European Commission Outlines Prohibited Systems Under EU AI Act

The European Commission has outlined the operational boundaries for prohibited artificial intelligence systems under the European Union AI Act.

Under the framework's tiered, risk-based architecture, systems deemed to pose an unacceptable risk to fundamental rights and safety face comprehensive bans across all member states. The prohibition rules become applicable six months after the regulation enters into force, marking the earliest compliance milestone in the framework's phased implementation schedule.

The banned category targets specific AI deployments that manipulate human behaviour to circumvent free will. This includes cognitive behavioural manipulation targeting vulnerable demographics, such as voice-activated toys that encourage dangerous behaviour in children. The framework also outlaws social scoring systems that evaluate or classify individuals over time based on social behaviour, perceived socio-economic status, or known personal characteristics.

Biometric surveillance mechanisms face severe legal curbs under the prohibited tier. The framework forbids the untargeted scraping of facial images from the internet or closed-circuit television footage to build or expand facial recognition databases. Emotion recognition systems are prohibited from deployment within educational institutions and workplace environments.

Additionally, the regulation outlaws real-time remote biometric identification in publicly accessible spaces by law enforcement agencies, permitting its use only under narrow, exhaustively defined exceptions subject to judicial or independent authorisation.

National market surveillance authorities will enforce these bans within individual member states, assisted by an advisory European Artificial Intelligence Board. The AI Office, established within the European Commission in February 2024, oversees general-purpose AI models and enforces uniform implementation across the bloc. General-purpose AI rules take effect 12 months after entry into force, whereas wider requirements for high-risk systems become applicable at 24 and 36 months.

Violations of the prohibited practices criteria incur the framework's highest financial penalties. Regulatory breaches carry administrative fines of up to €35 million or 7 per cent of a company's total worldwide annual turnover for the preceding financial year, whichever is higher. For smaller enterprises, fines scale down to €7.5 million or 1.5 per cent of global turnover.

Will national surveillance authorities maintain the forensic capabilities required to detect illicit biometric scraping and covert workplace monitoring once the six-month deadline arrives?