Spain's Herta scales EU-banned face recognition across India

The reporting worth pausing on this week comes from Tech Policy Press, which maps how Spanish firm Herta Security, founded in Barcelona in 2009 by former Bosch employee Javier Rodríguez Saeta, is running a face-recognition business inside India that would be illegal to run at home.

The numbers give the shape of it. Herta's flagship product, BioSurveillance NEXT, sits behind the 540 facial recognition systems that Eastern Railway announced were operational at 143 stations, with a full plan covering 392 stations. In 2022 a Delhi-based company won an €11.5 million tender for the underlying video surveillance system. Herta's software also runs across three of Delhi's prison complexes, and a company marketing presentation obtained by Investigate Europe claimed 140 facial recognition cameras deployed in Ahmedabad's safe-city program.

The awkward part is the legal geography. Since 2025 the EU AI Act has largely prohibited real-time remote biometric identification in public spaces, and according to the reporting four leading legal scholars said the Indian Railways Eastern Region and Ahmedabad deployments would be unlawful if run inside the EU. Herta has received more than €3.3 million in EU research funding since 2020. Italian MEP Brando Benifei called the pattern one that "exposes a dangerous double standard" and said the bloc should "find arrangements to not allow the export and use abroad of systems we would not permit at home."

What sits behind the cameras is the part worth staring at. One of Herta's local business partners said there were around one million subjects on the Indian Railways watchlist, and Delhi Police said in 2022 it treated facial recognition matches at 80 percent similarity as positive identifications. India has no comprehensive data-protection statute covering policing use. The Nirbhaya Fund, India's scheme for women's safety, had by March 2025 disbursed around 58 billion rupees (€532 million), and the reporting raises the question of whether public-space surveillance is a good match for the crimes it was set up to address.

The honest caveat is that this is a mapping exercise, not a court finding, and the piece does not give you a field false-match count or a live legal challenge to any specific deployment inside India. What it does give you is a data-heavy case file that MEPs pushing for AI Act export controls can now point at, and one Indian legal and civil-society actors can use to force the country's regulatory vacuum into open view.