Real-time facial recognition: the law from July 1 and the images that have already been tested

The Act (2026:806) and the Ordinance (2026:815) are effective from July 1, 2026. The police tested the system in June using material from the national camera platform. The review distinguishes between the thresholds of the law, test data on innocent individuals, and what is not Palantir.

Summary: On July 1, 2026, the Act (2026:806) on AI systems for real-time facial recognition for law enforcement purposes came into force, supplemented by regulation (2026:815). The Police Authority and the Security Service are permitted to use the technology if it is absolutely necessary to locate or identify a specific person in specifically enumerated situations, and only if the reasons outweigh the intrusion. Prosecutors grant permission when the purpose is to prevent, deter, detect, or enforce. The court grants permission when the purpose is to investigate or prosecute. In urgent situations, use may begin, but an application must be made within 24 hours. Each use must be reported to IMY. On June 29, 2026, two days before the law came into effect, the police stated that the system is being tested with footage from the national camera platform. This means images of individuals filmed in public camera surveillance. The police claim that the system is closed and that the data is deleted after the test. This is the authority's assertion. It is not the same as saying that the faces were never processed.

The camera reform on April 1, 2025, made it easier to install cameras. Real-time AI is the next step: not just filming, but matching faces against reference images while the stream is ongoing. Motverket's articles on camera surveillance and Palantir are additional layers. This text concerns the law, the test, and what can be requested.

What the law actually allows

The EU's AI regulation (2024/1689) generally prohibits biometric remote identification in real-time in public places for law enforcement. Member states may open exceptions. Sweden has done so in the Act (2026:806). IMY is the market surveillance authority from July 1, 2026: receiving notifications, ensuring that use complies with decisions, reporting annually to the commission.

Section 4 enumerates when the technology may be used, and only to locate or identify a specific person. The five cases are narrow: those suspected of being subjected to abduction, human trafficking, or certain human exploitation; those who are missing and suspected of being subjected to a crime; imminent risk that the person will commit a serious crime against life or physical safety; those reasonably suspected of a crime in the AI regulation's annex II with imprisonment of four years or more on the scale, for investigation or prosecution; or those convicted of such a crime, to enforce the penalty. Section 5 adds proportionality: the reasons must outweigh the intrusion for the person the measure is directed against or for some other opposing interest.

The permit is twofold. Section 6: prosecutors when the purpose is prevention, deterrence, detection, or enforcement. Section 7: the court on the prosecutor's application when the purpose is investigation or prosecution. Section 10 requires the decision to name the person, purpose, time, area, and reasons. The time must not be longer than absolutely necessary and not exceed one month. The area must not be larger than absolutely necessary. Sections 13–16 are the emergency valve: danger in delay, documented reasons, application within 24 hours, deletion if permission is denied or reasons were lacking. Section 17 gives the person identified or located in a criminal investigation the right to notification, with confidentiality exceptions that can delay the notice for up to one year and six months.

It is a coercive measure-like arrangement, not a general surveillance authority. The formulation "the police may use facial recognition from July 1" is therefore too broad. The police may use it in the enumerated cases, after permission or in emergencies with subsequent review, and must report to IMY. The rest of the street should not be matched. That is the intention of the legal text. Whether it holds is determined by how often the 24-hour valve is used and what the test data has already taught the system.

The June test: others' faces as a basis

The police's announcement on June 29, 2026, is brief and clear. The law comes into force on July 1. To develop reliable systems, they must be tested. In the tests, footage from the national camera platform is used. "This means that image material of individuals filmed through public camera surveillance will be used as a basis to test the technology." The processing of personal data is justified by future law enforcement: finding perpetrators in very serious crimes or preventing terror. The system is closed, not connected to the internet, and "after the test activities are completed, all data will be deleted."

Three things must be kept separate. Firstly: the test is not a permit under sections 6 or 7. It is the development of a system that the law will later govern. Secondly: those filmed are not the five categories in section 4. They are individuals who happened to pass by a camera that the police already have the right to use following the camera reform. Thirdly: deletion after the completion of test activities is a promise of data culling, not proof that no copies, vectors, or training results remain. The article by Motverket on illegal registry searches deals with another type of secondary use. The principle is the same. A legal original – the camera image – becomes a new processing when used to build AI.

The chain is both political and technical. On April 1, 2025, the camera regulations were changed so that more cameras could be installed with a lower threshold. The national platform collects streams. In June 2026, the same streams become test data. On July 1, 2026, the same authority receives permission to match faces in real-time against reference images. None of the steps are secret. What is missing in the police's news is volume: how many hours, how many faces, which reference registers are tested against, who approved the processing, and whether IMY has already received a notification about the test. These questions can be asked. The answers are in the registry, not in the press headline.

Three thresholds: camera, test, real-time

Keep three thresholds separate.

Palantir and Acus, which Motverket has reviewed separately, are tools for merging and analyzing data. Real-time facial recognition is another intervention: the body as a search key in the public space. They can be used in the same authority. They should not be described as the same system. Those who confuse them either make the threat greater than the law or the control weaker than it is. Both errors benefit those who do not want to show the documents.

What the reader should do with this

Frequently Asked Questions

Can the police scan everyone in a crowd from July 1, 2026?
Not according to the law text. The use must be absolutely necessary to locate or identify a certain person in the listed cases, within a defined area and a limited time.

Who grants permission?
Prosecutors when the purpose is to prevent, hinder, detect, or enforce. Courts when the purpose is to investigate or prosecute. In case of imminent danger, the police may start and must seek permission within 24 hours.

What does IMY do?
Receives notifications of use, exercises market control according to the AI Regulation, and reports to the EU Commission. IMY is not the one granting operational permits.

Is the test in June the same as real-time use?
No. The police used archive material from the camera platform to build reliability. It is a different processing than a permit to match a live stream against a named person.

Is this Palantir?
No. Palantir is an analysis and integration system. The law (2026:806) concerns biometric remote identification in real-time in public places.

Sources