Can we keep our existing card readers and controllers?

In most cases yes. Face recognition attaches at the decision layer and hands its result to the existing access controller on the same interface a reader uses, so the controller, the lock and the door hardware stay as they are. The card path normally stays live as the fallback and as the visitor route.

Does the face data leave our building?

It does not have to. Ayonix runs at the edge, on an on-premise server, or fully air-gapped, and in all three the images and templates stay inside the customer's own network. No call to an Ayonix service is required to perform a match.

Can someone get in using a photograph on a phone?

That is what liveness detection, also called presentation attack detection, exists to prevent, and it should be part of the specification rather than an option. It is also one of the things a pilot has to test explicitly, on the actual hardware at the actual door, because its behaviour depends on the camera and the lighting.

What happens if the network or the server goes down?

The door should fall back to the existing credential path — a card, a PIN or an intercom — and stay usable. A face recognition layer that can lock people out of a building when it fails is a design fault rather than a limitation, and it is worth writing the required behaviour into the specification before installation.

Does it still work when people wear masks?

Masked operation is supported, and it is a normal requirement in Japan rather than an edge case. It is also a condition that moves results, so it belongs in the pilot: test with the coverings people at that site actually wear, rather than accepting a general statement about mask support.

Is Ayonix NIST certified for access control?

No, and no vendor is. NIST runs evaluations and publishes reports on how submitted algorithms performed; it does not certify, approve or endorse vendors, and it maintains no approved-vendor list. Ayonix has participated in NIST face recognition evaluations, which means algorithms were measured — a certification claim would describe something that does not exist.

How many people can one door handle?

The population size matters less at a door than it does in a search system, because access control is normally a verification: one live capture against the record for the person claiming entry. What governs throughput at a door is capture quality and how people approach it, which is why pilots are run at shift change rather than at a quiet hour.

Face recognition for access control

Face recognition for access control uses the person as the credential, so nothing can be lent, lost or copied. It is a verification problem at a door: one live capture against the record for whoever is claiming entry, decided in the time somebody takes to reach for a card.

By Jan Mocary, Chief Technology Officer, Ayonix AI

Last updated: September 19, 2026

What does face recognition change about a door?

A card, a fob and a PIN all share one property: they are separable from the person. They can be lent to a colleague working late, left at home, cloned from a reader, or photographed over a shoulder. Every access log built on them records which credential was presented, not who presented it. Face recognition removes that gap, because the credential and the person are the same thing.

Nothing to issue, re-issue or collect back when someone leaves.
Nothing to lend, so the log records a person rather than a token.
Hands free, which matters at doors people reach carrying things.
Tailgating becomes visible: the camera sees two faces where the door expected one.

The trade is that a face is not revocable. A compromised card is cancelled and replaced in a minute; a compromised face template cannot be. That is the reason the rest of this page is mostly about where the data sits and who can reach it, rather than about matching.

Where does the matching actually run?

This is the first architectural decision and it governs almost everything after it. Three arrangements are in normal use, and the right one depends on how many doors there are, how tolerant the site is of a network outage, and what the organisation is willing to have leave its own network.

Arrangement	Suits	Fails when
At the door (edge device)	A handful of doors, or doors that must keep working when the network does not	The directory grows past what the device holds, or enrolment has to be managed per door
On-premise server	Most multi-door sites: one directory, one place to enrol, one place to audit	The link between door and server drops and no local fallback was designed
Air-gapped	Sites where no image or template may leave the network under any circumstance	Nothing: it is the same as on-premise, with the outbound path removed

Where the comparison happens, and what each choice costs

Ayonix runs in all three. The distinction that matters commercially is that none of them requires face images or templates to be sent to a vendor's cloud service in order to work, which is what makes the question answerable at all for public-sector and healthcare buyers.

Can it be retrofitted to existing doors and readers?

Usually, and the retrofit is normally an addition rather than a replacement. Access control hardware is layered, and face recognition attaches at the layer that decides, not the layer that locks.

A camera is placed to capture a face at the approach to the door, at the height and angle people actually arrive at.
The recognition service compares the capture against the record for the person claiming entry and produces a decision.
That decision is handed to the existing access controller on the same interface a card reader uses, so the controller, the lock and the door hardware are unchanged.
The existing card or PIN path stays live alongside it, as the fallback and as the enrolment mechanism for visitors.

The integration work is almost always in the controller interface and in the directory, not in the recognition. A site that has already standardised its controllers is a short project; a site with four generations of panel is a longer one, and that is worth establishing before a pilot rather than during it.

How does enrolment stay current as people join and leave?

