How facial recognition, passenger data, and cross-agency coordination create a continuous monitoring network
WASHINGTON, DC, December 10, 2025
The Schengen system was initially sold to European publics as a space of open internal borders, fast lanes between countries, and the symbolic end of routine passport checks. In 2025, that promise still exists, but it is increasingly mediated by invisible digital infrastructure. Cameras at border gates, biometric kiosks at ports and airports, risk scoring tools in back offices, and shared passenger databases inside secure government networks are redefining what it means to cross into or move within Europe.
Artificial intelligence is not the only technology involved, yet it quietly underpins many of the systems that collect, compare, and interpret data about travellers. Facial recognition algorithms decide whether automated gates open or stay closed. Machine learning models examine passenger name records to highlight unusual itineraries. Cross-agency platforms link information from border guards, police, customs, and intelligence services to produce shared risk dashboards.
Supporters argue that this digital border is essential. They point to terrorist attacks, irregular migration, trafficking networks, sanctions evasion, and fraud, and they describe AI-supported systems as an efficient way to focus limited enforcement resources. Critics see a different picture. For them, the same tools form the backbone of a continuous monitoring network that can follow people from check-in desks to internal train lines, with limited transparency and uneven safeguards.
As the Entry-Exit System comes online and the Schengen area expands to new member states, Europe is conducting a live experiment in how far technology can extend the frontier beyond the physical line on the map and into the data trails of everyday travellers.
Schengen’s expanding digital perimeter.
Two developments define the current phase of Schengen’s transformation. The first is territorial. With Bulgaria and Romania now fully integrated into the Schengen area, land border checks between those states and their neighbours have been removed. The free travel zone stretches further east, enlarging the space where internal movements are lightly controlled while shifting more pressure to the external perimeter.
The second is technological. On October 12, 2025, the European Union’s Entry-Exit System became operational at external borders. Over six months, it is being rolled out at airports, seaports, and land crossings that serve as gateways to the Schengen area. Non-EU nationals entering for short stays no longer rely solely on ink stamps. Instead, they are registered in a digital system that records their biographical details, biometric identifiers such as fingerprints and facial images, and the time and place of their entry and exit.
Once the system is fully implemented, border officers will no longer need to count stamps to determine whether someone has exceeded the 90-day limit under the 180-day rule. The EES database will provide an instant calculation that highlights overstays and potential identity fraud. That change may appear administrative, but it allows authorities to treat mobility as a long-running record rather than a series of disconnected encounters at individual checkpoints.
Alongside EES sits the delayed but still upcoming European Travel Information and Authorisation System. ETIAS is scheduled to begin operations in the last quarter of 2026. Visa-exempt travellers, including those from North America and other partner regions, will need to obtain online authorisation before boarding flights, ferries, or certain international trains bound for the Schengen area. Their applications will be checked automatically against security, migration, and health databases. Most approvals are expected to be granted within minutes, but some will be flagged for further review.
With Bulgaria and Romania joining Schengen in full and EES moving from planning to implementation, the European border is no longer only a physical perimeter staffed by guards. It is a series of networked systems that collect and analyse data before, during, and after travel.
Facial recognition and biometric checkpoints
Facial recognition sits at the visible edge of this digital architecture. For many travellers, their first encounter with the new border is an automated gate where a camera replaces the traditional conversation with a border officer.
Technically, such systems perform a sequence of operations. A camera captures a live image of the traveller’s face. Software detects and isolates the face in the image, extracts a biometric template, and compares it to a reference stored on a passport chip or in an EES record. The algorithm produces a similarity score, often expressed as a probability or percentage, which is then compared against a threshold set by the authority that operates the gate. If the score is above the threshold, the gate opens. If it falls below, the gate stays closed, and a human officer completes the check.
Artificial intelligence is central to the recognition process. Modern facial recognition engines are trained on large datasets, enabling them to handle variation in lighting, angle, and appearance. That training can make them fast and accurate at scale. Still, it also introduces familiar concerns about bias, especially when the training data does not reflect the diversity of the travelling public.
