The turning point for AI in physical security
After years of walking the floors, joining panels, and listening closely to the industry’s biggest events, we can say with quiet certainty: AI is no longer an outsider in physical security — it’s part of the conversation now.
If you’re a security manufacturer, integrator, or solution provider, you’ve likely heard a lot about how AI transforms surveillance, automates access control, or delivers predictive insights. But if your instinct is still: “I’m not sure my customers want this, and I’m not sure I do either,” — you’re not alone. The physical security industry is, by nature and by necessity, conservative. It is built on reliability, compliance, and long hardware cycles. Innovation has always followed a strict path:
- Test;
- Certify;
- Deploy;
- Repeat.
Still, AI is unlikely to remain optional for long. Regulatory pressure is beginning to move faster than market demand, and with the introduction of the EU Artificial Intelligence Act (EU AI Act), the conversation around AI in security is now more structural and regulatory. So, ignoring it is no longer a safe strategy.
This article is your in-depth guide to what the AI Act means for physical security and how to approach compliance confidently, even if you only plan to adopt AI.
Why so many in security are still unsure about AI
People in physical security have good reason to be cautious about AI. Many AI systems in the market are overhyped, promising capabilities that rarely align with real-world performance. Clients operating in high-stakes environments such as critical infrastructure, healthcare, or public services are rightly skeptical. They want provable safety, consistent accountability, and full system transparency.
Adding AI is not always simple. It can introduce new layers of complexity and create opportunities for things to go wrong. That skepticism is valid. Physical security has always been about risk management and operational stability. But the EU AI Act shifts the landscape from “wait and see” to “prepare and prove.”
Adding AI can introduce new layers of complexity and create opportunities for things to go wrong
What the EU AI Act really is
The EU AI Act is the world’s first comprehensive AI law. It classifies AI systems based on their risks to fundamental rights, safety, and social trust. If you use, sell, or run an AI system in the European Union, the Act applies to you — no matter where the system was developed.
The regulation introduces four levels of AI system risk:
- Minimal-risk applications, like spam filters, are left mostly unregulated.
- Limited-risk systems, such as customer-facing chatbots, require transparency measures like disclosing that users are interacting with AI.
- High-risk systems, which include biometric access control, AI-based surveillance, and analytics used in public safety, must comply with strict requirements.
- Unacceptable-risk systems, which are considered a clear threat to people’s safety, livelihoods, and rights, are banned altogether.
For manufacturers and integrators operating in physical security, this means that any solution involving biometric authentication, behavioral analytics, or AI-driven threat detection sits solidly within the high-risk category. As such, these systems are now subject to various non-negotiable obligations.
What is the current timeline
The rollout of the EU AI Act is structured to give businesses time to align their systems and processes with the new requirements.
- The Act officially came into force on August 1, 2024.
- As of February 2025, the EU has officially banned certain AI practices, like social scoring and subliminal manipulation because they are considered too harmful to allow.
- By August 2025, obligations for general-purpose AI systems, such as foundational language models, will take effect.
- By August 2026, the full set of rules for high-risk systems will take effect, including most physical security applications with AI involved.
If your product roadmap includes a release or major update in 2026 or beyond, you need to be working on compliance NOW. Compliance can no longer be treated as a retroactive fix and must be embedded in the architecture and lifecycle of the system.
Penalties for non-compliance
The EU is enforcing the AI Act in much the same way as it does the GDPR, and the fines for breaking the rules are just as high.
- Organizations found to use banned AI practices can face penalties of up to €35 million, or 7% of global annual turnover.
- High-risk system violations carry penalties of up to €15 million or 3% of global turnover.
- Failures in documentation or transparency can incur fines of up to €7.5 million, or 1%.
Transparency or documentation failures can cost up to €7.5M
These are not hypothetical risks. The EU has demonstrated its willingness to investigate and fine companies under GDPR, and the AI Act is expected to follow a similar trajectory, starting with sectors that intersect most directly with public safety and individual rights, including physical security.
Why physical security is the front line
Physical security is about keeping people safe and protecting the places and assets that matter. It relies on trust, predictability, and clear lines of accountability. AI systems in this domain do not support functions, they are often the frontline decision-makers.
Real-world applications include:
- Biometric identity verification at secure entrances
- Intelligent video analytics that flag unusual activity or motion
- Automated systems that determine whether to trigger alarms or deploy security personnel.