An access control directory is only as good as its leavers process, and face recognition makes that sharper rather than softer. A card that was never collected back stops working the moment it is revoked in the system. A face template that is never deleted keeps matching.

Enrolment is a deliberate, consented act with a known capture quality, not a frame lifted from a corridor camera.
The directory should be driven from the system that already knows who works here, so a leaver is removed by the process that already exists.
Deletion has to be real deletion of the template, and it has to be demonstrable to an auditor.
Visitors and contractors need a path that expires by itself rather than one somebody has to remember to close.

Where an organisation cannot yet drive enrolment from its own directory, the honest sequence is to run the pilot on a small, manually managed population and fix the integration before the rollout, not after it.

What happens when the match fails?

Every biometric system rejects someone it should have admitted, some of the time. A face recognition deployment is not judged on how rarely that happens; it is judged on what the door does when it does.

The door refers rather than refuses: the person falls back to a card, a PIN or an intercom, and gets in.
The referral is logged as a referral, so the rate is visible and can be tuned rather than guessed at.
The threshold is set with the operator, against their own tolerance for referrals, not shipped as a default.
A network or server outage fails to the existing credential path, never to a locked door.

A design that turns a false rejection into an incident will be switched off within a month of go-live, whatever it scored in evaluation. A design that turns it into a few seconds and a card tap survives, and the referral log is what tells you where the camera or the lighting needs work.

What does Japanese law require of the face data?

Facial recognition data collected from identifiable individuals falls under Japan's Act on the Protection of Personal Information, administered by the Personal Information Protection Commission. An access control deployment therefore has to be able to say what is held, why, for how long, and who can reach it — before it is installed rather than when it is asked.

Personal Information Protection Commission — the Act and its rulesThe regulator's own publication of the legislation governing personal data in Japan, including its handling requirements.
Privacy, retention and human reviewHow to set retention, what a human review step is for, and the questions a deployment has to be able to answer.

The architectural choice in the second section is what makes most of these questions answerable. A deployment where images and templates never leave the organisation's own network has a short, checkable answer to who can reach the data; one that routes captures to an external service has a longer one.

How should an access control pilot be sized?

On the doors that are actually difficult, not the easy ones. A pilot on a well-lit lobby door with twenty cooperative staff proves very little about a loading bay entrance in February.

Choose one easy door and one hard one, and measure both.
Measure referral rate, not accuracy: it is the number the operator will feel.
Run through a shift change, when people arrive in a group rather than singly.
Include the fallback path in the test, because it is part of the system.

How to run a face recognition pilotWhat to measure, on whose data, and how to tell a real result from a demonstration.
Camera placement for face recognitionHeight, angle, lighting and distance — the variables that move capture quality more than the engine does.

Frequently asked questions

Can we keep our existing card readers and controllers?: In most cases yes. Face recognition attaches at the decision layer and hands its result to the existing access controller on the same interface a reader uses, so the controller, the lock and the door hardware stay as they are. The card path normally stays live as the fallback and as the visitor route.
Does the face data leave our building?: It does not have to. Ayonix runs at the edge, on an on-premise server, or fully air-gapped, and in all three the images and templates stay inside the customer's own network. No call to an Ayonix service is required to perform a match.
Can someone get in using a photograph on a phone?: That is what liveness detection, also called presentation attack detection, exists to prevent, and it should be part of the specification rather than an option. It is also one of the things a pilot has to test explicitly, on the actual hardware at the actual door, because its behaviour depends on the camera and the lighting.
What happens if the network or the server goes down?: The door should fall back to the existing credential path — a card, a PIN or an intercom — and stay usable. A face recognition layer that can lock people out of a building when it fails is a design fault rather than a limitation, and it is worth writing the required behaviour into the specification before installation.
Does it still work when people wear masks?: Masked operation is supported, and it is a normal requirement in Japan rather than an edge case. It is also a condition that moves results, so it belongs in the pilot: test with the coverings people at that site actually wear, rather than accepting a general statement about mask support.
Is Ayonix NIST certified for access control?: No, and no vendor is. NIST runs evaluations and publishes reports on how submitted algorithms performed; it does not certify, approve or endorse vendors, and it maintains no approved-vendor list. Ayonix has participated in NIST face recognition evaluations, which means algorithms were measured — a certification claim would describe something that does not exist.
How many people can one door handle?: The population size matters less at a door than it does in a search system, because access control is normally a verification: one live capture against the record for the person claiming entry. What governs throughput at a door is capture quality and how people approach it, which is why pilots are run at shift change rather than at a quiet hour.