Italy opens the door to police facial recognition with AI: what could be transferred to Spain

As of September 7, 2026, the Organic Law Project for the proper use and governance of artificial intelligence is in the Congress of Deputies, in the amendment phase to the text in committee. It has not yet been debated in Plenary nor sent to the Senate, so the parliamentary process remains open and the law is not definitively approved.

1. Basic identification of the project

In the parliamentary database, the project appears as:

• Short title: For the proper use and governance of artificial intelligence.
• Origin chamber: Congress of Deputies.
• Type of initiative: Organic Law Project from the Government.
• File number in Congress: 121/000096.
• Legislature: XV legislature (current).

The processing record itself indicates that the project is pending, with an extended amendment deadline, which confirms that the procedure has not yet moved on to the stages of drafting committee report, committee opinion, and Plenary.

2. Background in the Executive and submission to Congress

Before reaching Parliament, the regulation followed a prolonged path in the Government:

• 03/11/2025 – The Council of Ministers authorizes the urgent processing of the Preliminary Draft Law for the proper use and governance of artificial intelligence and publicly presents it, as recorded in the official reference and notes such as that from the Ministry for Digital Transformation and Public Function (note of 03/11/2025).
• 03/17/2025–03/26/2025 – The public hearing on the preliminary draft is held (open consultation on the Ministry's participation portal), receiving external contributions.
• 03/25/2026 – The Economic and Social Council issues Opinion 03/2026 on the preliminary draft (CES document).
• 05/26/2026 – The Council of Ministers approves in second round the Organic Law Project for the proper use and governance of artificial intelligence and agrees to send it to Congress, as detailed in the Ministry's official note (note of 05/26/2026).

From that moment, the initiative ceases to be a preliminary draft and is processed as an organic law project in the General Courts.

3. Main milestones in Congress

• 05/28/2026 – Registration of the project in the Congress of Deputies.
• 06/12/2026 – Publication of the text in the Official Bulletin of the General Courts (Congress Section), formally opening its parliamentary processing as an organic law project.
• A first deadline for submitting amendments to the articles is opened, initially set until 06/30/2026.
• The Congress Board subsequently agrees to extend that amendment deadline several times, the last until 09/09/2026, as recorded in the official chronology of file 121/000096.

Press reports coincide with this scenario: for example, the analysis on the Congress calendar until Christmas published by Demócrata on September 1, 2026, states that the AI law project “starts September still in the amendment phase in the Economy, Commerce and Digital Transformation Committee, with the deadline extended” until early September (Congress calendar 2026).

4. Current phase and pending steps

With all available information, the status today can be summarized as follows:

• The project is in Congress, assigned to the Economy, Commerce and Digital Transformation Committee.
• The processing is in the text amendment phase, with the submission deadline extended until September 9, 2026.
• The drafting committee that must prepare the compromise report based on the amendments has not yet been constituted, nor is there a committee opinion.
• There has been no debate or vote in the Plenary of Congress on this project, nor therefore referral to the Senate.
• Consequently, the law is not approved, nor is it published in the Official State Gazette as an Organic Law in force.

The expected next steps, once the amendment deadline closes, would be the constitution of the drafting committee, approval of a committee opinion, debate and vote in the Congress Plenary, sending to the Senate and, finally, return to Congress if applicable, royal sanction, and publication in the BOE.

Until that entire process is completed and the regulation appears in the Official State Gazette as a promulgated organic law, it can be stated that the Organic Law Project for the proper use and governance of artificial intelligence remains in parliamentary processing, in a relatively early phase focused on the submission and negotiation of amendments.

In the Italian system, the giudice per le indagini preliminari (GIP) is the judge who oversees the preliminary investigation phase and, therefore, the use of especially invasive investigative means. Following the approval of legislative decrees to implement the European AI Law and its specific adaptation to the police field, the use of facial recognition and other biometric processing by security forces is subject to a series of material limits and a prior judicial control in which the GIP plays a central role.

