Regulation isn't the same thing as prohibition. Biometric sign-in wouldn't be covered by their suggestions. This is probably because biometric sign-in is not inherently abuse of AI/ML. It certainly can be though, but covering that would require prohibiting AI/ML in its entirety, even at home or in academia.