1. What does AI-powered surveillance mean?

Traditional surveillance might involve a camera recording footage for someone to review later. AI-powered surveillance can go further by automatically analysing images, identifying patterns, comparing faces against watchlists, tracking activity or generating assessments about behaviour.

Examples include:

• Live facial recognition in public spaces.
• Automated number plate recognition.
• Workplace software that tracks activity, productivity or computer use.
• AI systems that analyse security footage or flag unusual activity.
• Digital services that combine location, device and behavioural information.
• Biometric systems used to verify or identify a person.

These technologies are not all the same. Their risks depend on what information is collected, how it is analysed, who uses the results and what happens to the people identified or assessed.

2. Facial recognition: convenience or constant identification?

Facial recognition can be useful for specific purposes, such as unlocking a personal device or verifying identity. In those situations, a person may knowingly participate in a one-to-one check.

Live facial recognition in public spaces is different. A system can scan the faces of many people passing a camera and compare them against a watchlist, even when most people have no connection to the investigation.

The Information Commissioner's Office explains that biometric identification involves particular data protection requirements. An organisation using facial recognition must establish a lawful basis and, where required, an appropriate condition for processing special category biometric data.

Organisations should also assess whether the system is necessary and proportionate, whether a less intrusive alternative could achieve the same purpose, and how the technology's performance and impact will be evaluated.

For police use in England and Wales, published Home Office guidance describes safeguards including public notification of deployments, human review of potential matches and deletion of unmatched biometric data under the described operational arrangements. These safeguards do not remove the need to justify each deployment.

3. What happens when the system gets it wrong?

AI systems can make mistakes. A facial recognition match may be incorrect, information may be incomplete, and a system's performance may vary between different people or operating conditions.

The consequences depend on how the result is used. A mistake could lead to additional questioning, denial of access, an unfair suspicion or a decision that affects someone's work or reputation.

Human review is important, but it must be meaningful. Staff should have the training, time and authority to challenge a result rather than treating a computer-generated alert as proof.

Organisations should test systems in realistic conditions, monitor error rates, investigate complaints and document what happens when an incorrect result causes harm.

4. The human rights question: what changes when people know they are being watched?

Surveillance can affect more than the information collected about an individual. If people believe their movements, associations or activities are constantly being analysed, they may change how they behave.

The ICO has identified a potential chilling effect associated with biometric surveillance in public spaces. People may become less willing to exercise freedoms such as expression or peaceful assembly when they feel they are being monitored.

In September 2026, Parliament's Joint Committee on Human Rights published its report, Human Rights and the Regulation of AI. It warned that the existing legal framework can be fragmented and that people harmed by AI may face gaps in accountability and redress. The committee recommended stronger, risk-based protections; these are recommendations to government, not proof that every proposed measure has become law.

The wider question is whether the benefits of a surveillance system justify its effect on the rights and freedoms of the people who are monitored.

5. Workplace monitoring: when does oversight become excessive?

Employers may have legitimate reasons to monitor workplace safety, protect systems, investigate specific incidents or meet regulatory obligations. But AI tools can make monitoring more continuous and intrusive.

Examples include software that records keystrokes, captures screenshots, tracks computer activity or attempts to infer employee performance and wellbeing.

The ICO says employers must monitor workers lawfully and fairly. They should identify a clear purpose, choose the least intrusive method that can achieve it, tell workers what is happening and assess the effect on their rights and freedoms.

For example, if an employer needs to establish whether staff have logged in at the correct time, checking system login records may be more proportionate than automatically capturing webcam images throughout the day.

Monitoring should not become an excuse to collect information about workers' private lives, particularly when they work from home. Organisations should also consider the impact on trust, dignity and wellbeing.

6. Privacy, data protection and the risk of function creep

Information collected for one purpose can gradually be used for another. A camera originally installed for safety might later be used for performance monitoring or identification. Location information collected to manage a service might be repurposed to evaluate individual behaviour.

This is often described as function creep. It can occur gradually, particularly when organisations adopt new analytical tools without reviewing the original justification.

Responsible data governance requires organisations to:

• Define a specific and legitimate purpose before collecting information.
• Identify the applicable lawful basis and any additional conditions required for sensitive biometric data.
• Collect only the information needed for that purpose.
• Explain monitoring clearly and make privacy information accessible.
• Set and follow appropriate retention periods.
• Restrict access and protect records from unauthorised use.
• Reassess risks before introducing a new purpose or capability.

