Starting from September 30, 2026, Italian investigators can use artificial intelligence systems for remote biometric identification in real time. The use of these systems can be used provided that very specific conditions are respected and, in ordinary cases, only after receiving authorization from the judge. The novelty is contained in legislative decree no. 160 of 9 September 2026, which adapts Italian legislation to the European regulation on artificial intelligence, the so-called AI Act of the European Union (EU Regulation 2024/1689), and introduces specific regulations for the use of biometric recognition systems in the activity of police forces.
The provision introduces the new article 359-ter into the Criminal Procedure Code, dedicated precisely to identification and localization through systems based on the use of artificial intelligence. In practice, cameras installed in stations, airports, certain urban areas or used during large events will be able to transmit images to a system capable of analyzing biometric characteristics. These images can then be compared with an authorized database. The innovation can be used for the search for fugitives, suspicious people who have committed crimes of a certain importance, as well as for the discovery of missing people, including victims of some serious crimes, such as kidnapping, sexual exploitation and human trafficking.
Who decides when to authorize the use of the new tool
The objective of the measure is not to monitor and recognize without distinction all the people filmed by the cameras. During preliminary investigations, the prosecutor can request the use of this technology when prosecuting crimes punishable with a maximum sentence of at least four years. The system can be used to verify the identity of a person already identified, search for a fugitive or locate a person who is concretely suspected of having committed a crime.
Ordinary activation requires a reasoned provision from the judge for preliminary investigations. The document must indicate the purpose of the operation, the crimes being prosecuted and the person sought. The judge establishes the geographical area in which the system can be used and the duration of the operation, which cannot exceed the seven-day threshold. Any extensions may also last a maximum of seven days.
There are also emergency procedures, which can be triggered in some particular cases. When this is necessary, the public prosecutor can authorize the operation, but must send the provision to the judge within 12 hours to obtain validation. If this does not arrive, the results obtained cannot be used. In exceptional situations, the judicial police can instead intervene directly: they must inform the public prosecutor within 12 hours, while the latter must ask the judge for validation within the following 24 hours, with a decision that must arrive within 48 hours of the request.
Real-time biometric identification can also be used outside of investigations into crimes already committed, but only in exceptional circumstances and for prevention purposes. These include countering serious security threats, such as those linked to terrorism, searching for missing persons and finding victims of kidnapping, human trafficking or sexual exploitation.
The decree also intervenes on video surveillance in places and events characterized by particular public order and safety needs. The images of the faces can be associated with the personal data and, when applicable, with the assigned seat, using the information obtained from the electronic scanning of the tickets. In this first phase, however, no biometric data is processed: facial recognition can be activated later, after the commission of a possible crime. The information is retained for seven days and then automatically deleted.
How the AI recognition system works
Let’s now see how the recognition system technically works. First of all, after receiving authorization according to the process we described above, the judicial police identifies the cameras that can be used for the purposes of the investigation. Then the AI acquires the video stream, analyzes it and extrapolates a facial print which, like fingerprints, is unique. The system can also use some specific biometric data (such as iris) or specific physical characteristics (such as gait) to proceed with the identification of a person. The system then notifies the operators of any correspondence with what is present in the database.
Regarding the latter, we specify that the database used must be specific and limited. In fact, the decree prohibits the construction of biometric archives through data scraping, i.e. the automated collection of photographs present online. It will therefore not be possible to indiscriminately download images online to create a gigantic database to be used as needed.
Human control also remains central. Artificial intelligence does not autonomously decide whether a person is actually the one sought: it simply limits itself to reporting a possible match, but the evaluation remains the responsibility of the individual agents. The result of the identification is then placed in the prosecutor’s file.
Furthermore, the biometric data collected cannot be used without limits: they must be used exclusively for the purposes indicated in the authorization and for the established period. Once the intended period has expired, they must be deleted.
