ARTICLE 19 Report Exposes EU-LISA's Role in Border Surveillance Expansion

A report by the digital rights group ARTICLE 19, presented in a contribution published by the European Digital Rights network EDRi, examines how the European Union is enlarging its border surveillance apparatus, with attention on the agency EU-LISA. The agency is described as little scrutinised, even though it builds and maintains the large IT systems that support EU migration and border management.

According to the piece, the EU began in October 2025 to gather and retain the fingerprints and face scans of all non-EU nationals who cross its outer frontier through the Entry/Exit System (EES). A second system, ETIAS, due by late 2026, will screen travellers who need no visa before they arrive. Together the two systems could process more than 1.4 billion travellers, combining biometric, migration, visa and policing information in searchable profiles. ARTICLE 19 reviewed EUR 1.99 billion in contracts that EU-LISA awarded between 2019 and 2025.

The analysis finds that private firms, among them IDEMIA, Sopra Steria, IBM and Leonardo SpA, hold substantial power over how the systems work, because procurement hands them large blocks of biometrics, engineering and operations. Surveillance capacity could therefore grow through technical adjustments decided by companies instead of by accountable political choices. For migrants, taking part is compulsory, and a single database error could spread across the network and lead to delayed or denied entry or to visa refusals, with little clarity on how to challenge a decision.

ARTICLE 19 calls for the GDPR and the AI Act to be enforced without their broad exceptions for migration and law enforcement, for binding transparency duties on EU-LISA procurement, and for migrant-led and digital rights groups to take part in design and evaluation. It will keep monitoring EU-LISA.