Prohibited AI practice: definition, scope and what it obliges you to do
What "Prohibited AI practice" means in practice, where the definition comes from, and the obligations that attach once the term applies to you.
A prohibited AI practice is an artificial intelligence application or deployment banned outright because its risks are deemed unacceptable under the EU AI Act. These practices include manipulative techniques, exploitation of vulnerabilities, social scoring of people by public or private actors, and certain types of biometric categorization or untargeted facial image scraping. Organizations operating AI systems must verify their use cases against these prohibitions before initiating development, deployment, or commercialization.
Origin and regulatory grounding of banned AI practices
The legal basis for prohibiting specific artificial intelligence applications stems directly from the foundational text of the EU AI Act. European legislators established these rules to protect fundamental rights, democracy, the rule of law, and environmental sustainability against particularly harmful applications of machine learning and algorithmic systems. Rather than regulating how these systems are built or monitored, the framework draws a hard line by declaring certain capabilities entirely incompatible with the values of the jurisdiction.
Compliance and legal-operations teams must look to the primary legislative text to understand the exact contours of each prohibition. The European Commission provides additional context through its European Commission — regulatory framework for AI portal, detailing how these rules fit into the broader governance structure. The prohibitions apply universally across sectors, meaning that no amount of internal risk mitigation or technical documentation can cure an artificial intelligence practice that falls squarely into a banned category.
When evaluating software inventories, organizations often use the risk-engine or related compliance discovery tools to separate permissible applications from forbidden ones. Because the prohibitions are absolute, finding even a single prohibited practice in the deployment pipeline requires immediate cessation of that activity. Regulatory authorities enforce these rules through significant monetary sanctions and operational restrictions, making early identification essential for legal teams.
Understanding the legislative intent helps compliance officers interpret borderline cases correctly. The prohibitions target technologies that manipulate human behavior, subvert free will, or introduce discriminatory sorting mechanisms that undermine basic societal trust. Reviewing official guidance from bodies such as the EDPB — published documents helps clarify enforcement priorities and supervisory expectations regarding these restricted methodologies.
The definitive legal test for identifying a prohibited practice
To determine whether an artificial intelligence system constitutes a prohibited practice, compliance professionals apply a specific functional and intent-based test derived from the EU AI Act. The test examines whether the system deploys subliminal techniques beyond a person's consciousness to materially distort behavior in a manner that causes or is reasonably likely to cause significant harm. It also evaluates whether the software exploits vulnerabilities of specific groups due to age, disability, or a specific social or economic situation.
Another critical branch of the test involves evaluating whether public or private actors use social scoring systems that lead to detrimental or unfavorable treatment in unrelated contexts. The test scrutinizes biometric identification practices in publicly accessible spaces for law enforcement purposes, subject to narrow exceptions defined in the statute. Organizations can structure their internal evaluations by mapping out their intended features against these statutory triggers.
| Evaluation Criterion | Statutory Focus | Compliance Action Required | |---|---|---| | Subliminal Manipulation | Systems deploying covert techniques | Immediate halt and removal | | Vulnerability Exploitation | Age, disability, or socioeconomic targeting | Immediate halt and removal | | Social Scoring | Evaluation or classification of people by public or private actors | Immediate halt and removal | | Biometric Scraping | Untargeted facial image harvesting | Immediate halt and removal |
If an application triggers any of the criteria outlined above, it fails the legal test and cannot be placed on the market or put into service. Teams should consult the methodology and data-sources pages to understand how compliance software evaluates these features. Conducting a thorough initial triage prevents wasted engineering effort on products that violate core statutory red lines.
The test leaves no room for partial compliance or compensating controls. An AI system that fails the prohibition test cannot be salvaged by adding human oversight, watermarking, or transparency notices. Legal operations teams must ensure that product managers understand this binary nature during the earliest phases of ideation and design.
Operational consequences once a system is classified as prohibited
Once an artificial intelligence application is identified as a prohibited practice, the legal status of the project changes instantly. The organization can no longer legally develop, test on real-world subjects, deploy, or distribute the software within the regulated jurisdiction. This requires an immediate freeze on all engineering, marketing, and sales activities associated with the specific capability. Management must reallocate resources away from the banned initiative to ensure no further exposure occurs.
For providers and deployers operating across multiple borders, a prohibited practice in one jurisdiction may force a complete architectural redesign of the global product. Teams often utilize the cross-border-compliance resources to understand how regional differences affect their deployment strategies. Failing to withdraw a banned system can trigger severe enforcement actions from market surveillance authorities, resulting in substantial financial liabilities and reputational damage.
Legal operations teams must also review existing contracts, licensing agreements, and partnership arrangements tied to the affected software. If a vendor has supplied a component or model that constitutes a prohibited practice, immediate indemnification and termination protocols may be triggered. Organizations can review their broader governance posture using the trust and about documentation to verify that corporate compliance policies adequately address these worst-case scenarios.
