The EU's landmark #AIAct was agreed at minutes to midnight yesterday. Whilst lawmakers celebrate, human rights groups are sceptical.

As someone who's spent years calling on the EU to #BanBiometricMassSurveillance via the @reclaimyourface campaign, here's my take on where they landed:

Real-time public facial recognition (RBI): disappointingly, but not surprisingly, member states resisted a full ban. The Parliament fought hard to narrow exceptions and add more safeguards, but it doesn't look like it will be enough to stop widespread biometric mass surveillance.

Real-time RBI 'safeguards': at the press conf, lead MEPs seemed to suggest there would be no possibility for retrospective authorisation. ...(cont'd)

...I really hope so, otherwise member states will have a blank cheque to ignore the (already insufficient) rules for 48 hours with impunity;

Retrospective (ex-post) public facial recognition (RBI): our expectations were depressingly low here, so it is a pleasant surprise to see some movement. The limitation of use to 'serious crimes' could be an improvement on the status quo, depending on the wording;

Biometric categorisation: the negotiators are advertising a full ban on categorising sensitive characteristics like race and gender using biometrics. This sounds great, but I'm worried that they have worded it in a way which creates big loopholes. One to watch;

Emotion recognition: a full ban on uses in workplaces and education contexts is certainly a win, but it's incoherent to make uses in policing and migration only high-risk (which is what we assume they have done). ... (cont'd)

...This tech is fundamentally flawed and based in eugenics;

Scraping for FRT databases: this 'ClearviewAI' provision is a win, bolstering data protection authorities who have stated that mass scraping of facial images is impermissible on the basis of EU law. But why only faces and not all biometric data?

Transparency: we know that member states had pushed hard to exclude biometric systems (and all policing and migration systems) from public transparency rules. So far, negotiators have been very quiet on this point, leading me to suspect the worst;

High risk biometrics: we advocated for all biometric identification systems to be at a minimum high risk, in order to protect people on the move, who are the most profoundly impacted by these systems (think eg hand-held biometric scanners). No news here, so I suspect the worst;

National security: the blanket national security exemption is very relevant for biometrics. We're likely to see countries like France claiming that their use of banned uses of biometric systems is for national security purposes, therefore enjoying a de-facto loophole;

Exports: disappointing news on exports too. It seems providers won't be stopped from exporting banned AI (like many of the abovementioned biometric systems) outside of the Union, meaning one rule for people inside the block, and another for everyone else;

We @edri will be sharing more as we get a clearer picture of the final text in coming weeks. Here's our initial PR, based on the limited information that we have: https://edri.org/our-work/eu-ai-act-deal-reached-but-too-soon-to-celebrate/

Congratulations to the MEPs and especially the unsung heroes (the advisors and APAs) who put up a bold fight. It's not where we wanted it to be, but you can clearly see how much worse it would have been if member states had gotten their way. That's a win in and of itself

Of course, a lot has to be said also for the journalists who did an incredible job of bringing some vital transparency to this deeply opaque process....

It's bizarre how much we've had to rely on the hell-hole that is Twitter to find out about a law that will affect all of us.

@ella Dunno. Does it mean that trying to guess gender from camera images will not be possible? Why is that considered dangerous?