The UK's surveillance infrastructure
The United Kingdom has one of the densest concentrations of CCTV cameras of any country in the world. Exact figures are contested because no central register exists, but the British Security Industry Association has consistently estimated the total at somewhere between four and six million, covering both publicly operated systems — those run by police forces, local authorities, and Transport for London — and the vastly larger estate of privately operated cameras in retail premises, offices, housing estates, and transport hubs. The public cameras represent a relatively small fraction of the total, but they are the ones most directly relevant to law enforcement use and most subject to legal oversight obligations.
For most of the period since CCTV became widespread in British towns and cities in the 1990s, the cameras simply recorded. Footage was reviewed after an incident by human analysts, an extraordinarily labour-intensive process given the volume of material. The transformation brought about by AI is that cameras are increasingly being asked to analyse in real time: to detect specific behaviours, identify individuals, count and classify people and vehicles, spot anomalies, and generate alerts — all without a human watching the feed at the moment the relevant event occurs. This shift from passive recording to active analysis changes the nature of CCTV as a surveillance tool fundamentally, and it has happened largely without the legislative framework that governs CCTV having been updated to reflect it.
The Surveillance Camera Code of Practice and its limits
The Protection of Freedoms Act 2012 established the office of the Surveillance Camera Commissioner and created the Surveillance Camera Code of Practice, a statutory code that applies to police forces and local authorities in England and Wales operating surveillance camera systems in public places. The code requires that surveillance be necessary and proportionate to the aim it serves, that data not be retained for longer than necessary, that appropriate signage be displayed, and that systems be subject to regular review.
The Surveillance Camera Commissioner's role is advisory and promotional rather than regulatory: the office can publish reports, promote the code, and refer concerns to the Information Commissioner's Office, but cannot itself impose sanctions. For forces and local authorities that are formally committed to the code — evidenced by registering with the Commissioner's office — there is a reputational incentive to comply. For the vast majority of private operators, the code has no application at all, and even for public bodies, enforcement has historically been limited.
A more fundamental problem is that the code was written before the current generation of AI analytics tools existed. Its requirements — necessity, proportionality, minimisation — are clearly capable of applying to AI-enabled analytics, but the code provides no specific guidance on how they do so, what a DPIA for an AI-enabled surveillance system should contain, or what signage would be adequate to notify members of the public that footage is being analysed rather than merely recorded. The Commissioner's office has acknowledged these gaps and has called for an updated statutory framework, but legislation has not followed.
Automatic Number Plate Recognition
Automatic Number Plate Recognition — ANPR — is probably the most extensive AI surveillance system currently operating in British policing, and one of the least discussed in public debate. The National ANPR Service, managed by the Police Digital Service, processes more than sixty million reads per day from a network of fixed and mobile cameras spread across motorways, A roads, town centres, and police vehicles. Each read captures the vehicle's registration plate, the time and location, and an image of the vehicle, all of which is stored centrally for a default period of two years.
ANPR data is used operationally to identify stolen vehicles, vehicles linked to suspects, and vehicles crossing the boundary of an area subject to an investigation. It can be used to reconstruct a vehicle's movements over days, weeks, or months — a capability that creates a detailed record of the driver's patterns of life that would have been available only through dedicated physical surveillance in a previous era. The legal basis for retaining this data on all vehicles regardless of suspicion, and for the breadth of queries permitted against it, has been the subject of repeated legal challenges and has been considered by the courts in England and Wales and by the European Court of Human Rights. The courts have generally upheld the regime while imposing conditions around access and oversight; critics argue those conditions are insufficiently robust relative to the scale of the database.
AI analytics layered on to CCTV
Beyond ANPR, a range of AI analytics capabilities are being added to CCTV networks in both policing and smart city contexts. Crowd density monitoring — algorithms that estimate the number of people in a given area from camera footage and alert operators when crowd levels approach a threshold associated with safety risk — is one of the more established applications, having been used at major events for several years. Abandoned object detection, which flags items left unattended in public spaces, is similarly relatively mature.
More contested applications include behavioural analytics tools that attempt to identify behaviour associated with aggression, distress, or criminal activity from how a person moves or interacts with others. These tools have been marketed to police forces and transport operators with claims about their ability to identify fights before they escalate or to detect signs of distress in individuals at risk of self-harm on railway platforms. The evidence base for their reliability in real-world conditions is limited, and the rate of false alarms — generating alerts for behaviour that is entirely benign — is a significant operational concern as well as a civil liberties one.
