Catalog / Computer Vision / VIS-045

AI-assisted X-ray & CT security screening (baggage, parcels, cargo)

Automatic threat recognition on dual-energy X-ray and CT images of baggage, parcels, mail and cargo, so that screeners review only alarms and see better images.

Parts needed to run it yourselfPrediction & time seriesVision

Aviation, customs, prisons, courts and logistics hubs must inspect large volumes of bags and parcels for weapons, explosives and contraband. Dual-energy X-ray and CT scanners with built-in automatic threat recognition detect explosives and prohibited items, flag only suspicious items and let screeners concentrate on real alarms. This is a certified-equipment domain: the AI is shipped inside type-approved scanners, not assembled by the end user.

Problem & value

  • Today: hold baggage is screened by CT-based explosive detection systems (EDS) with automatic decisions; cabin baggage is still often viewed by humans on 2D X-ray, with a manual search for liquids, electronics and prohibited items. Parcel, mail and cargo hubs use the same technology for security and customs.
  • AI value: consistent detection independent of screener fatigue, fewer false alarms and manual searches, higher throughput, and (with CT at checkpoints) laptops and liquids staying in bags. Detection is automatic for explosives and increasingly for weapons, lithium batteries, narcotics and other contraband.
  • Regulatory driver: in the EU, the equipment and its detection performance are prescribed by Implementing Regulation (EU) 2015/1998 and tested under the ECAC Common Evaluation Process (CEP) [1][2]. Performance figures are classified; vendors publish no detection rates, so do not trust marketing numbers without a certification reference.

Variants

  • Hold baggage (EDS): fully automated, alarm-only viewing under ECAC EDS Standard 3 or later (3.1 / 3.2); alarmed bags go to a screener or a secondary check [2].
  • Cabin baggage at checkpoints: CT scanners with automatic explosive detection (the ECAC "C" levels, C1 to C3, increase automation) and prohibited-item detection for weapons and batteries [2].
  • Parcels, mail and air cargo: high-throughput X-ray and CT in sorting hubs for security and customs, including lithium-battery and dangerous-goods detection.
  • Customs and cargo containers: large-scale X-ray/gamma systems with AI-based manifest-versus-image comparison; links to ANOM-021 (customs risk targeting).
  • Prisons, courts, government buildings: smaller scanners with weapon and phone/contraband detection.
  • Remote screening: images from several lanes or airports are reviewed in a central room (network-based screening), with automatic detection reducing the workload.

How it works

  1. scan (dual-energy X-ray or CT volume)
  2. image reconstruction & material estimation (density, Zeff)
  3. segmentation into objects
  4. automatic threat detection (explosives: material + shape classifier; weapons: object detector)
  5. decision: clear | alarm (+ highlighted region)
  6. screener review of alarms or secondary search / trace detection
  7. logging, performance monitoring, threat-image projection (TIP) for training
  • Explosive detection is mostly physics-based: CT yields density and effective atomic number per voxel, classifiers separate threat materials from benign items. Prohibited-item detection (guns, knives, batteries) is object detection/segmentation on 2D or 3D data, increasingly with deep learning.
  • Human-in-the-loop: screeners resolve alarms, and in cabin-baggage lanes they may still view every image. Regulation decides which decisions may be automatic; operators cannot lower this.
  • Threat-image projection (TIP) injects virtual threats into live images to measure and train screener vigilance; related AI features rank bags or propose a region of interest.

Data preparation

The relevant data are X-ray and CT images, the bag or parcel metadata, threat library configurations and screener decisions with alarm outcomes. Images stay in the scanner vendor's system and its archive; metadata come from baggage handling, parcel or customs systems; procedures sit in manuals and PDF files.

Typical gaps: proprietary image formats that are hard to export, no linkage between image and the final resolved outcome (what was in the bag), few real threat examples, strongly imbalanced classes, and unclear retention and access rules. Real threat images are restricted and cannot be freely collected, so training relies on threat image projection (TIP) and synthetic data.

