My research focuses on constitutional law, artificial intelligence regulation, fundamental rights, biometric technologies, and the institutional governance of emerging technologies.
A central strand of this work examines how technological systems reshape the exercise of public power, particularly in law enforcement and surveillance contexts, and how European and national legal frameworks allocate responsibility, authorisation, oversight, and accountability.
Featured research
Facial Recognition & Law Enforcement in the EU
A comparative legal tracker
My research question: how are European Union Member States regulating the use of facial recognition technologies by law enforcement authorities?
This evolving comparative research project maps the national legislative and regulatory frameworks governing facial recognition across the EU, with particular attention to the interaction between national law and Regulation (EU) 2024/1689, the EU AI Act.
The tracker examines real-time remote biometric identification, retrospective and post-remote facial identification, facial-image databases, biometric search powers, authorisation procedures, oversight mechanisms, and restrictions on law enforcement use.
Rather than classifying Member States simply according to whether facial recognition is “allowed” or “prohibited”, the project asks:
Who may use facial recognition, for which purposes, on what legal basis, subject to whose authorisation, and under which safeguards?
The project distinguishes between:
- national measures specifically adopted in connection with the AI Act;
- pre-existing national facial recognition and biometric regimes;
- post-AI Act reforms driven by other European or domestic legal frameworks;
- sector-specific restrictions on facial recognition;
- legislative proposals that would expand or restructure biometric law enforcement powers.
This distinction makes it possible to examine not only the substantive conditions governing facial recognition, but also the institutional allocation of public power: which choices are made by legislatures, governments, ministries, police authorities, prosecutors, courts, and independent supervisory authorities.
FRTracker: version 0.1 — September 2026
Current coverage: 8 EU Member States · 12 normative measures
The tracker is progressively expanded as additional Member States and legislative developments are verified against primary and official sources.
Explore the tracker → FRTtracker
Read the methodology → FRTracker’s methodology
Current research
Regulating Facial Recognition in the EU: Fundamental Rights under the AI Act
Current book project examining the regulation of facial recognition technologies in the European Union through the lens of fundamental rights and the EU AI Act.
The project investigates how biometric technologies interact with law enforcement powers, preventive policing, institutional safeguards, and national constitutional choices. Particular attention is devoted to the relationship between technological capacity and public authority, and to the legal mechanisms through which the exercise of biometric power is authorised, constrained, and reviewed.
DIGCON — Digital Constitutionalism and Fundamental Rights
Research within the FIS DIGCON project focuses on the relationship between digital regulation, public and private power, and fundamental rights.
A current strand of the project develops a Fundamental Rights Assessment Sandbox: a methodological environment for testing how instruments such as Fundamental Rights Impact Assessments, Data Protection Impact Assessments, governance models, and accountability mechanisms operate in practice.
The purpose is not to test the technical performance of AI systems, but to examine whether assessment procedures and institutional arrangements effectively identify and address fundamental rights risks.
Fundamental Rights Impact Assessment and AI Governance
A further strand of research concerns the development of Fundamental Rights Impact Assessments under the EU AI Act and their relationship with data protection, proportionality, public-sector accountability, and constitutional safeguards.
The research examines FRIA not merely as a compliance requirement, but as a mechanism for structuring and justifying decisions concerning the deployment of high-risk AI systems.
Research approach
Across these projects, the analysis combines constitutional law, EU digital regulation, data protection law, and comparative public law.
Particular attention is given to the relationship between:
technology and public power · fundamental rights and institutional safeguards · risk regulation and constitutional accountability · European harmonisation and national legal diversity
The aim is to understand not only what digital regulation requires formally, but also where legally significant decisions are made, by whom, and subject to which forms of control.
federicapaolucci.com 