Across Europe, police forces are gradually acquiring powers to deploy artificial intelligence (AI). In November 2025, the federal states of Baden-Württemberg and North Rhine-Westphalia amended their state police laws to enable or expand the use of the US intelligence software Palantir – and thus triggered debate on AI use. In neighbouring France and Luxembourg, legislative debates have not yet escalated to the full regulation of automated data analysis, with both countries prioritising the authorisation of AI-supported video analysis in public spaces.

While the regulatory details may differ, the underlying dynamic is the same: legislatures are progressively expanding AI-assisted police powers without a coherent regulatory concept, exposing fundamental rights to uneven and unnecessary risks. Yet the use of AI by the police creates a variety of threats to the privacy and personal data protection of those (unwittingly) affected. There is also concern that new technologies, which law enforcement agencies do not control alone, will increase dependence on companies with sometimes questionable reputations. A joint regulation of police AI could both mitigate these risks and send a strong signal of Europe’s independent, rights-centred path distinct from that of the US.

Constitutional requirements for the use of automated data analysis

In Germany, the states of Hesse (in 2018 with Section 25a HSOG) and Hamburg (in 2019 with Section 49 HambPolDVG) were the first to establish powers for automated data analysis in their police laws – and constitutional complaints were filed against them. In February 2023, the BVerfG ruled on Hamburg (1 BvR 2634/20) and Hesse (1 BvR 1547/19), establishing the requirements for police powers to perform automated data analysis (see here and the following references). In doing so, the court demonstrated in an almost textbook manner that the severity of the interference with fundamental rights by automated data analysis can vary depending on the legal framework (para. 75 ff.). The legal requirements for constitutionally compliant data analysis must correspond to the respective severity of the interference, which the challenged provisions did not do.

This requires the interaction of various factors to be taken into account, such as the type and scope of the data involved (para 79 et seq.) and the methods of analysis and evaluation used (para 91 et seq.), which can both increase or reduce the intensity of the interference. Therefore, the legislature must, in particular when it comes to the prevention of crimes that do not yet pose a concrete threat, “lay down the essential principles for limiting the type and scope of the data and the processing methods themselves by law” (para. 112). The court thus laid the foundation for further constitutional debate on data analysis using artificial intelligence and, in particular, the controversial Palantir software.

Legislative reforms in Germany and their shortcomings

New momentum has now been brought to the debate by legislative reforms in the two federal states of Baden-Württemberg and North Rhine-Westphalia, both of which recently amended their state police laws to enable or expand the use of Palantir. When comparing the new provisions in Section 47a PolG BW and Section 23 (6), (6a) PolG NW, it is interesting to note that the two federal states take very different approaches. Baden-Württemberg opted for a graduated approach, specifying which data categories are excluded, included, or, if necessary, added as supplementary information to the analysis. Data from residential surveillance and online searches – generally considered the most serious interferences with fundamental rights in police data collection law – are excluded by the law. Regularly included are case processing data (criminal complaints, investigation reports, notes with data from informants and witnesses), case data (mainly data on persons involved in criminal investigations and their contacts), and data from police information systems. In addition, telecommunication traffic data (e.g. who called whom, location data), data from evidence, data from non-state databases or from separately maintained state registers, and data from separately stored internet sources may be included on a supplementary basis, where necessary, in individual cases. The inclusion of traffic data from cell site queries and the content of monitored telecommunications is only permitted in cases involving a concrete or specific danger (Section 47a (3) PolG BW).

North Rhine-Westphalia, on the other hand, refrains from such detailed regulations and merely stipulates that data from residential surveillance or online searches may only be included if this is essential to avert a present danger to the life, body or liberty of a person (Section 23 (6a) Sentence 4 PolG NW). Otherwise, the state law does not contain any provisions. It even allows the use of self-learning systems, which had previously been prohibited, thereby further interfering with fundamental rights. With such carte blanche for automated data analysis, the parliament in North Rhine-Westphalia leaves it to the administration to regulate the essential requirements for the use of AI in internal guidelines. This does not comply with the constitutional requirements outlined above. This comparison shows how differently two states deal with the risks identified in the use of AI by the police, despite clear guidance by the Federal Constitutional Court. A look at other European countries confirms that legislation on police AI seems to be shaped more by current political events rather than by a coherent legal approach.

