The EU AI Act's prohibitions take effect

The first substantive obligations of the EU AI Act, which had entered into force the previous August with a staggered rollout, became legally applicable: the Article 5 prohibitions and a set of AI-literacy obligations for providers and deployers.

Article 5 bans nine categories of AI use outright, without a risk-tiered exemption. Among them: social-scoring systems that rate people by behaviour or predicted characteristics, harmful manipulation or exploitation of vulnerabilities, real-time remote biometric identification by law enforcement in public spaces (with narrow exceptions), untargeted scraping of the internet or CCTV footage to build facial-recognition databases, emotion-recognition systems used in workplaces or schools, biometric categorisation to infer protected characteristics such as race or sexual orientation, and systems for predicting an individual’s likelihood of committing a crime based on profiling alone. A ninth prohibition, covering AI-generated child sexual abuse material, was scheduled to apply later, in December 2026. Alongside the bans, the Act’s AI-literacy provisions require organisations that develop or deploy AI systems to ensure staff have a sufficient understanding of how they work.

Because the Act binds anyone placing a system on the EU market regardless of where it was built, the prohibitions were the first point at which non-European labs had to demonstrate compliance rather than simply await future rules. Enforcement mechanisms were still being stood up in most member states at the time the bans took effect, so the practical test of the prohibitions — investigations, fines, and any contested interpretation of terms like “manipulation” — came later, but 2 February 2025 marked the moment the Act stopped being a future obligation and became a present one.