Responsible AI & computer vision.

Last updated: May 2026.

Johansson Solutions Ltd (JSL) provides computer-vision and analytics systems that operate in public, often safety-critical spaces, transport hubs, major events. The same capabilities that make these systems useful for safety also carry real risks if applied carelessly. This page sets out the principles we work to, and the safeguards we expect to put in place on every engagement.

What our systems do, and do not do

Our analytics generate aggregated, anonymous outputs: counts, densities, walking speeds, flow rates, group composition, dwell statistics. They are designed to support operational decisions about spaces and crowds, not decisions about individuals.

Our systems are not built for, and we do not deploy them for: facial recognition, biometric identification, behavioural profiling of named persons, or any purpose that singles out an individual.

How we work

• Purpose limitation. Each deployment is scoped to a defined operational purpose, typically crowd safety, accessibility, or infrastructure planning, and contracted accordingly. Re-purposing data for unrelated use requires explicit written agreement.
• Data minimisation. We process only the imagery needed for the analytics task, retain it only for as long as the engagement requires, and prefer on-the-fly extraction of metrics over long-term video retention where the client's operational needs allow it.
• Anonymous-by-design outputs. The metrics we deliver, density, flow, speed, Level of Service, group statistics, describe crowds and spaces, not identified individuals. Where demographic segmentation (e.g. mobility-impairment, staff/non-staff, broad gender estimate) is contractually required, it is produced in aggregate form only.
• Bias and validation. We test detector performance against ground truth that reflects the deployment environment, including crowd density extremes that off-the-shelf models are rarely evaluated against. For demographic classifiers, we document the dataset basis, expected error rates, and the explicit operational caveats before any use.
• Human oversight. Our outputs are decision-support, not decision-automation. Operational interventions: diversions, gate closures, capacity calls, remain a human responsibility informed by our data.
• DPIA support. For any UK or EU deployment processing personal data, we support our client (as data controller) in completing a Data Protection Impact Assessment before deployment, and we contribute the technical sections within our scope.
• Security & access control. Camera feeds, intermediate data, and outputs are handled under access controls proportionate to the sensitivity of the deployment, with encryption in transit and at rest where commercially reasonable.
• Transparency. We can describe, in plain language, what each capability does, what it cannot do, and what its known limitations are. We provide that description to clients before contracting and to regulators on request.

Regulatory posture

We design and deliver with UK GDPR, the Data Protection Act 2018, and the UK Surveillance Camera Code of Practice in mind. For deployments in jurisdictions with stricter requirements (e.g. the EU AI Act), we work with clients to map our system against the relevant classification (most of our outputs sit outside the prohibited and high-risk categories, but we assess case-by-case).

Where this is going

This is a living statement. As regulation, deployment contexts, and our own technology evolve, we expect to update it. If you are evaluating us as a supplier or partner and need a longer-form version, for example to support a procurement, a DPIA, or a bid submission — please get in touch.