Brussels has spent the past two years exporting a regulatory model the rest of the world is still catching up to. Between the GDPR’s now decade-old legacy and the EU AI Act’s phased rollout, companies that process any data derived from cameras or public-space sensors have had to answer an uncomfortable question earlier than their global competitors: can this technology work at all if it isn’t built to comply from day one?
Acorel, a French company that’s spent 37 years building automatic people-counting and flow-analytics technology for transit systems, airports, and public venues, offers a useful test case — not because it’s an EU policy actor, but because its entire product category sits squarely inside the regulatory questions Brussels has spent the last several years trying to answer.
A sector built on exactly the data the EU is most worried about
People flow management — sensors and cameras that count, track, and analyze how people move through physical space — sits at an awkward intersection of several EU regulatory priorities at once: data protection (GDPR), biometric and AI oversight (the AI Act), and increasingly, questions about surveillance in public infrastructure funded partly by EU transport and cohesion money.
The core tension is straightforward. Transit authorities, airports, and public buildings across the bloc have real, defensible reasons to want real-time occupancy data — safety compliance, energy efficiency, service planning. But the sensing technologies capable of delivering that data (cameras, computer vision, LiDAR) are precisely the technologies EU regulators have spent years trying to bring under tighter control, particularly where biometric identification is involved.
“Anonymous by design” as a compliance strategy, not an afterthought
Acorel’s answer to that tension — one shared by a number of vendors in the category — is architectural rather than procedural: build the anonymization into the sensor itself, so there’s no personally identifiable data generated in the first place, rather than collecting it and then trying to govern access to it after the fact. The company states its systems detect and count without storing images or identifying individuals, positioning its technology as GDPR-compliant by construction.
That distinction matters more under the AI Act than it did under GDPR alone. The Act’s risk-based framework treats real-time biometric identification systems in publicly accessible spaces as one of its most tightly restricted categories — in some cases outright prohibited for law enforcement use, and subject to strict conditions otherwise. A system that never performs identification in the first place — one that outputs an anonymous headcount rather than a matched identity — sits in a fundamentally different, and far less restricted, part of that framework than a facial-recognition system does. Vendors that built this distinction into their architecture years before the AI Act’s text was finalized are, in effect, already compliant with a law that was still being negotiated when their engineering decisions were made.
Why this matters beyond one company
The pattern is bigger than any single vendor. As the AI Act’s obligations phase in — with rules on biometric categorization, real-time identification, and high-risk system documentation each hitting different implementation dates — a whole category of European sensor and analytics companies is finding that regulatory foresight, not just technical accuracy, has become a genuine market differentiator. Companies that treated privacy as an engineering constraint from the start face a much lighter compliance lift than those retrofitting anonymization onto systems built around identifiable data.
For public-sector buyers — transit agencies, airport authorities, municipal building managers across the EU — that shifts the practical question in a procurement process. It’s no longer just “how accurate is this sensor,” but “does this vendor’s architecture make our AI Act and GDPR compliance obligations easier or harder to meet, long after the contract is signed.” A vendor with an “anonymous by design” pitch has a real answer to that question before the tender is even issued.
The bigger picture from Brussels
The EU’s regulatory model has often been criticized — including by companies operating within it — as slower and more cautious than the US or Chinese approach to AI deployment. Acorel’s history offers a counterpoint worth noting: a company built on 3D sensors and computer vision that appears to have found compliance to be less a brake on its business model than a design constraint it worked around early, arguably giving it a head start over competitors now retrofitting privacy protections into architectures that weren’t built with them in mind.
Whether that pattern holds across the wider European AI and IoT sector as the AI Act’s remaining provisions come into force over the coming years remains an open question — one Brussels policymakers, and the companies subject to their rules, will be watching closely either way.