Border authorities can adjust thresholds to reflect their risk appetite. A high threshold reduces false positives, which lowers the chance that the system will mistake one person for another. It can, however, increase false negatives, meaning legitimate travellers are rejected and referred for manual checks. A lower threshold has the opposite effect. In practice, the choice reflects political priorities as much as technical judgement.
Facial recognition is not confined to automated gates. Some airports and ports are experimenting with “one person, one token” systems in which a single biometric enrolment at check-in is used throughout the journey. In such schemes, a facial template can eliminate the need to repeatedly present a boarding pass and passport at security and boarding, and in some premium lounges. Proponents argue that this reduces friction and speeds up processing. Privacy advocates warn that it also normalises a form of tracking inside commercial spaces, blurring the line between border control and customer analytics.
Case study one: First contact with the digital border
Consider a Canadian traveller arriving in Europe in early 2026, after EES is fully operational but before ETIAS is in force. It is her first trip to the Schengen area, and she is connecting through a central hub to a smaller destination.
On arrival, she is directed to a bank of self-service kiosks reserved for third-country nationals. A screen prompts her to scan her passport, answer simple questions about her trip, and then look straight at the camera. The kiosk captures a facial image and, in some implementations, her fingerprints. After a brief wait, a receipt appears confirming that her enrolment has been accepted. She then proceeds to an automated gate, where a second facial scan verifies her identity against the freshly created record.
On the surface, the process feels modern and efficient. She notices that lines seem to be moving faster than the manual queues. She is not told, however, how long her data will be stored, which agencies can access it, or how it might be linked to future journeys. Nor does she know that, in the background, her entry record is tied to a calculation of how long she can now lawfully remain within the Schengen area.
From the perspective of EES designers, the encounter is a success. The system has captured high-quality biometrics, produced a secure entry record, and released the passenger into the terminal with minimal delay. From a privacy perspective, it creates a new, long-lived data point that can be linked to other information in ways that are not immediately clear to the individual concerned.
Passenger data is the backbone of digital borders.
While biometrics capture attention, the true backbone of the digital border is passenger data. Long before a traveller reaches a checkpoint, airlines and other carriers collect detailed information that can later be used for risk analysis.
Passenger name records are the most significant category. PNR data is generated when a reservation is made and can include names, contact details, routing, payment information, travel dates, seat selections, baggage details, frequent flyer numbers, and information about companions. Under the European Passenger Name Record Directive, airlines must transmit PNR data to specialised Passenger Information Units in member states. These units store the data for several years and are authorised to use it to prevent, detect, investigate, and prosecute terrorism and other serious crimes.
Artificial intelligence tools make PNR analysis more powerful. Machine learning models can be trained on historical cases to identify combinations of factors that correlate with particular types of risk. For example, they might flag last-minute one-way cash tickets on specific routes, or itineraries that involve repeated visits to locations associated with previous investigations. Importantly, such patterns do not prove wrongdoing, but they can trigger alerts that lead to closer scrutiny of specific passengers.
A separate but related stream is advance passenger information. API is collected closer to departure and focuses on identity data, such as passport numbers, issuing countries, and dates of birth. Recent European regulations have created a more structured framework for how API is collected and transmitted, including the phased introduction of an EU-level router through which air carriers must send these details. API allows authorities to check identities against watchlists and national databases before a plane leaves the gate.
Together, PNR and API transform airlines into the front line of border risk analysis. Carriers that fail to collect or transmit the required data can face penalties. In practical terms, this means that scenarios in which a passenger boards a flight to Europe without prior screening are becoming rarer.
From isolated databases to continuous monitoring
The digital border is not simply a stack of independent systems. It becomes continuous when data from different sources is linked and shared between agencies. That process is unfolding in several layers.
At the national level, Passenger Information Units receive PNR data and often share relevant extracts with border guards, customs, and police units. Entry-Exit records generated at airports and land crossings are stored in central systems but can be queried by frontline officials across the country. In some states, joint coordination centres combine human staff from multiple agencies with shared access to mobility databases and AI-supported analysis tools.
At the European level, institutions such as Frontex and Europol play a coordinating role. Frontex, the European Border and Coast Guard Agency, operates systems and situation centres that rely on contributions from member states. Europol supports cross-border investigations and has access to specific categories of travel data, where relevant, for serious crime and terrorism cases. The European Union has also invested in large projects to make security and migration databases more interoperable, so that authorities can search across systems using standard biometric and biographical identifiers.
