It sounds like a good step, but I'm sad it seems to only specify "AI-Powered". We've had effective methods of bulk facial recognition for years without "AI". Not AS effective, maybe, but definitely effective enough. Also, I didn't see in the linked article - did they define "AI" well? I guess I feel like it would be easy to bypass that definition.
The EU has a general ban on "AI" or any sort of automation making decisions about people who are not aware of the exact criteria those decisions are made about.
That for example spares us from a lot of automatic CV screening as well as law enforcement profiling with AI tools. We do it mostly the old-school way of just having racist / classist cops.