EU Commission Issues Guidelines on Prohibited AI Practices Under EU AI Act
On February 4, 2025, the European Commission (EC) issued draft guidelines clarifying the AI practices that are prohibited under the European Union’s (EU) Artificial Intelligence (AI) Act. While non-binding, the guidelines provide valuable clarifications and practical examples to assist businesses in navigating their obligations under the AI Act. The EC has approved the draft guidelines, with formal adoption anticipated in the near future.
Background
Effective February 2, 2025, the AI Act’s provisions on prohibited AI practices came into force, coinciding with other provisions on AI literacy. Article 5 of the AI Act explicitly prohibits certain AI practices deemed to pose unacceptable risks, including systems that manipulate or exploit individuals, perform social scoring, or infer emotions in workplace or educational settings.
The ban applies to both companies offering such AI systems and those utilizing them. The guidelines provide concrete examples of practices classified as prohibited, alongside those that are permissible.
Notably, the AI Act may also apply to companies outside the EU, should they make an AI system or a general-purpose AI (GPAI) model available on the EU market, or if the output generated by the AI system is utilized within the EU.
Prohibited AI Practices
Below is an overview of the main prohibitions under the AI Act as interpreted by the guidelines:
- Social Scoring: The AI Act prohibits offering or utilizing AI systems that assess individuals’ social behaviors to determine their treatment in unrelated contexts. For instance, AI systems that recommend insurance premiums based on unrelated personal characteristics could constitute social scoring. However, AI-enabled scoring providing privileges to online shoppers with a strong purchase history is not included in this prohibition.
- Manipulation and Exploitation: The use of AI systems employing subliminal techniques or exploiting individual vulnerabilities to influence behavior and cause harm is prohibited. Examples include AI in games that encourage excessive play by exploiting children’s vulnerabilities. Conversely, AI systems designed to assist with language learning transparently and without coercive elements are permissible.
- Facial Recognition and Biometric Identification: The AI Act bans the creation of facial recognition databases through indiscriminate scraping of images from the internet or CCTV footage. For example, scraping facial images from social media for a recognition database would be prohibited. However, scraping non-facial data, such as voice samples, is not covered by this ban.
- Emotion Recognition in Workplaces and Educational Institutions: AI usage for recognizing emotions in these settings is generally prohibited. Examples include tracking employee emotions in call centers or inferring students’ attention in classrooms. However, emotion recognition for medical and safety purposes is exempted.
- Biometric Categorization: The categorization of individuals based on sensitive attributes such as race or sexual orientation using biometric data is forbidden. The guidelines clarify that AI systems categorizing individuals for commercial services, such as facial filters on an online marketplace, are permissible as long as the categorization is technical and necessary.
Responsibilities for AI Providers
The guidelines stipulate that providers of AI systems are responsible for not releasing systems that are “reasonably likely” to be used for prohibited purposes, as well as for implementing safeguards to prevent foreseeable misuse. This includes adopting technical safeguards, user controls, and restrictions of use.
AI providers are expected to clearly exclude the use of their systems for prohibited practices in their terms and provide clear usage instructions. Continuous compliance is essential, necessitating ongoing monitoring and updates to AI systems placed on the market. Should a provider become aware of misuse, they must take appropriate measures.
Next Steps
Companies engaging in prohibited AI practices may incur significant fines, reaching up to EUR 35 million or seven percent of their global annual turnover, whichever is higher. The first enforcement actions are expected in late 2025 as EU countries finalize their enforcement regimes. Companies offering or using AI in the EU should review their systems and terms in light of these guidelines and address compliance gaps promptly.
