England and Wales facial-recognition audits miss the decision that leads to arrest

Police audits of retrospective facial recognition follow the database operator, not the investigator who acts on a match. England and Wales should tie wider use to a documented chain from candidate to arrest outcome.

Audits of police facial-recognition searches in England and Wales follow the database operator, not the investigator who acts on the result. That is one of the findings of an inspection published on 12 November. The report gives no count of wrongful arrests. It could not establish with certainty whether the algorithm's bias contributed to any.

CTOL's view: make wider use of retrospective facial recognition (RFR) depend on a documented chain from the algorithm's candidate to independent corroboration, any arrest and the case outcome. The inspectorate, His Majesty's Inspectorate of Constabulary and Fire & Rescue Services (HMICFRS), recommends a statutory code of practice by 30 June 2027. Whether that code makes the chain auditable decides whether it works.

Most faces on a candidate list are classed as non-matches

RFR compares a crime-scene image with the more than 20 million custody images on the Police National Database (PND). From 1 April 2025 to 31 March 2026, forces ran 291,341 searches. Seventy-four percent returned at least one face match, and force averages ran from 9.1 to 14.7 candidates per search.

On CTOL's arithmetic, 291,341 searches times 74% gives about 215,592 searches with a candidate list. At 9.1 to 14.7 candidates each, that is roughly 1.96 million to 3.17 million images shown to operators and investigators in a year. That is a sensitivity built on force averages, not a measured total.

The inspection report says a search may produce "a maximum of one true match". The National Physical Laboratory (NPL) classes every other candidate as a false positive for testing. On that rule, at least 89% of the images on a 9.1-candidate list are non-matches, and 93% at 14.7. The report gives no rate for investigators picking the wrong person.

The Home Office says the system found the correct match in 99% of searches where that image was on the database, at police settings. That measures retrieval, and a system can find the right face while still showing many wrong ones.

Audits follow the operator, not the investigator

A match is an investigative lead, not identification evidence. Yet in a Home Office survey of 779 PND users, 34% either incorrectly believed or were unsure that a match meets the Code D evidential requirement. Of the 86% with training, 49% said it covered risks and limitations.

Forces must audit at least 1% of PND searches. At least a quarter of those audits must cover RFR. According to the inspection report, 7 forces had not appointed an auditor and 2 auditors could not access the PND. Ten forces appeared to have audited more than required. Twenty-two failed to submit a return or submitted incomplete information. Only two had audited the correct number of RFR searches.

The inspectors call this focus a weakness. The report documents what it can allow. In one force, officers circulated a suspect after a search. He was arrested in another force area. Investigators later established that he did not match the offender image. The force found that officers had made no further enquiries before circulating him.

In another force, supervisors directed an arrest based solely on a potential match, and those investigators had received no training. Some officers said managers had at times encouraged them to progress investigations quickly after positive matches.

Audit data from the National Police Chiefs' Council (NPCC) showed that audits of RFR searches had identified no confirmed adverse incidents. HMICFRS also says an arrest after a match that later clears someone does not necessarily make the arrest unlawful or unnecessary. Those limits cap what can be said about harm. Forces also lacked data linking matches to arrests and case outcomes.

The 2024 setting change moved the trade-off to the investigator

A 2024 NPL test found that at some settings, women and Asian or Black people were more likely than men or White people to be wrongly included. After sensitivity adjustment, the differences were no longer statistically significant, but the likelihood of finding a true match fell. NPL said the evaluation alone could not determine the full extent of any bias.

The NPCC lead for the PND set national actions in September 2024 that included increasing sensitivity. Later that November, the lead reduced the setting after operational feedback that the higher one may have limited investigators' chances of identifying suspects. A 28 November letter said the revised setting would increase potential matches. CTOL reads that as moving the trade-off into the investigator's hands, since broader lists put more weight on the human check.

The Home Office has identified a new algorithm that NPL found could achieve high accuracy without significant performance differences between demographic groups. It usually returned a single potential match and was trialled by Essex Police and Cheshire Constabulary. A shorter list would help, but one candidate would still not be identification evidence.

HMICFRS says RFR is making a valuable contribution, and cites an urgent Cheshire search in a knife-point robbery completed within 10 minutes. An AOL copy of the Guardian report relays Ben Russell, the NPCC's facial recognition lead, defending continued use. He says "Policing remains committed to the ethical, proportionate and responsible use of retrospective facial recognition".

The same copy relays Prof Pete Fussey of the University of Southampton, who says "Meaningful human scrutiny of AI systems is a legal requirement". It also relays Jasleen Chaggar of Big Brother Watch on "The revelations that officers are treating facial recognition as bona fide evidence rather than a probability score".

Detroit wrote corroboration into a rule

Detroit's 2024 settlement of a wrongful-arrest case shows what a corroboration rule looks like. Under it, according to the American Civil Liberties Union (ACLU), police may not arrest on facial-recognition results alone. A lineup needs independent reliable evidence. The settlement requires officer training and four years of court enforcement. It also requires an audit of cases since 2017 in which the technology obtained an arrest warrant.

The ACLU counts three known wrongful arrests relying on facial recognition, all of Black people. Detroit's legal system differs, so it is a design model only. Nathan Freed Wessler of the ACLU, speaking in a US context, calls face recognition technology "fundamentally dangerous in the hands of law enforcement".

The June 2027 code has to reach the arrest decision

HMICFRS says no comprehensive statutory framework governs police use of facial recognition. Its 16 recommendations include a statutory code of practice and force investigation policies by 30 June 2027. Independent oversight and mandatory training follow by 31 December 2027. It also says "We don't believe that the government should create a new regulatory body".

On 4 November Home Secretary Shabana Mahmood announced a new independent watchdog. In serious non-compliance it could seek a court injunction against a force's use of the technology. In August the Information Commissioner's Office reported 107 recommendations from audits of five forces.

Either oversight model needs case-level records, so the evidence favours wider use only if the code HMICFRS recommends by 30 June 2027 requires search records naming the investigator and the candidate relied on, documented corroboration before arrest, and auditor access to the outcome.