Preparation steps: (1) agree with the scanner vendor on export formats and interfaces, see PREP-005; (2) link images with resolved alarm outcomes and harvest labels from them, see PREP-020; (3) define a category scheme aligned with the detection standard, see PREP-019; (4) build a held-out test set with certified experts, see PREP-018; (5) clarify access rights and retention, see PREP-024; (6) record screener feedback on false alarms, see PREP-021. Expect more than half of the effort in data work and standards compliance. Start with GUIDE-003.

Implementation paths

Which path for whom

  • Enterprise: Path A, because airport, logistics and parcel operators must use certified scanners with approved detection algorithms; the detection function is part of the type-approved product.
  • Public: Path A, because authorities and aviation security must use certified equipment and standards, so there is no room for self-built detection.
  • Developer: Path C, because research and integration teams can train and evaluate open detection models on public X-ray datasets and run them on modest hardware (HW1) for add-on tools such as prioritisation or image enhancement.

Path A — Buy (the normal route)

  • Certified scanner vendors: Smiths Detection (UK, iCMORE detection algorithms, CT systems), Rapiscan (Rapiscan Systems, US/UK; OSI group), Leidos (ClearScan, US), Nuctech (China; note procurement and security policies in several states), Analogic (CT), Vanderlande and Beumer (EU: baggage-handling integration of EDS), Astrophysics, plus Rohde & Schwarz (EU) for walk-through people scanning, which is a separate domain with its own rules.
  • Selection criteria: the machine and the detection software must be on the national/EU list of approved equipment for the intended standard (EDS Standard 3, cabin C-levels, ECAC CEP results) [1][2]. Check upgrade path for new threat libraries and algorithm updates, because software change can trigger re-certification.
  • Choose A: always, for regulated screening points. Integration (lane control, baggage handling, reconciliation) is delivered by the vendor or an integrator.

Path B — Build on cloud APIs

  • Not suitable for the primary security decision: images are classified, latency is hard real-time and detection must be certified. Cloud services only make sense for non-regulated analytics: operational dashboards, screener-performance analytics, or customs/parcel triage in unregulated settings (internal mailrooms, warehouses).

Path C — Self-host (open source)

  • Research and prototyping, not certified use: open datasets such as SIXray, PIDray, OPIXray, CLCXray and the HiXray collection, and object detectors such as the YOLO family, RT-DETR, Mask R-CNN or Segment Anything-style models, as starting points for contraband detection in non-regulated environments (private mailrooms, events, industrial lines).
  • Hardware: HW1 for inference at the scanner edge, HW2 for training small models.
  • Limit: publicly available datasets show mostly staged threats on 2D images, which transfer poorly to real bags and to CT; a self-built model cannot replace certified EDS.

Path D — Custom training

Done by scanner vendors and a few research groups, not by operators. It requires large libraries of real and simulated threat scans, access to controlled materials and test laboratories, and a certification path. Operators contribute their alarm-resolution data (where legally and contractually permitted) to improve false-alarm rates and new item categories.

State of the art (2026)

  • CT everywhere: CT is established in hold-baggage screening and spreading through cabin-baggage checkpoints, which enables 3D object and material analysis and removes the need to unpack laptops and liquids in many airports [2].
  • Deep-learning detection of weapons and batteries on 2D and 3D images is commercial and continues to improve; explosive detection remains tied to certified, physics-informed algorithms.
  • Operational limits: false alarms (dense food, electronics, cluttered bags), a long tail of new threat forms and concealment, domain shift between scanner models, and difficulty evaluating performance because test data are classified. Academic benchmarks (SIXray, PIDray) do not represent certified conditions; reported academic accuracy should not be used for procurement.
  • Trends: remote and networked screening, AI-based screener assistance (region-of-interest highlighting), risk-based screening, and dynamic updates of threat libraries.

Shared resources & combinations

  • Detection stack: object detection and segmentation shared with VIS-001 (inspection), VIS-053 (NDT X-ray/CT) and HLTH-001 (radiology, same image physics but regulated as medical).
  • Combinations: VIS-010 (video surveillance at the checkpoint), VIS-044 (counter-UAS at the same airport), ANOM-021 (customs risk targeting selects which containers get scanned), and VIS-016 only where a legal basis exists for biometric processing at the same lanes.

