Artificial intelligence in surveillance: from signal to decision

An operational chain, not a magic feature

A useful system starts with a specific risk: night-time intrusion, unauthorised access, an emerging fire, a fall or an abandoned object. The team then chooses sensors, rules, confidence levels and procedures. AI can pre-qualify an event; an operator verifies the alarm, checks the context and decides whether to contact an owner, dispatch an officer or take no action. Automating the chain before responsibilities are defined only makes confusion arrive faster.

• Documented fact: current systems can extract objects, trajectories and anomalies within a defined scope.
• Realistic capability: combine several clues into a contextualised alert.
• Limitation: high probability proves neither identity, intent nor an offence.
• Illustrative scenario: video is checked after a person is detected outside opening hours, before any response.

From raw pixels to a verifiable alert

A camera may produce dozens of frames each second, but an operator needs a structured event: area, time, proposed class, trajectory, confidence level and video immediately before and after. Temporal tracking prevents one person from generating twenty alerts in twenty seconds. Business rules add context: a delivery at 14:00 is normal; the same movement behind a closed gate at 02:10 deserves checking.

Correlation is decisive on complex sites. One video detection might be a reflection. Combined with a gate contact and radar event in the same time window, it becomes more credible. Conversely, a valid access credential might reduce its priority. A sound architecture retains contradictory evidence rather than forcing artificial certainty. The applicable guidance is set out in Artificial intelligence regulation in Switzerland (Federal Chancellery).

• Detect: find a presence, crossing, apparent smoke or unusual variation.
• Classify: propose person, vehicle, animal, parcel or another defined class.
• Correlate: connect video, thermal, access control, radar, acoustics and robot or drone position.
• Prioritise: apply severity, confidence, time, zone and team availability.

Identification is a separate decision

Recognising a category is not identifying an individual. Face recognition and number-plate reading introduce different technical and legal questions. NIST continues to measure demographic differences between face-recognition algorithms and notes that image quality, lighting and angle affect false negatives. For many private-security requirements, detecting an intrusion and checking the scene is sufficient; collecting identity would be disproportionate.

Computer vision: objects, zones and trajectories

Computer vision can detect people and vehicles, track movement, count crossings or identify a boundary breach. Performance depends on field of view, pixels on target, occlusion, weather and lighting. A strong model may disappoint when the camera is too high, vegetation moves constantly or reflective clothing confuses the image. Site design remains decisive.

Anomaly analysis learns or formalises what is usual and flags deviations. It might reveal movement at an unusual time or a vehicle travelling against the normal flow, but rare does not mean dangerous. An unscheduled maintenance contractor is a legitimate anomaly. These systems are most useful for discovery and prioritisation, backed by careful human verification.

Thermal imaging and multi-sensor fusion

Thermal imaging is valuable for finding a warm signature in darkness, light mist or a low-contrast scene. Manufacturers such as Axis position it for perimeter detection while noting that thermal images do not provide the same identifying detail as visible cameras. Warm surfaces, thermal reflections, animals and seasonal variation still require local calibration. An operator may call up an optical camera aimed at the same zone to assess the alert. The stated specifications are detailed in Q2111-E thermal camera for perimeter detection (Axis Communications).

Fusion may happen early, by combining raw data, or late, by correlating events generated by individual sensors. Late fusion is often clearer and more resilient in security operations: if one sensor fails, the others continue and the evidence behind an alert remains visible. A good system shows this provenance instead of one opaque score.

• Visible-light imaging: contextual detail for verification, sensitive to image conditions.
• Thermal imaging: day-and-night detection and low visual contrast, with limited identity detail.
• Radar or LiDAR: distance, direction and motion, without independently explaining the scene.
• Access sensors: precise events, but credentials may still be lent or stolen.

Make the trade-off scenario by scenario

For a perimeter alert, seconds matter and an intermittent connection can be critical, so local detection, an encrypted buffer and a degraded mode are preferable. For trend analysis across several warehouses, a central platform may be appropriate. Power, model maintenance and bandwidth matter alongside licence price.

Test degraded operation. What happens when the internet link, GPS, analytics server or network clock fails? Sensors should report their own unavailability, critical events should remain recorded and the team needs an alternative procedure. AI that explicitly says it cannot reach a conclusion is safer than a silent failure.

Minimise before transmitting

Cropping to the useful area, masking neighbouring spaces, converting video to metadata or promptly deleting irrelevant feeds reduces exposure. Local processing does not automatically make a system compliant or secure: a poorly administered edge device remains a connected computer. Inventory equipment, control access, encrypt communications and govern updates. The applicable guidance is set out in Artificial Intelligence Risk Management Framework 1.0 (NIST).

Build defensible ground truth

Ground truth is the human label used to judge a model. It must define what really counts: is a silhouette behind a fence an intrusion if the person remains on the pavement? Two annotators may disagree; those disagreements often expose an ambiguous operating rule. Resolve them before deployment instead of hiding uncertainty in a score.

The validation set should cover day, night, seasons, rain, snow, backlighting, protective equipment and people with different sizes and mobility. Rare cases deserve controlled tests: a simulated intrusion, an open door or a partly obscured camera. Recordings of people must remain necessary, proportionate, secured and subject to a retention limit.

Drift: the world changes after acceptance testing

A new fence, moved camera, growing vegetation, software update or changed operating pattern may alter inputs and results. Monitoring server availability alone is insufficient. Track the distribution of alerts, resample negative cases, compare performance by camera and revalidate after material change. Model updates should be versioned and reversible. The applicable guidance is set out in AI Act application timeline (European Commission).

A global accuracy figure hides the useful problems

Accuracy without context says little. Ask for the confusion matrix, alert precision, event recall and results by camera, time and condition. With a rare event, even a low false-positive rate may produce more false than true alerts. Alerts per shift and the human time they consume describe operational impact more clearly.