Artificial intelligence is increasingly deployed in this multi-layered environment to prioritise attention. Algorithms can rank alerts by likely severity, highlight emerging patterns that span several countries, or suggest where human analysts should focus scarce investigative time. The result is a monitoring network that may be less visible than traditional border fences but is more pervasive in its reach.
Case study two: When alerts follow a traveller across borders
An anonymised scenario illustrates how this network can affect an individual’s experience.
A dual national living outside Europe travels frequently to multiple Schengen countries on business. His work in logistics and procurement involves crisis regions and occasionally sensitive goods, although all activity is licensed and lawful. He books multi-leg trips that combine air and rail travel, often with short-notice changes. His itineraries generate substantial PNR and API data.
At some point, an investigation into a trafficking network identifies travel patterns that superficially resemble his routes. Authorities develop a risk indicator based on those patterns and implement it within national PNR analysis tools. Unknown to him, his upcoming journeys now trigger low-level alerts in several states. Border systems do not automatically refuse him entry, but they repeatedly request additional checks.
He starts to notice that his boarding passes are frequently marked for secondary screening, that he is asked detailed questions about his work, and that he is sometimes escorted to separate rooms for interviews, even though he has never been accused of any offence. Because each incident occurs in a different country and is handled by other officers, no single explanation is provided. The continuity lies not in the human interactions, but in the algorithm that quietly follows his data across borders.
Cross-agency coordination within the expanding Schengen
The expansion of Schengen to include Bulgaria and Romania, along with Croatia’s earlier integration, has increased the number of states that must coordinate on border data and AI tools. In theory, the removal of land border checks between member states should reduce friction for travellers. In practice, it has also strengthened the rationale for robust external and digital controls.
As new members join, they connect their border management systems to European platforms and begin sending and receiving data in accordance with standard rules. That process requires technical upgrades, legal changes, and institutional coordination. It also raises questions about capacity and oversight. Smaller states must invest in secure IT infrastructure and specialist staff. Larger states must ensure that their own systems can handle increased volumes and more complex data flows.
At the same time, several existing Schengen states have reintroduced temporary internal border controls in response to irregular migration and security concerns. Those controls are supposed to be targeted and time-limited, but in practice, some have become semi-permanent. For commuters who cross internal borders daily, such checkpoints can feel like a return to earlier times. Behind the scenes, however, these internal checks are now embedded in a landscape where EES, PNR, and API continue to operate, making the overall system more layered than before.
Case study three: A cross-border worker in a time of “temporary” controls
A health care worker lives in one Schengen country and commutes daily to another, crossing a bridge that lies on a busy internal border. For years, she has driven across with only occasional spot checks.
Following a surge in irregular migration and political pressure to show action, the destination state reinstates border controls at that bridge. Officers begin to stop a significant portion of vehicles, checking IDs and asking questions. The worker now faces unpredictable delays during what was once a routine commute.
At the same time, new data-sharing measures mean that the registration plate of her car and the identity document she presents can be logged and compared with information in national and European databases. While she benefits from Schengen membership when traveling to other parts of Europe, her daily route has become part of a monitored corridor, where information about her movements accumulates over time.
Legal frameworks and safeguards
The continuous monitoring network developing around Schengen is constrained by law, at least in principle. Several overlapping frameworks determine what data can be collected, how long it can be stored, and who can access it.
The Schengen Borders Code sets out rules for external border checks and the conditions under which internal controls can be reintroduced. Specific regulations govern the Entry Exit System, including retention periods for data and provisions on access by law enforcement. The legal texts underline that EES is intended to manage short-stay movements and combat irregular migration and crime. Still, they also authorise data access for a range of agencies under defined conditions.
The Passenger Name Record Directive regulates how PNR data is collected and used. It requires member states to establish Passenger Information Units and includes obligations around data security, masking, and eventual deletion or anonymisation. Court rulings at the European level have confirmed that the directive is compatible with fundamental rights law, but only with careful interpretation and implementation.
