A biometric entry system shipped without an SOP, an unpublished expert panel, and a privacy law gap mean every office, bank, and gated entrance is inheriting the same template.
Maharashtra's Assembly became a test lab for a question most offices, banks, and gated buildings have not yet had to answer out loud: when a face replaces an entry pass, who consents, who stores the scan, how long is it kept, and what stops it from being reused?
The Assembly installed facial recognition at its doors ahead of the 2025 monsoon session, with the new biometric rules notified on the 19th and the session starting on the 22nd. On day one, the system blocked reporters and officials from getting in. State Assembly Speaker Rahul Narwekar acknowledged "technical problems" and said they would be sorted out, according to the Times of India. The official reason for the rollout, given to reporters that day, was past instances of fake and duplicate passes being used to enter the legislature.
That story was narrowed to a glitch narrative and let the harder questions stay in the lobby. The harder questions came from opposition members inside the House and they were three explicit objections plus an obvious gap: whether consent was taken before a face was captured, where the image data is stored, what mechanism prevents misuse, and how long the biometric template is retained. The first three are what opposition members put on the record inside the Assembly. The fourth is the question any retention policy has to answer even when no one asks it out loud. The Assembly has not published an answer to any of them.
A biometric gate inside a state legislature has one feature no office, no bank, and no apartment complex can match when it fields the same questions: the people passing through it are the same people whose job it is to write the rules for biometric processing. Open Magazine's analysis makes the case bluntly: facial recognition is "possibly the most suspect" biometric, its appeal is convenience rather than certainty, and that makes it a poor standalone gate for a high-security zone and a defensible additional layer. The Assembly installed it as a standalone gate.
The defence sits on a real prior problem. State Assembly officials told reporters the rollout was a response to fake and duplicate pass incidents, the Times of India reported. Replacing a forgery-prone physical pass with a face template does address that specific failure mode, and the failure mode is real. It also, by construction, creates the four questions above, because a face template is not a pass. It is a biometric identity record keyed to a single human, and once stored it carries a different risk profile than a laminated card.
Ministers in the Assembly's coalition government conceded enough of that risk to promise a fix. The Maharashtra government committed to setting up an expert panel within 30 days to frame standard operating procedures for AI use, with the surveillance row over the entry system as the named trigger, according to the Economic Times and the Free Press Journal. CNBC TV18 described the panel as the state's policy response to the privacy concerns the rollout had triggered.
Whether the panel was constituted on time, who sat on it, and what SOP it produced are not in the public reporting available. The 30-day commitment is a ministerial announcement, not a settled policy outcome, and the gap between announcement and outcome is itself the policy signal. A legislature that built the biometric gate before publishing the rules has now built an expert-panel timeline that may or may not have a board, a chair, or a draft to point to.
The template does not stay in Maharashtra. Every commercial office park on a security upgrade cycle, every private bank piloting face-authenticated transactions, every gated residential campus considering visitor face capture will eventually face the same four questions. They will not get a free answer from a regulator either. India does not yet have a dedicated personal-data-protection regime covering biometric processing at the entrances to public buildings, as Open Magazine's analysis of the Assembly rollout noted. The state that just became the test case is running the test while its answers are still invisible.
What to watch: whether the expert panel is actually constituted, whether its draft SOP answers the four questions by name, and whether the Assembly's biometric gate is opened up to a public audit on retention, storage location, and access logs. If those three things happen, the Maharashtra template becomes a defensible model. If they do not, it becomes the first chapter of a rulebook that every other institution inherits by copying it.