Recent regulatory framework

As reported by Demócrata in the article Italy gives green light to two decrees to control the use of AI in police work, Giorgia Meloni's Government has approved two legislative decrees that:

• Authorize the use of AI by the Police in areas such as biometric controls and video surveillance “provided there is human supervision.”
• Require that such use be backed by a judicial order.
• Prohibit large biometric databases and rule out mass surveillance or a generalized “Big Brother” system.

At the same time, the Garante per la Protezione dei Dati Personali (Italian data protection authority) has approved the draft legislative decree adapting Italian legislation to the AI Act and specifically regulating:

• The use of AI systems by police forces.
• The conditions and guarantees for biometric data processing.
• The use of remote biometric identification technologies.

The Garante emphasizes that the automated and generalized processing of biometric data of those accessing public places or events is not compatible with the AI Law and that only ex post facial recognition for specific searches is allowed, on already acquired records and for a concrete operational need. Furthermore, it requests that the new article 359-ter of the Code of Criminal Procedure, dedicated to biometric identification, expressly include the prohibition of using databases obtained through indiscriminate scraping or in violation of data protection regulations.

Specific powers of the GIP

Against this background, the powers of the preliminary investigations judge regarding police facial recognition are structured around several axes:

• Prior authorization of measures
  The decrees require that the use of AI systems by the Police be “backed by a judicial order.” In the preliminary investigations phase, this control typically corresponds to the GIP, who must assess whether the use of facial recognition or biometric databases is:
  • Necessary for the specific criminal investigation.
  • Proportional to the seriousness of the crime and the interference with fundamental rights.
  • Compliant with the European AI Act framework, which reserves real-time biometric identification for exceptional cases and under strict safeguards.
• Material, spatial, and temporal delimitation
  Inspired by the AI Act approach (which, according to the Spanish electronic administration portal, requires delimiting place and time and having prior judicial or administrative authorization for real-time biometric identification), the GIP must:
  • Specify the scope: which persons or targets may be subjected to facial recognition, in which spaces (e.g., a specific access, a stadium, a perimeter area) and during what period.
  • Distinguish between real-time and ex post uses, practically authorizing mostly ex post analysis of already obtained images and only allowing near real-time scenarios in cases of extreme gravity (search for missing persons, prevention of attacks, etc.), according to the AI Act exceptions.
• Control of databases and sources
  In light of the Garante's observations, the GIP must verify that:
  • The Police do not resort to databases of illicit origin, such as massive collections through indiscriminate scraping of internet images or video surveillance.
  • The biometric databases used meet quality and accuracy standards, given the evidentiary relevance and risk of false positives.
• Imposition of additional conditions and guarantees
  The GIP may condition the authorization on safeguards such as:
  • Effective human supervision over algorithmic results.
  • Detailed recording of biometric searches performed.
  • Limited retention periods and destruction of irrelevant data.
• Ex post control and rights protection
  If it is alleged that facial recognition has been used outside the established limits (e.g., mass surveillance, expansion of targets, use of illicit databases), the GIP may:
  • Order the cessation of the measure during the investigation phase.
  • Assess the possible illegality of the evidence obtained, which may lead to its procedural inadmissibility before the trial judge.

Structural limits

Overall, the framework in force as of 2026 configures the GIP as a guarantor that police facial recognition is used only exceptionally, focused, and controlled, vetoing:

• Mass or indiscriminate biometric surveillance in public spaces.
• Large facial databases built without legal basis or through scraping.
• Any use not justified by a concrete operational need and backed by a motivated judicial order.

Thus, the preliminary investigations judge becomes the main filter to reconcile the technological powers of the Police with the enhanced protection of biometric data and privacy required by the GDPR, the AI Act, and the Italian implementing regulations.

Based on the available institutional and press information, the landscape is as follows: in Spain, beyond the future state AI Law and the European framework, there are not yet autonomous communities that have approved a specific law on “police use of AI”; regional regulations are limited to generic references to “technical means” or video surveillance. In Europe, the clearest regulation is at the European level (AI Regulation) and some countries have begun to develop specific rules or practices, notably Italy, France, Germany (at the Länder level), and the Netherlands.