Data protection rules, particularly the General Data Protection Regulation and the Law Enforcement Directive, apply in the background. They enshrine principles such as purpose limitation, data minimisation, proportionality, and the right of access and rectification. In theory, travellers can request information about the data held on them and challenge unlawful processing. In practice, exercising those rights in a national security context can be difficult.
A new Artificial Intelligence Act, moving through the European legislative system, will add another layer. It treats specific uses of AI as high-risk and imposes obligations on transparency, documentation, human oversight, and robustness. Real-time remote biometric identification for law enforcement in public spaces is heavily restricted. Many border-related AI systems will fall into high-risk categories, requiring operators to comply with detailed rules on risk management, data governance, and post-deployment monitoring. How those obligations will be enforced in complex multi-agency environments remains an open question.
Profiling, discrimination, and error
Technical sophistication does not eliminate social and ethical concerns. On the contrary, artificial intelligence can magnify longstanding problems of profiling and discrimination if it is trained on biased data or guided by problematic assumptions.
If historic investigations and prosecutions have focused heavily on particular nationalities, communities, or regions, models trained on that history may treat travel associated with those groups as inherently more suspicious. Risk indicators may also embed socioeconomic biases, such as assumptions about low-cost airlines, small cash payments, or shared addresses. Even when no direct reference to ethnicity or religion exists, proxies can reproduce similar effects.
Errors are another source of harm. A misspelled name in a watchlist, an incorrect date of birth in a reservation, or a mistaken association in a database can lead to repeated false positives once AI systems begin to treat those entries as signals. The distributed nature of Schengen’s monitoring network means that a single erroneous record can spread across multiple countries and systems, making it harder to correct.
Case study four: The cost of a mistaken match
Imagine a journalist who covers organised crime and corruption across several countries bordering the Schengen zone. She travels often, sometimes on short notice, to meet sources and attend court hearings. Her work is lawful and protected by press freedom principles.
During a complex investigation, an intelligence unit mistakenly associates her phone number with a person under suspicion, mistaking a shared contact for the device’s owner. That association is entered into an internal file and, over time, is reflected indirectly in risk indicators used in passenger data analysis.
The journalist begins to notice changes. Airline agents frequently step away from the desk when she checks in. Border officers greet her by name and ask detailed questions about her itinerary. On one occasion, she is prevented from boarding a flight, with staff citing unspecified “clearance issues—attempts to obtain clarification lead to vague statements about security procedures.
The original mistake may never be publicly acknowledged, and it might eventually be corrected quietly in a database. In the meantime, AI-assisted systems treat her as a potential risk because of an erroneous link she cannot see. The chilling effect on her reporting is considerable. She begins to avoid specific routes, declines assignments, and weighs the risk of each trip differently than she did before.
How individuals and organisations are responding
For individual travellers, navigating the digital border broadly means dealing with new practical requirements. Non-European nationals must be prepared to register biometrics in EES, complete ETIAS applications once the system launches, and allow extra time at airports or ports where new technologies are being introduced. For many people, the experience will be smooth. For others, particularly those who already face discrimination, the risk of delays and intrusive questioning remains higher.
The accuracy and consistency of personal data are becoming increasingly critical. Ensuring that names are spelled identically across passports, tickets, and visas, that biographical details are correct, and that expired documents are not referenced in new bookings can reduce the chance of avoidable mismatches. Knowing in advance which crossings are busiest, which ports and terminals have implemented EES, and how long data will be stored can help travellers make informed choices.
Companies, especially those that operate in sectors exposed to regulatory scrutiny, are treating mobility as a strategic issue. Financial institutions, energy companies, technology firms, and humanitarian organisations often have staff who frequently cross European borders. Their risk profiles are shaped not just by where they go, but also by how their movements appear to AI-supported systems.
Some organisations now conduct internal audits of travel patterns, identify staff whose itineraries are particularly complex, and ensure that supporting documentation is available if questions arise. They may also establish internal protocols for what to do if an employee is detained, refused boarding, or subject to repeated secondary checks. These protocols typically balance cooperation with authorities and protection of staff rights, while avoiding any suggestion of obstructing legitimate investigations.
