coreper meetings, ambassadors from Italy, Hungary, Romania, Sweden, the Czech Republic, Lithuania, Finland and Bulgaria all expressed support for the French position. Greece, facing sustained migration pressure, demanded an explicit exclusion for prisons and border zones, lobbying for real-time biometric analysis in public spaces on citizens, refugees and asylum seekers. Cyprus, Estonia, Latvia and Hungary joined France in pushing to expand the list of crimes that justify real-time facial recognition beyond the 16 specified offences, which already include a catch-all reference to "environmental crime".

The Spanish presidency of the Council, which held the rotating chair in the second half of 2023, was eager to close the file before the European elections and before Viktor Orbán's Hungary assumed the presidency in July 2024. Spain itself uses predictive policing algorithms, one of only two EU countries to admit doing so alongside the Netherlands. At a Coreper gathering in October 2023, the Spanish ambassador called predictive policing "an important tool for the effective work of law enforcement." Ireland, the Czech Republic and Finland echoed that view a month later, arguing against a complete ban.

Biometric surveillance and the end of anonymity

The Act bans biometric categorisation systems that infer race, political opinions, religious beliefs, sexual orientation or trade union membership. But the police exemption allows authorities to collect image data on any individual or purchase it from private companies. Real-time facial recognition can be deployed when "strictly necessary" for investigations into the 16 listed crimes. The European Digital Rights Network warned in 2020 that such deployment in public spaces "means the end of anonymity in those places." The legislation also permits the cross-referencing of millions of faces against national databases, a capability that did not exist when the General Data Protection Regulation was adopted.

France's domestic record foreshadowed the European outcome. In May 2023, the French Constitutional Council sanctioned AI-powered video surveillance for the Paris Olympics, the first such authorisation in the Union. Amnesty International described the move as "a serious threat to civic freedoms and democratic principles." That precedent now serves as a template for the bloc.

Emotional recognition and predictive policing: two carve-outs

Emotion recognition systems, technologies that claim to interpret moods or feelings, are prohibited from 2 February in workplaces, schools and universities. Employers cannot use them to assess staff satisfaction or retention risk; retailers cannot track customers to analyse buying intent. Yet the same systems are explicitly permitted for all police forces, immigration authorities and border agencies. At a Coreper meeting on 29 November 2023, Denmark's ambassador argued any ban "must be proportionate and should only apply if there is a risk of discrimination." The Netherlands, Portugal and Slovakia took a similar stance, all described in the minutes as "generally critical" of widening prohibitions to include law enforcement.

Predictive policing, algorithmic forecasting of who might commit a crime, survived the negotiations with a human oversight requirement. The final text allows the systems provided a person reviews the output. A source in the European Parliament involved in the talks, speaking anonymously, reflected: "This battle was one of the toughest and we lost it."

The self-certification loophole

High-risk AI systems are supposed to undergo independent conformity assessment, registration in a European database and a fundamental rights impact assessment. But an article added during the final trilogue, the three-way negotiation between the Council, Parliament and Commission, allows providers to fill in a self-certification and decide for themselves whether their product qualifies as high-risk. An internal working document from the European Parliament's legal service questioned the decision: "A high level of subjectivity left to companies, which appears to be in contrast with the general aim of the AI Act, to address the risk of harm posed by high-risk AI systems."

The French delegation made the commercial rationale explicit at a Coreper meeting on 15 November 2023, warning that if wider use of the technologies was not permitted, "there was a risk that companies would relocate their business to regions where fundamental rights did not play a role." France is home to Mistral AI, one of the continent's most prominent foundation model developers, and has positioned itself as a champion of European technological sovereignty.

What the courts have already said

The national security exemption faces immediate legal uncertainty. The Court of Justice has established that member states must justify any derogation from EU data protection law on a case-by-case basis, and that private actors do not inherit the state's exemption. Vogiatzoglou noted that the 2020 and 2022 rulings concerned French telecoms firms retaining metadata for intelligence services, a narrower context than the blanket surveillance powers the AI Act now confers. Whether the new legislation can withstand scrutiny in Luxembourg remains an open question.

Anton Ekker, a Dutch lawyer specialising in digital rights, takes a different view. "I'm very critical about the use of algorithms by a state. However, the narrative to say that because there are exceptions then things are allowed, it's not correct," he said. "There are many national, constitutional laws, protecting fundamental rights." But Professor Rosamunde van Brakel of the Vrije Universiteit Brussels countered that oversight mechanisms rarely prevent harm: "In most cases regulation and oversight ... only kicks in after the violation has taken place, they do not protect us before. Moreover AI applications used in the public sector often affect vulnerable populations who are not empowered to launch a complaint or trust that a complaint will be taken seriously."