The best Vision AI solution isn’t the one that analyses everything

Vision AI platforms are becoming increasingly powerful. They can detect people, classify vehicles, analyse movement patterns, measure waiting times, recognise objects, read licence plates and identify unusual situations. With the rise of Generative AI and Vision Language Models, another layer is being added: systems can understand more context and make video searchable using natural language.

But as more becomes technically possible, another question becomes increasingly important:

Should we actually use all of it?

European regulation makes that question more relevant than ever. The GDPR requires organisations to process personal data for a defined purpose and to consider necessity and proportionality. The AI Act introduces additional requirements for the responsible use of AI, with further provisions becoming applicable and enforceable from 2 August 2026. At the same time, NIS2 and the Critical Entities Resilience (CER) Directive are raising expectations around digital and physical resilience across Europe.

Unlike the GDPR and AI Act, NIS2 and CER are directives and therefore have to be implemented through national legislation. This means the exact legal framework differs between Member States. In the Netherlands, for example, NIS2 and CER are implemented through the Cybersecurity Act and the Critical Entities Resilience Act, which entered into force on 15 August 2026. Other European countries have implemented, or are implementing, the same European frameworks through their own national legislation.

The direction, however, is shared across Europe: organisations need to strengthen their resilience while remaining critical about what data they collect, process and retain.

That means the best Vision AI solution is not automatically the one with the highest number of analytics.

Start with the problem, not the technology

Vision AI projects often start with a list of capabilities: Intrusion Detection, People Counting, Cross Camera Tracking, Heatmaps, ANPR, PPE Detection, Queue Management and Natural Language Search.

Technically impressive, but it is actually the wrong starting point.

The first question should be:

What problem are we trying to solve?

Only then should we determine what information is required and which form of AI is appropriate.

An airport trying to understand why queues build up at certain times may only need information about numbers of people, direction of movement, occupancy and waiting time. There is no need to know who individual passengers are.

A manufacturing facility monitoring whether an emergency exit remains clear does not need to identify the employee walking nearby. The system only needs to determine whether the defined area is clear or obstructed.

And for perimeter security, it is often sufficient to know that a person has entered a restricted area at a time when nobody should be there. The identity of that person is not necessarily relevant.

More intelligence does not automatically have to mean more personal data.

Not everything that is visible is relevant

This distinction becomes more important as Vision AI becomes more capable.

A camera captures an entire situation. AI can extract an increasing amount of information from that image. But information that is technically available is not necessarily relevant to the purpose for which the system is being used.

That requires conscious choices. What information do we genuinely need? What information can we deliberately leave out? For how long do we need the analysis? And what happens with its output?

Privacy and responsible AI therefore do not have to be addressed only afterwards through policies and documentation. Some of those decisions can already be made in the technical configuration of the system.

The right AI, on the right camera, at the right time

This creates an interesting opportunity.

Why should an analytic run permanently on a camera when the information is only needed temporarily?

Imagine an organisation wants to understand for four weeks where visitors spend the most time inside a building. Dwell time or flow analytics can be activated for that period. Once the question has been answered, the analysis can be switched off.

The same AI capacity can then be used elsewhere to investigate queues, occupancy or another operational question.

Vision AI becomes less of a static technology that is installed once and performs the same task for years. Instead, it becomes a flexible information infrastructure that can adapt to the organisation’s changing needs.

This is not only more efficient. It also encourages a more deliberate approach:

analyse only where, when and for as long as the information is actually required.

We can think of this as privacy by configuration. Not as a formal legal term, but as a design principle: configure the technology so that it processes the information relevant to a clearly defined purpose, rather than simply analysing everything it can.

From permanent monitoring to targeted information

The same principle changes how organisations can view their camera infrastructure.

Traditionally, video technology is configured camera by camera. A camera is given a function and often continues performing that same function for years.

Vision AI makes a more dynamic model possible. Today a camera might support occupancy analytics. Next month the same camera could be used for queue management. Another camera might temporarily support an investigation into traffic flows or the use of a specific area.

The camera stays the same.

The information requirement changes.

This is particularly relevant for large organisations with hundreds or thousands of existing cameras. Every new information requirement does not necessarily require a new camera or another standalone system. Existing infrastructure can be used much more flexibly.

In security too, less can be more

The same principle applies to security.

An AI platform may be capable of recognising faces, following people, analysing appearance and classifying behaviour. But if the security question is simply whether someone enters a restricted area after closing time, intrusion detection may be all that is required.

Adding more analytics does not automatically make the solution better.

Every additional analysis introduces additional data, configuration, complexity and potentially new privacy and governance questions.

A mature Vision AI strategy should therefore not only ask:

What else can we add?

But also:

What can we deliberately leave out?

That may be less spectacular in a product demonstration, but for large organisations it is ultimately far more important.

Flexibility becomes part of governance

As Vision AI becomes more flexible, this flexibility itself becomes a governance issue.

If AI capacity can easily be moved between camera streams, an organisation can decide much more precisely where analytics are active. Licences and AI resources do not necessarily have to remain permanently attached to one camera or one use case.

This creates the possibility of running temporary analytics campaigns: measure, analyse and learn for a defined period, then move that capacity to the next question.

But technical flexibility needs organisational control. Who is allowed to activate an analysis? For what purpose? On which cameras? For how long? What information is retained? And when should the analysis be switched off again?

Technical flexibility only becomes truly valuable when combined with governance.

The power is not in using as much AI as possible

Vision AI platforms will continue to become more capable. New models will understand more of what happens in video, and users will be able to activate new analyses more easily.

That makes it tempting to collect increasingly more information.

A mature approach to Vision AI requires the opposite.

Start with the problem. Determine what information is actually required. Choose the minimum analysis needed and activate it only where and when it adds value.

The best Vision AI solution is therefore not the one that continuously analyses everything.

It is the one that gives organisations the flexibility to analyse exactly what is needed — and the control to deliberately leave everything else out.