Case study five: Corporate mobility planning in the age of the digital border
A multinational company with operations in Europe, the Middle East, and Africa decides to review its mobility practices after several senior staff report repeated delays at Schengen border crossings. None of the individuals has a criminal record, and all work in regulated industries that require high levels of compliance.
Internal analysis reveals that executive travel often involves last-minute changes, irregular routing to reach remote sites, and the use of different legal entities for ticket purchases. From a business perspective, those patterns are understandable. From the standpoint of AI-based passenger data analysis, they resemble some of the risk profiles associated with past sanctions and export control violations.
The company engages external advisers, including employees of Amicus International Consulting, to map how its travel patterns intersect with European border data systems. The advisory team does not attempt to bypass or weaken controls. Instead, it focuses on ensuring that legitimate activity is documented and interpretable. That process includes centralising bookings through a single travel platform, harmonising job titles and roles across jurisdictions, and maintaining internal records that clearly link each trip to a lawful business purpose.
In parallel, the company prepares briefing materials for travelling staff that explain what EES, PNR, and ETIAS are, what questions officers may ask, and how to respond calmly and accurately. It also designates internal points of contact who can provide information to authorities if clarification is needed.
Over time, executives report fewer unexplained delays. When issues do occur, they are resolved more quickly because officers can verify information against clearly structured documentation. The company accepts that a certain level of scrutiny is unavoidable, but it has reduced the risk that ambiguous data will be interpreted in the worst possible light.
The role of professional advisory services
As European borders become more digital, the gap between legal texts, technical systems, and lived experience widens. Understanding how that triangle fits together is not straightforward. Laws are written in general terms, technologies evolve quickly, and practices vary between states and even between individual crossing points.
Professional advisory firms working in cross-border planning seek to bridge that gap. Employees at Amicus International Consulting, for example, engage with clients who must navigate combinations of residence rights, corporate structures, and mobility patterns that span multiple regions. Their work frequently involves explaining how new systems such as EES and ETIAS interact with older frameworks like visas, residence permits, and national registration regimes.
For some clients, the focus is on compliance and predictability. They want assurance that their travel and relocation plans fit within current rules and are resilient to foreseeable changes. For others, particularly those from countries with restrictive capital controls or political instability, the question is how to restructure their lives and assets in ways that respect law in all relevant jurisdictions while minimising exposure to arbitrary or politicised use of border powers.
In every case, AI-supported monitoring systems are part of the environment rather than the central object. Advisers track how these systems are being implemented, how courts and regulators are reacting, and where accountability gaps arise. They may recommend practical steps, such as diversifying routes, updating documentation, or seeking advance clarification from authorities in complex cases. They also help clients understand that in a world of digital borders, information management is as important as physical movement.
Looking ahead
Europe’s digital border is still under construction. The Entry Exit System is in its first months of operation, and ETIAS is more than a year away from full launch. The new legal framework for advance passenger information is fresh, and the Artificial Intelligence Act is moving through its early implementation phases. There will be technical issues, political disputes, and legal challenges. Some projects will stall or be redesigned. Others will quietly become part of the background of international travel.
What appears settled is the direction of travel. Schengen’s promise of free movement inside the zone now depends heavily on a thickening layer of controls at, and beyond, the external perimeter. Those controls are not only physical checkpoints, but also databases, biometric systems, and analytic tools that treat movement as information to be collected, processed, and scored.
Whether this architecture ultimately strengthens both security and rights will depend on how it is governed. Transparency about what data is collected, meaningful ways to correct mistakes, limits on function creep, and real oversight of AI systems are essential to maintaining public trust. Without them, the digital border risks becoming a one-way mirror in which authorities can see into the lives of travellers, while individuals are left guessing how they appear in the systems that decide whether they can enter, stay, or move on.
For now, one conclusion is clear. In the expanding Schengen system, the frontier does not begin at the booth where a passport is presented. It starts much earlier, in the moment a journey is planned and booked, and it extends long after arrival, within the records that artificial intelligence helps to knit into a continuous monitoring network. Understanding that reality is becoming a necessary part of responsible travel, business planning, and policy making in a world where data increasingly define borders.
Contact Information
Phone: +1 (604) 200-5402
Signal: 604-353-4942
Telegram: 604-353-4942
Email: [email protected]
Website: www.amicusint.ca
