Facial recognition is no longer just a technological tool. Under the GDPR and the AI Act, it raises complex legal issues involving biometric data, governance, contractual risk, and regulatory compliance.