A particularly controversial episode in the UK context was the disclosure in 2019 that the developer of the King's Cross estate in central London had operated a facial recognition system linked to the CCTV network across the site without informing the public, the local authority, or the Information Commissioner's Office. The ICO investigated and found that the operator had failed to carry out a lawful DPIA and had not identified a legal basis for the processing. The episode illustrated that facial recognition in semi-public spaces was not confined to police operations, and prompted significant debate about the regulatory gap covering private-sector surveillance.
Drones in policing
Police forces across England and Wales have acquired drone fleets with increasing speed since the late 2010s. The National Police Chiefs' Council has encouraged forces to develop drone capability, and the National Police Air Service has integrated drones — formally termed Unmanned Aerial Systems or UAS — into its operations alongside conventional helicopters. Drones offer policing advantages over fixed cameras and aircraft: they are cheaper to operate than helicopters, can be deployed rapidly to specific locations, can fly at low altitude with high-resolution cameras, and can carry thermal imaging equipment that is effective at night or in poor weather.
The regulatory framework for police drone operations is a patchwork. The Civil Aviation Authority governs how drones may be flown — airspace authorisation, proximity to people and buildings, registration and competency requirements — but does not regulate what can be done with the footage collected. Data protection law and the Human Rights Act govern the collection and use of data, and forces must comply with the Surveillance Camera Code of Practice when using drones for surveillance. There is no single piece of legislation specifically addressing police drone use, and the legal basis for specific operations — flying over a protest, tracking a suspect across multiple locations over an extended period, deploying thermal imaging to locate individuals in their gardens — has not been tested comprehensively in court.
The AI dimension of drone policing is developing rapidly. Automated object tracking — where the drone's camera system locks on to and follows a specific vehicle or person without requiring a human operator to manually control the camera — is already available in commercial drone products used by police forces. Onboard processing of video footage in real time, rather than transmitting raw footage to a ground station for analysis, is an emerging capability. And the integration of drone footage with ANPR, facial recognition, and other surveillance data streams creates analytical capabilities that go considerably beyond what any individual system can achieve in isolation.
Smart city surveillance partnerships
The concept of the smart city — urban environments in which sensors, cameras, and data networks are integrated to improve service delivery and public safety — has been actively promoted by central government and technology vendors for more than a decade, with varying degrees of uptake from local authorities. In practice, the policing dimension of smart city infrastructure often develops separately from and less visibly than the transport or environmental monitoring dimensions, and the governance arrangements for data sharing between local authority surveillance systems and police forces are not always clearly documented or publicly accessible.
Birmingham City Council operates one of the largest publicly operated CCTV networks in the country outside London, and has historically had close working arrangements with West Midlands Police for real-time data sharing. South Wales has been the site of several innovative — and contested — surveillance partnerships between the police, local councils, and private sector operators. The regulatory framework for these partnerships, and specifically the data sharing agreements that govern what police can access from privately operated or local authority cameras and under what conditions, is an area where transparency has generally lagged behind operational development.
The Investigatory Powers Act and covert surveillance
Overt surveillance — CCTV, ANPR, drone footage in public spaces — sits within a different legal framework from covert surveillance, which is governed primarily by the Investigatory Powers Act 2016. The 2016 Act — known to its critics as the Snoopers' Charter, a label that predates the legislation and attached to earlier proposals under the Coalition and Cameron governments — consolidated and extended the legal basis for bulk interception of communications, equipment interference, and the retention of bulk datasets. Its relevance to AI in policing lies primarily in the provisions governing bulk datasets and data retention, which create the legal framework within which large-scale data analytics by intelligence agencies and police forces with access to intelligence products operates.
The Investigatory Powers Act established the Investigatory Powers Commissioner's Office as an independent oversight body, and the annual reports of the IPCO provide some of the most detailed publicly available information about how surveillance powers are used in practice. However, the operational detail of how AI analytics are applied to bulk datasets and what safeguards govern their use remains largely outside the public domain.
Follow the coverage
PoliceAI News tracks AI surveillance stories continuously — new camera network deployments, drone operations, legal challenges, ICO decisions, and policy developments as they happen.
View Live Surveillance StoriesYou can also browse the full archive on this topic or explore related subjects: facial recognition, data protection and GDPR, and AI bias and discrimination.