Person detection, appearance search and facial recognition are different capabilities with different risks. Define the intended use before enabling sensitive features.
Know what the system is claiming
| Capability | Meaning | Important boundary |
|---|---|---|
| Person detection | Estimates that a person is present. | Does not establish who the person is. |
| Appearance search | Finds video with similar or specified visual attributes. | Similarity is not verified identity. |
| Face detection | Finds a region likely to contain a face. | Detection is not identification. |
| Face matching or recognition | Compares face information within a supported workflow. | A match can be wrong and requires an appropriate review process. |
| Behavior or anomaly detection | Flags a defined pattern or departure from a learned/configured baseline. | Unusual activity is not proof of wrongdoing or intent. |
| Generative descriptions | Produces text describing or helping search selected footage. | Descriptions may omit, misstate or invent details. Review source video. |
Begin with necessity and a narrower alternative
Write down the purpose and the decision the organization expects to make. Consider whether ordinary recorded video, access logs, object detection or a less identifying method can meet that purpose. Do not enable biometric or demographic features simply because the product offers them.
Have the responsible legal, privacy, HR and security personnel review the actual use, jurisdiction, notices, permissions, retention and sharing. Requirements vary by location and application. This guide is a purchasing framework, not a statement that a feature is lawful for a particular property.
Questions to resolve with the supplier
- What video, templates, embeddings, attributes and event records are created?
- Where are they processed and stored, including backups and third parties?
- Who can view, search, export or administer them?
- Can sensitive features be disabled and access limited?
- How are retention, deletion and incident preservation handled?
- Is customer information used for model training, and what controls apply?
- What testing supports performance for the intended scene and population?
- How are errors challenged, corrected and reviewed?
Human review must be meaningful
Provide reviewers with original footage, context and the possibility that the AI result is wrong. Do not use a single automated match as the sole basis for an accusation or other consequential decision. A review process should be able to reject the model’s output, document uncertainty and escalate appropriately.
Inferred appearance categories are not reliable statements of identity, gender or other personal characteristics. Avoid building operating decisions on speculative labels. Assess whether retaining those labels serves a justified purpose at all.
Protect the system and the information
Require individually assigned accounts, appropriate role boundaries, MFA where supported, protected recovery processes and a documented removal procedure for staff and provider access. Decide who authorizes exports and how they are transferred. Keep security layouts, credentials and identifiable incident evidence out of public learning materials.
Document the decision
| Record | Purpose |
|---|---|
| Use and alternatives | Explains why the feature is needed. |
| Approvals and responsibilities | Identifies who reviewed the application and owns its operation. |
| Data inventory and retention | Makes storage, sharing and deletion explicit. |
| Evaluation and limitations | Records errors, untested conditions and human review. |
| Review triggers | Defines when changes or incidents require reassessment. |
NIST’s AI Risk Management Framework is a voluntary resource for considering trustworthiness and AI risk. It is not a product approval or a substitute for applicable requirements.
Continue with the pilot workbook and integration and ownership. No independent legal or professional review of this editorial guide is claimed.
For practical camera-system planning, consult the publisher’s AI video and legacy-security upgrades reference.