Where processing is likely to create a high risk to people's rights and freedoms, a Data Protection Impact Assessment (DPIA) may be legally required. For facial recognition, the ICO advises organisations to document their justification and assess the risks associated with each deployment.

7. Disability, equality and inclusion

Surveillance technologies can affect people differently. A system may perform unevenly across groups, fail in particular environments or create additional barriers for people with disabilities.

For disabled and neurodivergent people, automated systems that interpret behaviour or attempt to infer intent may be particularly concerning if they misunderstand communication, movement or a person's response to a stressful situation.

Organisations should not assume that an automated assessment accurately describes a person's intentions, abilities or risk level. They should test for unequal outcomes, consider reasonable adjustments and provide a route for people to question or correct inaccurate information.

Equality impact assessments and meaningful consultation with affected communities can help identify risks that technical testing alone might miss.

8. Who is funding surveillance—and what should taxpayers ask?

Surveillance technology can be purchased or developed by public authorities, private businesses and technology suppliers. Public funding may support research, procurement, infrastructure, security systems or digital transformation.

Funding an AI surveillance system does not automatically establish that its use is necessary, effective or good value for money. The public should be able to examine the purpose of the investment and the safeguards attached to it.

Important questions include:

• How much public money has been committed and how much has been spent?
• Who supplies and operates the system?
• What specific problem is the system intended to solve?
• Were less intrusive alternatives considered?
• What evidence supports claims about accuracy and effectiveness?
• How are privacy, equality and human rights risks assessed?
• Who is responsible for an incorrect identification or harmful outcome?
• What information about deployments, costs, performance and complaints is published?
• What conditions would lead to the system being paused or withdrawn?

Transparency should cover outcomes as well as purchases. If a system is funded to improve safety, its performance should be evaluated against that objective, alongside the costs and harms associated with its use.

9. A responsible surveillance checklist

1. Define the purpose. State precisely what problem the system is intended to address.
2. Consider alternatives. Assess whether the same goal can be achieved with less intrusive methods.
3. Assess necessity and proportionality. Document why the proposed monitoring is justified in its specific context.
4. Protect rights from the start. Complete the appropriate data protection, equality and human rights assessments before deployment.
5. Test the system. Evaluate accuracy, limitations and performance across relevant conditions and populations.
6. Inform people. Explain what is collected, why it is collected, how long it is kept and how concerns can be raised, subject to any lawful operational exceptions.
7. Keep human accountability. Make sure trained people can challenge system outputs and make justified decisions.
8. Limit access and retention. Protect records and delete information when it is no longer needed for the stated purpose.
9. Monitor outcomes. Track errors, complaints, unequal impacts and whether the intended benefits are being achieved.
10. Be prepared to stop. Suspend or withdraw a system if its use cannot be justified or the risks are no longer acceptable.

10. The AM-MediaSpace perspective: privacy is part of responsible AI

At AM-MediaSpace, responsible AI means treating technology as an assistant, not an unquestioned authority. That principle applies to surveillance just as it applies to music creation, education, safeguarding and inclusive media.

Safety matters, but safety measures should not be treated as a blank cheque for unlimited monitoring. Organisations need clear reasons, proportionate methods, strong safeguards and ways for people to challenge mistakes.

Disabled and neurodivergent people, workers, young people and communities affected by surveillance should have a meaningful voice in decisions about technologies that may affect their freedom, privacy and everyday lives.

Conclusion: just because we can monitor people does not mean we should

AI surveillance may offer real benefits in specific circumstances. But its capabilities can also expand the scale of monitoring, make decisions less visible and create risks that are difficult for individuals to challenge.

The right questions are not only whether a system is technically capable or commercially available. We must ask whether its use is necessary, whether it is proportionate, who is accountable and how people's rights will be protected.

Public investment should support systems that demonstrate genuine benefits and respect human dignity. Privacy should not become an afterthought simply because technology makes monitoring easier.

Sources and further reading

• Information Commissioner's Office — Facial recognition technology and surveillance
• Information Commissioner's Office — Compliance with data protection principles for surveillance systems
• Information Commissioner's Office — Data protection and monitoring workers
• Home Office — Police use of facial recognition
• Home Office — Police use of facial recognition: factsheet
• House of Lords and House of Commons Joint Committee on Human Rights — Human Rights and the Regulation of AI (14 September 2026)
• Biometrics and Surveillance Camera Commissioner — Response to the live facial recognition consultation (24 February 2026)
• Data Protection Act 2018
• Human Rights Act 1998
• Equality Act 2010