Documentation of the decision to halt a prohibited project is critical for defending against regulatory inquiries. Auditors will examine how quickly an organization identified the violation and whether it took decisive steps to decommission the system. Maintaining a clear paper trail through internal compliance management tools ensures that the enterprise can demonstrate good-faith adherence to the statutory mandates.
Frequent compliance mistakes during initial artifact screening
Organizations frequently make avoidable errors when screening their artificial intelligence portfolios for prohibited practices. One common mistake is assuming that commercial off-the-shelf components or foundational models are pre-cleared by the upstream vendor. Providers and deployers share independent legal responsibilities under the EU AI Act, meaning that integrating a prohibited capability into a downstream product still exposes the deployer to direct liability.
Another frequent misstep involves confusing technical intent with actual functional impact. Development teams often believe that if an algorithm's manipulative or exploitative feature is framed as experimental or optional, it escapes the prohibition. However, the legal test focuses on the objective capability and potential outcome rather than the developer's stated subjective intent. Teams can avoid this trap by consulting the faq and learn sections for practical compliance insights.
A third error occurs when organizations rely solely on automated checklists without involving legal and compliance experts in the review. Automated tools can flag potential risks, but complex use cases involving biometric categorization or emotion recognition in the workplace require nuanced legal interpretation. Enterprises should leverage the agents and risk-engine functionalities to structure their review processes while maintaining human oversight over final determinations.
Finally, teams often fail to update their screening procedures when regulatory guidance evolves. As supervisory authorities issue new interpretations regarding borderline applications, static compliance programs miss critical shifts in enforcement posture. Regularly reviewing updates via the snapshot feature helps maintain alignment with current regulatory expectations and prevents outdated compliance assumptions from compromising the product pipeline.
Distinguishing prohibited practices from adjacent regulatory classifications
Compliance teams frequently confuse prohibited AI practices with adjacent regulatory concepts such as high-risk systems or general-purpose models. A prohibited practice is entirely forbidden, whereas a high-risk system is legally permitted provided it meets stringent compliance obligations. Understanding this distinction is vital, as misclassifying a prohibited system as merely high-risk will lead to unlawful market placement and severe regulatory penalties.
For example, while certain biometric systems are banned outright, other biometric applications are categorized as high-risk and can be deployed after undergoing a rigorous conformity-assessment. Similarly, general-purpose models governed by the general-purpose-ai-model framework are permissible as long as they comply with transparency and evaluation mandates, unless their specific fine-tuning or deployment ventures into a prohibited domain. Teams should review the high-risk-ai-system definition to ensure accurate tiering of their software inventory.
Another point of confusion arises around the roles of different market actors. An ai-provider creating a model bears different statutory duties than an ai-deployer putting it into service, but neither actor can legally introduce a prohibited practice regardless of their contractual division of labor. Technical documentation requirements, such as those associated with technical-documentation-annex-iv, apply exclusively to permissible systems and are never applicable to prohibited practices because those systems cannot be documented for legal deployment.
Post-market obligations also differ significantly across categories. While permitted systems require ongoing post-market-monitoring and incident reporting, a prohibited practice cannot be monitored into compliance. Once a system is confirmed to be prohibited, the only legally acceptable post-market action is immediate withdrawal from the market and permanent decommissioning of the software artifact.
BizLegal AI is regulatory research software, not a law firm. This page is general information, not legal advice, and does not create a lawyer-client relationship. Verify every deadline, threshold and obligation against the primary source cited before you act on it, and consult qualified counsel in the relevant jurisdiction.
Frequently asked questions
Can a prohibited AI practice be made legal by obtaining explicit user consent?
No, user consent cannot cure a prohibited AI practice under the regulatory framework. The statutory prohibitions are absolute red lines designed to protect fundamental rights and public safety, meaning that individual opt-ins or contractual waivers do not exempt an organization from these bans.
Do the prohibitions apply differently to private enterprises compared to public authorities?
Most prohibitions apply universally across both private and public sectors, though certain exceptions exist specifically for law enforcement, border control, and judicial authorities under strict statutory conditions and judicial authorization.
What immediate steps should a legal team take if a prohibited practice is discovered?
The organization must immediately halt all development, testing, deployment, and commercial distribution of the affected system. Legal and compliance officers should document the decommissioning process and review contracts with vendors or partners involved in the deployment.
Are research and development activities exempt from prohibitions?
Testing AI systems in real-world conditions outside of controlled laboratory environments generally falls under the regulatory scope, and deploying prohibited practices for testing on human subjects is strictly forbidden.
Sources
BizLegal AI is regulatory research software, not a law firm. This page is general information, not legal advice, and does not create a lawyer-client relationship. Verify every deadline, threshold and obligation against the primary source cited before you act on it, and consult qualified counsel in the relevant jurisdiction.
Last reviewed 2026-10-06.