Police Use of AI in France and Luxembourg

The legislative frictions across Germany reflect a political will to make automated data analysis fit within constitutional boundaries. Although such political effort has not yet been observed in France and Luxembourg, recent legislative developments in both countries show a determination to integrate AI tools into policing – albeit through a narrower regulatory focus on automated video analysis.

France moved particularly fast in regulating police AI uses against the backdrop of a sustained terrorist threat that can be traced back to major attacks such as the 2015 Bataclan massacre. Ahead of the 2024 Olympic and Paralympic Games, the French legislature adopted the loi n° 2023-380 du 19 mai 2023 (“Loi JOP 2024”), which, among several exceptional security measures, authorised experimentation with algorithmic video-analysis for the purpose of detecting predefined security-relevant events in public spaces such as abandoned objects, unusual crowd movements, intrusions into restricted areas, or fire outbreaks.

This legal framework limited the experiment to image data only, explicitly excluding biometric identification and confining processing to a closed list of safety-related events. Although conceived as a short-term, narrowly circumscribed experiment, political momentum quickly shifted: both the Paris Police Prefecture and members of the government publicly endorsed extending the experiment until the end of 2027. The Constitutional Council blocked the extension, but only on procedural grounds, without examining the substance of the measure (unlike the German Federal Constitutional Court). In fact, it held that the extension amounted to a cavalier législatif (a “legislative rider”), as the initial law was adopted with the accelerated process and its extension was inserted into a bill with which the former had no connection. Crucially, the Council did not rule out a permanent application of algorithmic video analysis, thereby allowing the gradual normalisation of overly intrusive police powers.

Luxembourg has taken a more restrained approach, which reflects both the reportedly limited use of AI tools by the police and the country’s relatively low levels of complex crime. Its debate surrounding amendments to the 2018 police law focused on authorising the use of video surveillance systems in public spaces. The new article 43ter enabled the police, with the authorisation of the Ministry of Internal Security, to capture incidents in predefined zones, including through zooming and automated analysis.

As in France, the authorised processing is limited to image data expressly for prevention, detection and prosecution purposes. Yet supervisory authorities warned that these statutory limits were not sufficient to prevent broader interferences with fundamental rights. Both the National Data Protection Authority and the Consultative Commission of Human Rights raised concerns (here and here, respectively) about e.g. the absence of explicit purpose limitation tied to police missions, the lack of detailed criteria for designating surveillance zones, as well as the fact that the text regulates camera deployment but not the software operating them, leaving room for later functional upgrades (including AI-supported analysis) without renewed authorisation. While the Parliament addressed only part of this criticism, the adopted text remains flexible to accommodate future technological developments, signalling the political interest in equipping police with new powers and the use of AI-driven tools.

EU dynamics vs. Member State practices

The examples of France and Luxembourg show that the lawful scope of AI use by the police is so far determined by the interplay between targeted application of narrow frameworks and constitutional review – often in fragmented ways that fall short of human rights standards. However, examples from the German states also show that even well-founded rulings by the constitutional court do not automatically lead to uniform legislative practice. It seems that it is the task of national parliaments to strike an appropriate balance here.

At the national level, debates remain relatively hesitant and inconsistent, mainly because the implications of the EU AI Act for law enforcement are still unfolding. Once fully implemented, the Regulation is expected to clarify the conditions under which commercial and in-house tools may be used by the police, while prompting Member States to revisit their domestic legal frameworks. Eurojust’s recent mapping confirms that currently, national approaches differ among Member States. Some favour the adoption of new statutory laws, others lean towards non-binding guidelines, while a third group considers existing laws sufficient to absorb AI-driven policing. The fragmentation is not surprising given the current lack of concrete EU-level guidance. The only exception is the European Parliament’s 2021 Resolution on AI in criminal law and its use by the police and judicial authorities in criminal matters, which, though useful, remains non-binding and predates the AI Act. The Commission’s forthcoming Guidelines (as per Art. 6 (5) EU AI Act) on high-risk AI systems, expected in February 2026, may therefore play a significant role in limiting divergence among Member States.

In any foreseeable scenario, EU data protection laws – the General Data Protection Regulation and particularly the Law Enforcement Directive – will remain central, already providing a harmonised framework for processing personal data by law enforcement authorities. As such, they are solid ground for safeguarding the rights to privacy and data protection. We should closely observe if this ground will remain solid once the AI Act becomes fully operational, and as the saga of the Commission’s recently introduced (and critically seen) Digital Omnibus Package concludes.

The post Patchwork Policing appeared first on Verfassungsblog.