These applications, even when simple in design, carry substantial risk if misused, misunderstood, or poorly managed. That’s why the EU AI Act treats them as high-risk. These systems are not experimental but operational, and the consequences of failure extend beyond technical disruption to public safety and legal liability.
What does compliance actually involve
Complying with the EU AI Act requires a product and engineering strategy that aligns with regulatory expectations from the earliest stages of design. Companies need to put strong safeguards in place and make sure the data they use is accurate and well managed. They also need to clearly explain how their AI systems work, including:
- What decisions the AI make?
- How can people review them?
- How can people override them?
Human oversight is a core requirement, particularly in any use case where AI decisions might impact individual rights or safety.
Systems also need to keep detailed records of:
- What the AI decided;
- What data it used;
- How it reached that decision;
- Whether a person stepped in to help make the call.
The regulation also warns against collecting more personal data than necessary and urges using only the details needed for each task.
Human oversight is a core requirement, particularly in any use case where AI decisions might impact individual rights or safety
CoreWillSoft’s practical framework for AI compliance
At CoreWillSoft, we work closely with manufacturers, integrators, and solution providers across the physical security industry. Over the years, we’ve seen how challenging it can be to balance regulation, system performance, and business priorities, especially when it comes to adopting AI. So, when it is a part of the equation, we do not treat compliance as a patch, but as a design principle. In doing so, we align with the EU AI Act and the principles of the EU Cyber Resilience Act (CRA), so the solutions we help create are both AI-compliant and cyber-resilient throughout their lifecycle.
Based on what works in the field, we suggest designing systems with AI in them around five key foundations:
- We strongly recommend separating AI logic from the system core and using modular AI components. This way, AI modules can be tested, certified, updated, or even removed without disrupting core system functions. This approach simplifies integration, supports risk containment, and makes regulatory adaptation much easier.
- We advocate for designing workflows where AI supports human decision-making, not replaces it. Operators should have visibility into what the AI does, why it made a decision, and where they can step in. This includes the ability to override it, as human oversight in sensitive cases is now a key EU AI Act requirement.
- We advise setting up a logging system that captures actions, inputs, timestamps, and any human intervention, so compliance teams have full transparency when needed. Every decision the AI makes, and every data point it uses, should be traceable.
- We recommend keeping data exposure to a minimum by using, e.g., attribute-based access, local processing when possible, and only handling full personal records when truly necessary. This approach reduces compliance risks, protects user privacy, and makes it easier to meet regulatory requirements.
- We recommend designing systems with remote servicing, over-the-air updates. Just as important, they should allow backend teams to remotely adjust or disable AI functions when required, adding an extra layer of operational control beyond the operator-level oversight required by the EU AI Act.
What the industry is saying
At The Security Event 2025, industry voices were clear:
Manufacturers feel pressure to adopt AI, but customers want it used carefully and responsibly.
Many companies are stuck in testing, unsure whether moving from the lab into the real world is safe or even allowed. The emerging consensus is that AI must be explainable, modular, and subject to oversight. One panelist captured the tension well: “Don’t make me send guards out for hugs. But don’t let me miss a real threat either.”
That’s what compliance should protect: functionality that improves safety, not vice versa.
What you can do right now
- Security manufacturers and solution providers should begin by auditing their current and future product lines for AI functionality. This includes not only obviously intelligent features, but any automation, analytics, or decision logic that replaces or filters human judgment.
- Next, companies should intentionally design their architecture to be AI-powered from the ground up, with all AI components isolated and modularized. This makes future updates simpler, helps the system keep up with new regulations, and lets it get the most out of its AI capabilities. It is also a nice idea to start improving internal documentation now, especially regarding how data is used and how decisions are made.
- Engaging both engineering and legal teams in the design process is important too. Compliance should be a shared responsibility from the first architecture decision to the final deployment.
- Finally, companies should treat this moment not as a challenge, but as a chance to lead. The companies that invest in compliant, explainable AI today will be the ones customers trust tomorrow.
Final thought
The EU AI Act is not a barrier to innovation, but a call to accountability. In an industry that deals with life safety, infrastructure protection, and citizen privacy, that should not be a surprise. Whether your systems already use AI or you’re cautiously considering it, now is the time to build the foundations of trust, traceability, and oversight. Doing so will make your systems better, your employees more informed, and your customers more confident in what you deliver.