1. Common European framework: EU AI Regulation

The European Artificial Intelligence Act (Regulation (EU) 2024/1689) applies to all Member States and contains rules directly relevant to police use:

• It prohibits certain AI practices considered of “unacceptable risk,” including:
  • Predictive policing when based solely on a person's profile or evaluation of their characteristics, as summarized by the Spanish Administration portal in this note.
  • The creation of facial recognition databases through indiscriminate scraping of facial images from the Internet or surveillance cameras.
  • AI systems that biometrically classify people by sensitive traits (race, religion, sexual orientation, etc.).
• Police use of remote biometric identification in real time in public spaces is in principle prohibited, except for very limited exceptions (selective search for a missing person, prevention of attacks, etc.), with judicial authorization and strict time and place limits.

The Council of the EU emphasizes in another communication that the law also prohibits predictive police surveillance based on profiles and certain uses of biometric data to classify people. This Regulation is, de facto, the common European framework on AI applied to security and policing.

2. Spain and autonomous communities

In the consulted normative base, there are no, to date, regional laws that regulate in a specific and detailed manner:

• Police facial recognition.
• AI-based predictive crime analytics.
• Or algorithms supporting criminal investigation.

There are laws on coordination of local police or regional police (Andalusia, Valencian Community, Madrid, Catalonia, etc.) that:

• Regulate the structure, functions, armament, and “technical means” of the police.
• Refer to providing forces with “modern and adapted resources to new needs,” as Law 6/2023 of Local Police of Andalusia does when referring to technical means and video surveillance.

But in the analyzed passages, no articles have been identified that expressly typify or limit the use of artificial intelligence by regional or local police; in practice, they rely on:

• State legislation on data protection and citizen security.
• The European AI Regulation, which sets the “red lines” (prohibitions and high-risk systems).

3. European countries with specific rules or practices

• Italy. According to the Demócrata article “Italy gives green light to two decrees to control the use of AI in police work”, the Council of Ministers has approved two legislative decrees that:
  • Authorize the use of AI systems by the police in areas such as video surveillance and biometric controls.
  • Require human supervision and coverage by judicial order.
  • Prohibit mass surveillance and the use of large biometric databases.
  The Italian government itself presents them as the first “national framework law” that implements the exceptions of the European AI Regulation in the police field.
• France. There is not yet an autonomous “police AI law,” but the data protection authority (CNIL) has set very strict limits on police facial recognition. In decision MED‑2024‑150, available at Legifrance, the CNIL recalls that:
  • The legislator has not authorized biometric identification devices (including facial) in public spaces for police purposes.
  • The use of facial recognition modules in video analysis software by police and gendarmerie has been considered illegal and must be deactivated or replaced with versions without that function.
• Germany (federal states). Reports from the data protection commissioners of Saxony and Lower Saxony, accessible in this report on Saxony and this note on Lower Saxony, show that:
  • Some Länder have deployed systems like Peris, which allows automated biometric comparisons of video images by the police.
  • Data protection authorities argue that there is not yet sufficient legal basis for automated real-time biometric identification in public spaces, in light of the AI Regulation, and call for strict limits on “smart video surveillance, remote biometric identification, and automated data analysis.”
  That is, police law reforms are underway but under intense scrutiny to avoid conflicts with the prohibitions of the European Regulation.
• Netherlands. The Dutch Data Protection Authority has issued several documents (for example, the “Third advice on the supervisory structure for the AI Act”) where:
  • It details how prohibitions in the AI Regulation regarding biometric identification for law enforcement, predictive policing, mass extraction of facial images, etc., should be supervised.
  • It emphasizes that AI systems used by the police are classified as prohibited or high risk and must comply with very strict requirements.
  This is more of a supervisory framework than an autonomous criminal-police law, but it has direct impact on police practices.

In summary, the key reference today is not so much national or regional sectoral laws on “police AI,” but the EU AI Regulation, which sets very precise prohibitions and conditions, and a series of national rules and decisions (Italy, France, Germany, Netherlands) that are beginning to implement it in police practice.