Bias can enter through data, optics, annotation, thresholds or the context of use. NIST face-recognition evaluations show demographic differentials and the influence of image quality. The answer is not a claim of a neutral model, but targeted evaluation, limited use of sensitive functions and a means of challenge where results affect people. The underlying research is available in Face Recognition Technology Evaluation: demographic effects (NIST).

Explain enough to act and audit

In security operations, a useful explanation need not be a mathematical derivation. An operator needs the triggered zone, proposed class, corroborating sensors, contextual clip, applied threshold and model version. A manager should be able to reconstruct why an alert was escalated or dismissed. A heat map may help but does not replace documentation and testing.

• Set error tolerances by scenario and severity.
• Segment tests by relevant conditions instead of relying on one average.
• Regularly sample rejected alerts to look for missed events.
• Log model version, threshold, rationale and human action.

A short procedure for every alert

Each scenario should define who receives the alert, what evidence they check, the response time, who can be contacted and when escalation is justified. The interface should show the relevant seconds before and after the event, a site plan and nearby sensor states. During uncertainty, the operator should be able to mark the result indeterminate rather than force it into a harmless or malicious category.

Sensitive decisions should not be triggered by a single probability. A robot can move to an authorised observation point, lights can come on or a remote announcement can be made, but dispatching an officer or calling public authorities requires contextual verification. Urgent safety procedures may be more automated only where they are risk-assessed, tested and designed with safe fallback.

Train people to challenge the AI

Automation bias encourages people to accept a system's suggestion, while alert fatigue encourages them to dismiss repeated alarms. Training must cover both. Operators should recognise confidence levels, sensor limitations and out-of-distribution scenes, and be rewarded for documenting a justified disagreement. Those disagreements are valuable data for calibration and governance.

Layered security remains the strongest defence

Segment the security network, disable unnecessary services and protect administration with strong authentication. Encrypt communications and backups and limit rights by role. Maintain an inventory of devices, firmware, models and dependencies with owners, versions and end-of-support dates. Test signed updates before deployment and preserve rollback.

Logs should reveal a disabled camera, changed threshold, bulk export or unusual connection. Important clips need verifiable integrity. Conventional penetration tests remain necessary, complemented by robustness tests: partial camera masking, misleading patterns, out-of-distribution data and alert flooding. No defence is absolute, so the incident plan must cover isolation, continuity, notification and restoration.

• Unique identities, least privilege and regular access reviews.
• Network segmentation, encryption and device monitoring.
• Model and data provenance, signatures and controlled updates.
• Tested backups, degraded operation and a cyber-response procedure.

The Coop case: functional limits can protect people

In October 2025, the FDPIC completed its preliminary review of intelligent cameras used by Coop at certain self-checkouts. After examining their operation, it found that they neither performed face recognition nor analysed purchasing behaviour and concluded that the processing complied with the FADP without creating an increased risk to affected people. This documented case does not approve every AI camera. It shows the value of a bounded objective, clear information and expressly excluded functions. The applicable guidance is set out in Preliminary Coop review: intelligent cameras at self-checkouts (FDPIC) and Video surveillance in the workplace (FDPIC).

For private projects, restrict coverage to the property, generally avoid public space, inform people, set necessary retention and protect data. In a workplace, security filming must not become continuous behaviour monitoring. Impact assessments, privacy masks and independent validation are design tools, not paperwork to complete after installation.

Prepare for the EU without confusing legal regimes

The EU AI Act enters its general application phase on 2 August 2026, with separate dates for some obligations and high-risk systems. It places strict controls on several biometric uses. A Swiss company supplying or deploying a system in the EU must determine its role and use case. Even where the Act does not apply directly, documenting risks, data, performance, supervision and changes supports trust and international readiness.

Voluntary frameworks complement legal duties. The NIST AI RMF organises governance around Govern, Map, Measure and Manage, while ISO/IEC 42001 defines a management system for continuous improvement of AI. Neither replaces law or context-specific legal analysis, but both give security, IT, management, suppliers and privacy professionals a shared vocabulary. The applicable guidance is set out in Switzerland signs the Framework Convention on AI (Council of Europe) and ISO/IEC 42001:2023, AI management systems (ISO).

Measure impact end to end

Read technical and human KPIs together: recall, alert precision, indeterminate rate, availability, presentation delay, verification time and action time. Add alerts per operator hour, silent failures and differences by condition. A flattering rate cannot compensate for a late alert.

Measurement must lead to a decision: maintain, recalibrate, expand, reduce or stop. Before wider deployment, require ownership and export of logs, a retention policy, performance by scenario, Swiss support, reversibility and accountability for errors. Reject guarantees of zero false positives and models that change without history.

• 1. Map risks, zones, affected people and possible responses.
• 2. Define ground truth, thresholds, edge cases and stopping criteria.
• 3. Test in real conditions, including outage, weather and contradictory scenarios.
• 4. Train operators, document decisions and audit exceptions.
• 5. Expand only after operational gain and risk control are demonstrated.

What My Robot Guard contributes

My Robot Guard can bring sensors, cameras, robots, drones, analytics and human supervision together around your actual scenarios. The aim is not to put AI everywhere, but to create an explainable chain: what signal is captured, how is it qualified, who verifies it and what action becomes possible? Depending on the site, the best answer may be a simple rule, multi-sensor fusion or a targeted mobile patrol.

A rigorous assessment starts with the premises, movement flows, feared incidents and data-protection constraints. It produces an architecture, tests and indicators that security, IT and management teams can challenge. That is how AI moves from an abstract claim to a measurable decision-support tool.