On June 9, 2026, the eight Nordic and Baltic prime ministers met President Volodymyr Zelenskyy in Tallinn and issued a joint statement backing the opening of all six EU accession negotiating clusters for Ukraine in June–July 2026 "without further delay." The sequence matters: accession talks begin with Cluster 1, the "Fundamentals," which governs the rule of law, fundamental rights, and data protection. That is the legal gateway through which Ukraine's largely ungoverned public-space biometric surveillance — Clearview AI, Kyiv's facial-recognition CCTV, and the stalled Bill No. 11031 — must now pass.
A surveillance estate built without a statute
Ukraine did not arrive at biometric surveillance through legislation. It arrived through war and improvisation. Clearview AI offered its tool to Kyiv free of charge in March 2022, and Ukrainian agencies have since run billions of scraped images — many harvested from the Russian social network VKontakte — to identify dead soldiers, screen people at checkpoints, and build war-crimes cases. Useful as that is, the Digital Security Lab Ukraine notes there is no statute authorizing it: deployment rests on "the good faith approach of the company and the relevant state authorities," atop a 2010 data-protection law it calls "extremely outdated" with no independent supervisory body.
The domestic camera network is just as unbound. Kyiv police demonstrated facial recognition across more than 1,800 regional cameras in May 2023. By early 2024, roughly 74% of Ukraine's approximately 24,000 surveillance cameras were made by the Chinese vendors Hikvision and Dahua — a procurement fact with its own security implications. And Ukraine's Criminal Procedure Code lets investigators pull footage from public-place devices "in automatic mode" on a prosecutor's resolution alone, with no prior court order.
What the AI Act actually demands
This is the body of practice that Cluster 1 will test against EU law — above all Regulation (EU) 2024/1689, the AI Act, whose Article 5 prohibitions took effect in February 2025. Two provisions bite directly.
Article 5(1)(e) bans, with no exceptions, AI systems that "create or expand facial recognition databases through the untargeted scraping of facial images from the internet or CCTV footage." That is a near-verbatim description of Clearview's business model, and it is the single hardest line Ukraine will have to cross. Article 5(1)(h) restricts — but does not abolish — real-time remote biometric identification in public spaces for law enforcement, permitting it only for narrow aims such as locating trafficking victims, preventing imminent threats to life, or finding suspects in serious crimes carrying four-year sentences, and only with prior judicial authorization and a fundamental-rights impact assessment.
The steelman for the regulators is strong and should be stated plainly. A country at war, integrating Chinese-made cameras of uncertain provenance and a scraping tool repeatedly fined under GDPR by France and Italy, is exactly the environment in which biometric data is abused — against dissidents, journalists, and misidentified civilians. Ukraine's own Institute of Mass Information warned that Bill 11031, as drafted, would "legitimize the process of collecting and analyzing all video surveillance data in public places in real-time" through "uncontrolled use of artificial intelligence." Untargeted mass biometric monitoring is a genuine threat to the open society Ukraine is fighting to join, and the AI Act's red lines exist for good reason.
Proportionality, not prohibition theatre
But the lesson Ukraine should draw is calibration, not capitulation. The AI Act is not a ban on biometric tools; it is a demand that their use be necessary, targeted, judicially supervised, and auditable. Bill 11031's defect is not that it enables facial recognition — it is that it centralizes a real-time feed under the Interior Ministry with no warrant gate, no independent regulator, and no purpose limitation. Those are fixable design choices, and fixing them is the substance of Cluster 1 compliance.
The sharper tension is wartime identification. The legitimate security value of identifying enemy combatants and documenting atrocities should not be sacrificed to satisfy a peacetime statute. The honest path is to separate the uses: wind down untargeted scraping into civilian-facing databases — the 5(1)(e) violation that has no defense — while preserving narrowly scoped, logged, court-authorized identification for defense and war-crimes work, much of which sits outside the AI Act's law-enforcement framing in the first place. Conflating the two invites either reckless surveillance or self-defeating disarmament.
Ukraine should also resist the European temptation to legislate loudly and enforce quietly. A face-recognition statute without a funded, independent data-protection authority is theatre, and EU members from France to Greece have shown how easily real-time biometric identification expands once the cameras are installed. The credible move is to build the regulator before the system — an oversight body with teeth, mandatory impact assessments, and public transparency reporting — so that proportionate surveillance is enforced rather than merely promised.
The Tallinn statement reframes all of this as opportunity. EU accession gives Ukraine external leverage to retire a Soviet-era data law, replace ad hoc wartime tooling with a rights-respecting framework, and do so with the political cover of "this is what Brussels requires." Handled as a proportionality problem rather than a prohibition checklist, Cluster 1 can leave Ukraine with both a working security apparatus and the civil-liberties guardrails that distinguish the union it wants to enter from the regime it is fighting. That is the bargain worth striking — and the clock on it starts this summer.