Effort, cost & KPIs

  • Path A: procurement and certification-driven projects take quarters to years; costs are dominated by scanner hardware, lane integration, maintenance and staffing, not the software.
  • KPIs: alarm rate and false-alarm rate (set by the certified configuration), manual-search rate, throughput (bags per hour), screener workload and TIP detection rate, availability, and the time to update threat libraries.

People & change

Involve management and the security department lead as owners of the screening process, and the screeners who work with the system every day. Add IT and IT security (scanner network, updates), legal and compliance (approval and certification of equipment, liability) and the DPO, because images may show personal items and screener performance data are personal. Vendors and the competent authority must be part of any change to the detection configuration.

Works council: yes. Screener performance and false-alarm statistics are suited to monitor employees' performance, so §87(1) no. 6 BetrVG applies under the BAG's objective suitability test. Inform it in good time under §90(1) no. 3, consider an expert under §80(3) and agree a works agreement that excludes individual performance rating (GUIDE-004). In public bodies the staff council applies. Check whether a DPIA is needed for the performance data and conclude an AVV with vendors (GUIDE-005).

AI literacy: Art. 4 AI Act requires measures that support staff literacy; train screeners on what the system does and misses and how to treat alarms (GUIDE-006). Pilot at one lane, with the screener's decision remaining final (GUIDE-009). Typical concern: deskilling and surveillance. Address them through continued screener training, human final decision and transparent use of statistics. See GUIDE-008 for communication and GUIDE-014 for AI Act duties.

Risks, regulation & compliance

  • EU aviation security: Implementing Regulation (EU) 2015/1998 and its detailed (partly classified) acts define permitted equipment and standards; ECAC CEP tests EDS and other screening equipment; national authorities approve operations [1][2].
  • EU AI Act: classification depends on context. Screening scanners are in general not high-risk by default: civil-aviation security law (Reg. (EC) 300/2008) is listed in Annex I Section B, where only a few AI Act articles apply via later sectoral acts; AI used for border checks or access control may fall under Annex III. Verify per product; check with legal counsel and the vendor's conformity statement [3]. Art. 5 prohibitions matter if screening is extended to people: biometric categorisation by sensitive traits, untargeted face scraping and emotion recognition in the workplace are prohibited.
  • GDPR: bag images may reveal personal items; images linked to bag tags and passengers are personal data, so retention should be short and access limited. Body scanners are covered by a separate regulatory regime (no storage of images, automatic detection of generic anomalies only).
  • Risks: automation bias, adversarial concealment, model changes that invalidate certification, supply-chain and security-policy concerns about non-EU vendors, dependence on one vendor for threat libraries.
  • Mitigations: keep certified configuration frozen, change control for updates, TIP and screener recertification, independent performance monitoring, local data handling.

Getting started

  1. Identify the regime: aviation (EU 2015/1998), customs/postal, prison/court, or private logistics, and which standard (EDS Standard 3, C-levels) applies.
  2. Get the national approved-equipment list and the vendor's certificates before any tender.
  3. For unregulated mailrooms, start with a 2D X-ray unit with a vendor detection licence and a pilot.
  4. Define KPIs, data-retention rules and the screener workflow (alarm resolution, escalation).
  5. Plan change control for software updates and threat libraries.

Sources

  1. European Commission — Aviation security legislation, Implementing Regulation (EU) 2015/1998 — https://eur-lex.europa.eu/eli/reg_impl/2015/1998/oj
  2. ECAC — Common Evaluation Process (CEP) for security equipment — https://www.ecac-ceac.org/activities/security/common-evaluation-process
  3. Regulation (EU) 2024/1689 (AI Act) — https://eur-lex.europa.eu/eli/reg/2024/1689/oj
  4. Smiths Detection — EDS Standard 3 explosive detection systems — https://www.smithsdetection.com/market-sectors/aviation/accelerate-security-with-ecac-eds-standard-3-explosive-detection-systems
  5. Beumer Group — ECAC Standard 3 overview — https://www.beumergroup.com/app/uploads/2024/07/ECAC-Standard-3.pdf
  6. SIXray dataset (Miao et al., CVPR 2019) — https://github.com/MeioJane/SIXray
  7. PIDray dataset (Wang et al.) — https://github.com/bywang2018/security-dataset