European lawmakers have promoted the European Union AI Act as a landmark regulatory framework designed to ensure that artificial intelligence is developed and deployed in line with European values such as privacy, transparency and accountability. However, a growing policy debate has emerged over whether Europe’s regulatory model contains a critical loophole: the absence of rules governing the export of sensitive AI technologies to countries outside the bloc.
The issue has gained attention after reports that a facial-recognition system developed by the Slovak technology company Innovatrics is being used in public schools in the Brazilian state of Paraná. The system reportedly identifies students through biometric facial analysis and automatically records classroom attendance, raising concerns about the global reach of European surveillance technologies.
The deployment highlights the legal and regulatory contrast between the EU’s strict domestic oversight of biometric systems and the lack of export controls governing their international use.
The AI Act, adopted by the European Union in 2024, classifies certain biometric applications as high-risk and imposes strict compliance requirements. These include transparency obligations, human oversight and limitations on the use of facial-recognition systems in sensitive environments.
European regulators have previously taken action against similar technologies when used in schools. In 2019, the Swedish Data Protection Authority fined a local school authority for testing facial recognition to monitor student attendance. Regulators concluded that the system violated the General Data Protection Regulation, arguing that children could not freely consent to biometric surveillance in a classroom environment.
A similar legal interpretation emerged in France when an administrative court halted pilot facial-recognition programs in high schools in the cities of Nice and Marseille in 2020. Judges ruled that the use of biometric identification was disproportionate and that students’ consent could not be considered valid due to the imbalance of power between schools and minors.
Despite such restrictions within Europe, current EU legislation does not include provisions that regulate the export of AI systems considered sensitive or high-risk.
During negotiations over the AI Act, members of the European Parliament proposed introducing export bans on certain technologies classified as “unacceptable risk.” The proposal was ultimately removed from the final legislative text after limited support from other EU institutions.
The absence of export restrictions has allowed European-developed technologies to be deployed in jurisdictions with different legal safeguards. In Paraná, officials report that the facial-recognition system is currently used in more than 1,700 public schools and processes attendance for close to one million students daily.
Under the system’s operational model, teachers photograph a classroom using a mobile application. The image is then analyzed by a cloud-based algorithm that compares each face to a biometric database and automatically registers students as present or absent.
According to publicly available information, Innovatrics has developed biometric systems used in more than 80 countries and has processed data linked to over one billion individuals globally. The company has also received European public funding for research involving automated biometric analysis of images.
The Brazilian deployment has raised additional legal concerns because school attendance records may affect eligibility for the country’s main social welfare program, Bolsa Família. Researchers and educators have warned that inaccuracies in biometric identification systems could potentially affect attendance records used in welfare administration.
A 2025 study conducted by researchers at São Paulo State University found that the facial-recognition system achieved an average accuracy rate of 91.1 percent, below the 95 percent performance requirement specified in the procurement contract.
Legal scrutiny of the program has also intensified within Brazil. In 2025, public prosecutor Marcos José Porto Soares filed a legal challenge arguing that the system may violate the country’s data protection framework, the Brazilian General Data Protection Law.
The case raises questions about whether students and parents provided valid consent for biometric processing, particularly after reports that earlier enrollment forms did not include an option allowing families to refuse the use of facial-recognition technology.
Authorities in Paraná have stated that the system complies with national data protection regulations and that teachers retain the ability to manually correct attendance records if identification errors occur. Meanwhile, privacy advocates and digital rights experts argue that the situation exposes a broader regulatory gap in Europe’s technology governance framework.
While the EU has positioned itself as a global leader in AI regulation, analysts say the absence of export oversight could allow technologies restricted within Europe to be deployed elsewhere under weaker safeguards. Policy experts say the debate may prompt future legislative discussions within the EU about whether AI regulation should extend beyond domestic use to include the international trade and export of sensitive digital technologies.