Cognitec in policing

Legal basis

The Crime and Policing Act 2026 (Royal Assent 29 April 2026), section 181, creates an authorised person gateway for police access to DVLA driver records including the photograph, via the Law Enforcement Data Service, expanding access beyond road traffic matters.

Oversight

Biometrics Commissioner; ICO, which reported a bias finding and is monitoring a planned algorithm replacement; subject of long-running custody image retention criticism

The Home Office states the Act does not itself create a process for searching the DVLA image gallery to identify unknown individuals, and that which non-police galleries may be searched is deferred to a forthcoming Police Reform Bill. Over 25,000 retrospective facial recognition searches are run each month against a pool of more than 19 million custody images. The statutory position changed in 2026 and any account citing only the absence of a framework is now stale. The Crime and Policing Act 2026 opened police access to DVLA driver records including photographs; the Lords rejected an amendment to block facial recognition searching of the roughly 50 million image DVLA database by 123 votes to 40 in March 2026. The substantive framework for which galleries may be searched has been deferred to a further bill. The National Physical Laboratory published an accuracy and equitability evaluation of Cognitec FaceVACS-DBScan ID v5.5 in December 2025, and the ICO's 18 August 2026 statement is explicit about the finding: the algorithm's bias increases the likelihood of incorrect matches for people in some demographic groups. The Home Office and NPCC have put mitigations in place (staff training, oversight reporting, equality impact assessments) alongside plans to replace the algorithm. The ICO continues to engage with HMICFRS, the Home Office and NPCC on the replacement and is reserving the right to take further regulatory action if warranted. A Home Office consultation on the facial recognition framework closed on 12 February 2026 with a government response promised within 12 weeks. That response remained unpublished more than three months past its due date as of August 2026; a July 2026 Lords session shows the Home Secretary being directly pressed on the delay.

Source: Biometrics Commissioner annual reports · last checked 2026-08-26

Legal basis

Contested. The Code of Criminal Procedure restricts real-time TAJ checks to specially authorised officers during an investigation; independent reporting finds the database used for on-the-spot street identity checks outside that basis.

Oversight

CNIL (French data protection authority); internal Gendarmerie monitoring tool 'Citar' introduced December 2025; no dedicated facial recognition legislation exists

French police and gendarmerie officers carry handheld devices, branded NEO (nouvel equipement operationnel), that run facial recognition software developed by the German company Cognitec, matching photographs taken in the field against the TAJ criminal records database. Facial matching became available on these devices from 2025; a desktop version had existed since 2022. TAJ (Traitement des Antecedents Judiciaires) holds around 17 million records on arrested and accused individuals, 48 million on victims, and roughly 9 million frontal photographs, operated by the Ministry of the Interior. Queries against it rose from 375,000 in 2019 to nearly 1 million by 2024. An investigation by the non-profit outlet Disclose, published in partnership with La Quadrature du Net in March 2026, found the database being used for real-time identity checks on public streets, which the French Code of Criminal Procedure does not permit: TAJ may only be used by specially authorised officers during an investigation, not for on-the-spot verification. Disclose spoke to six individuals in Paris, Marseille and Lyon photographed by police in the preceding four years, in some cases without consent, including one person scanned at a pro-Palestinian protest in Paris. A 2023 report from the police's own internal inspectorate, the IGPN, had already found the database was 'very frequently used on public streets during identity checks'. The Gendarmerie disputes the characterisation. An editorial in its own newspaper, L'Essor de la Gendarmerie, states the tool is limited to criminal investigations, identity checks where a person lacks or refuses identification, and intelligence gathering, describing its purpose as an investigative aid rather than mass surveillance. An internal memo states that results 'must be carefully reviewed by users' and 'must not be considered as evidence'. The Gendarmerie states access is restricted to judicially authorised officers, excluding volunteer deputy gendarmes and reservists. TAJ is monitored by the French data protection authority CNIL, and the Gendarmerie introduced an internal monitoring tool called Citar in December 2025 intended to reduce unauthorised access. La Quadrature du Net, which has previously and unsuccessfully sued over French police use of facial recognition, argues there is no legislation specifying how the technology may be used, by whom, or under what oversight, and that equipping thousands of officers with it amounts to surveillance authorised by the state without a legal framework. This site records a genuine dispute between an internal memo describing careful, restricted use and independent reporting describing frequent use outside the permitted legal basis, rather than resolving it.

Source: Disclose; La Quadrature du Net; Biometric Update; L'Essor de la Gendarmerie · last checked 2026-08-30