Despite their pronounced potential, unacceptable-risk AI systems, such as facial recognition, have been used as tools for, inter alia, digital surveillance and policing. This usage raises concerns in relation to the protection of basic freedoms and liberties and upholding the rule of law. This article contributes to the legal discussion by investigating how the law must intervene, control and regulate the use of unacceptable-risk technologies that concern biometric data from a human-rights and rule of law perspective. In doing so, the article first examines the collection of biometric data and the use of facial recognition technology. Second, it describes the nature of the obligation or duty of states to regulate in relation to new technologies. The article, lastly, assesses the legal implications resulting from the failure of states to regulate unacceptable-risk technologies and investigates possible legal remedies. The article uses some relevant EU regulations as an illustrative example.