Risk-based, not blanket
The EU AI Act is risk and use-case based; not every AI CCTV or behavioural-analytics system is automatically high-risk.
The guide
How regulation shapes the physical layer.
Regulation is catching up with AI deployment
The EU AI Act entered into force in August 2024 and applies through a phased implementation timetable. In the UK, AI remains governed through existing law, sector regulators and developing policy rather than a direct copy of the EU Act. AI-enabled CCTV, biometrics, access control and occupancy analytics may also engage UK GDPR and sector-specific duties. The exact position depends on the use case, people affected and where the system is placed on the market or used.
This guide focuses on how infrastructure can support proportionate safeguards. It is general technical information, not legal advice, and the controller, data-protection lead or legal adviser should confirm the obligations for the proposed deployment.
The EU AI Act and UK AI regulation: infrastructure requirements
The EU AI Act uses a risk-based framework. Some biometric identification, biometric categorisation and emotion-recognition uses are prohibited, high-risk or subject to transparency duties, depending on the context and exceptions. AI-enabled CCTV or behavioural analytics is not automatically placed in one category solely because it uses AI. Classification must be assessed against the Act and current Commission guidance.
Where the AI Act or another regime requires logging, records, human oversight or security controls, the supporting network and storage should be designed to preserve availability, access control and auditability. The required retention period and log content depend on the applicable rule and system role.
For UK organisations, relevant controls may arise from UK GDPR, the Data Protection Act, surveillance guidance, equality law, sector rules and contractual requirements. The UK approach continues to evolve, so do not present EU obligations as automatically applying to a UK-only deployment.
An AI CCTV system that captures facial recognition data and stores it on a network that is not adequately segmented from other business systems creates a data protection liability, not just a technical risk.
UK GDPR requires data protection by design and appropriate technical and organisational measures. It does not prescribe dedicated cable runs. Logical segmentation, physical separation, encryption, identity controls, monitoring and comms-room security are design options whose proportionality should be assessed for the specific risk.
The network and storage infrastructure behind AI audit trails must be specified, documented and demonstrably fit for purpose.
ICO guidance on AI and surveillance
For biometric recognition, the ICO requires an Article 6 lawful basis and a separate condition for special-category biometric data, together with fairness, transparency, necessity and security. A DPIA is required where processing is likely to result in high risk. Signage and retention controls depend on the surveillance context and should be defined by the controller.
Infrastructure can support those obligations through controlled access, appropriate segmentation, encryption-capable systems, reliable time and logging, secure storage and documented change control. Dedicated physical infrastructure may be selected for higher-risk environments, but it is not a universal ICO requirement.
Key point: What compliance frameworks require at the physical infrastructure level is far less understood than their software and governance requirements.
The compliance checklist for AI infrastructure specification
- Network segmentation: place surveillance, access-control and other operational systems in an approved security zone using VLANs, firewalls or dedicated infrastructure as required by the risk assessment
- Comms room access control: restrict and record access where proportionate to the systems and data housed in the room
- Storage infrastructure: define access, encryption, backup, retention and secure deletion requirements with the controller and system provider
- Cabling documentation: maintain labels and as-built records so connections can be traced and changes reviewed
- DPIA records: document relevant infrastructure and security measures where the system’s DPIA or governance process requires them
- Transparency: provide notices and signage appropriate to the surveillance use and the controller’s ICO obligations
Biometric data: the highest-risk category
Biometric data used to uniquely identify a person is special-category data. The controller must identify an Article 6 lawful basis and a separate Article 9 condition before processing begins. Explicit consent may be suitable where people have a genuine choice, but it is not the only possible basis and may be inappropriate where consent cannot be freely given.
The infrastructure should implement the safeguards selected through the DPIA and security design, which may include encryption, restricted administration, segmentation, audit logs, resilience and controlled physical access. ACCL can deliver the agreed passive and physical-security elements, but legal compliance remains the responsibility of the controller.
Standards and sources
- European Commission: AI Act: Risk-based EU regulatory framework and implementation information
- EU high-risk AI guidance: Guidance for assessing whether a system is high-risk
- ICO biometric recognition guidance: UK data-protection requirements for biometric recognition
- ICO DPIA guidance: Assessing high-risk processing
