Contents
- Why these bans came into force before the rest of the AI Act
- Full list of prohibitions in force since February 2025
- 1. Subliminal manipulation and exploitation of vulnerabilities
- 2. Social scoring by public authorities
- 3. Real-time biometric identification in public spaces
- 4. Emotion recognition in the workplace and education
- 5. Biometric categorisation inferring sensitive characteristics
- 6. Facial recognition databases built from scraping
- 7. Predictive policing based on profile alone
- What exceptions exist
- Fines for using prohibited AI systems
- Practical impact for technology companies
- How Yeeply can help
Since 2 February 2025, certain uses of artificial intelligence are outright banned in Europe. Not restricted, not conditional: banned. No general exceptions, no additional adaptation period.
The EU AI Act structures AI oversight into four risk levels. The first — unacceptable risk — does not carry compliance requirements: it carries absolute prohibitions. This guide sets out exactly what is banned, with what nuances, and what happens if you ignore them.
Why these bans came into force before the rest of the AI Act
The AI Act applies in phases. Most obligations arrive in August 2026 (high-risk systems) or August 2027 (legacy systems). But the unacceptable risk prohibitions were brought forward to February 2025 because the European Commission deemed they needed no adaptation period: they represent red lines that AI systems should never have crossed.
Full list of prohibitions in force since February 2025
1. Subliminal manipulation and exploitation of vulnerabilities
Prohibited: placing on the market or using AI systems that deploy techniques to influence people’s behaviour in ways that circumvent their rational awareness and can cause harm, and systems that exploit vulnerabilities related to age (children and elderly), physical or mental disability, or socioeconomic situation.
This covers: interfaces designed to create psychological dependency, systems that increase impulse purchases by exploiting cognitive biases in vulnerable groups, and persuasion tools operating below the threshold of conscious perception.
2. Social scoring by public authorities
Prohibited: use of AI by public authorities — or private actors operating on their behalf — to evaluate or classify natural persons based on their social behaviour or personal characteristics, generating a score that leads to detrimental treatment in unrelated contexts.
This covers social credit scoring and also government systems that restrict access to public services based on accumulated behavioural data.
3. Real-time biometric identification in public spaces
Prohibited: use of real-time biometric identification systems — primarily live facial recognition — in publicly accessible spaces for law enforcement purposes. Exceptions are extremely narrow and require prior judicial authorisation:
- Targeted searches for specific victims of trafficking, disappearance or sexual exploitation
- Prevention of imminent, specific and verified terrorist threats
- Localisation and identification of suspects of serious crimes (carrying penalties above 3 years)
Outside these three cases — and always with judicial authorisation — real-time biometric identification in public spaces is illegal for law enforcement.
4. Emotion recognition in the workplace and education
Prohibited: systems that infer the emotional state of people in work or educational settings. Software that analyses whether a worker is focused, distracted, satisfied or tense during their shift; or a system assessing student attention during class. Both are banned.
The prohibition applies to work environments broadly (not only physical spaces) and to all educational levels.
5. Biometric categorisation inferring sensitive characteristics
Prohibited: biometric categorisation systems that classify people based on inferred sensitive characteristics — race or ethnicity, political opinion, trade union membership, religious beliefs, sex life or sexual orientation — derived from biometric data.
The key word is ‘inferred’: the AI Act does not ban facial recognition as such (which has its own regime), but the deduction of these attributes from physical features or biometric patterns.
6. Facial recognition databases built from scraping
Prohibited: creating or expanding facial recognition databases by indiscriminate mass scraping of facial images from the internet or CCTV. Training databases of this type are directly banned regardless of their intended use.
7. Predictive policing based on profile alone
Prohibited: using AI to assess the risk of a person committing a crime based solely on their profile or personal characteristics, without grounding the assessment in observable objective behaviours. Pure criminal prediction — without behavioural evidence — is banned.
What exceptions exist
The only exceptions are for real-time biometric identification in law enforcement (the three scenarios listed above). For all other prohibitions, there are no exceptions.
Nor can the prohibition be circumvented by arguing the system was not designed for that use or that your intentions are good: the AI Act applies based on the actual use of the system, not the declared intent.
Fines for using prohibited AI systems
The AI Act reserves its highest fines for unacceptable risk systems: up to €35 million or 7% of global annual turnover, whichever is higher. For SMEs the calculation is proportional to the turnover percentage.
Supervisory authorities can also order immediate market withdrawal of the system and temporary operating bans.
Practical impact for technology companies
- Employee productivity tools with behavioural analytics: if they infer emotional or cognitive states, they fall in prohibited territory
- Biometric authentication in B2B applications: authentication (verifying who you are) is not banned; what is banned is mass identification and categorisation by sensitive attributes
- Audience or user analytics products: if they include emotion inference or psychological profiling, review carefully
- Candidate screening tools: scoring that includes emotional or psychological assessment without validated scientific basis enters the risk zone
How Yeeply can help
If you are unsure whether an AI component of your product may fall into a prohibited category, the first step is a technical and legal analysis of what the system actually does. At Yeeply we work with certified companies that already build AI Act restrictions into their architectures from design stage.
For projects with tight budgets, we also work with specialist Spanish teams offering the same technical guarantees at 30–40% lower cost. Use the Request a quote button at yeeply.com/en or write to sales@yeeply.com.
Tags
Related posts
What Is RAG? How to Build an AI That Answers From Your Company’s Data
What is RAG? A plain-English guide to AI that answers from your company's documents: how it works, permissions, security, costs and use cases. Prices included.
EU AI Act Compliance Roadmap for Businesses: Deadlines and Priorities in 2026
Step-by-step AI Act compliance roadmap for 2026: which deadlines have already passed, what August 2026 brings, and how to prioritise actions based on your AI system type.
What Is the EU AI Act and Does It Apply to Your Business? (2026 Guide)
Practical guide to the EU AI Act 2026: risk pyramid, who must comply, deadlines already in force and fines of up to €35M. What UK businesses developing or using AI need to know.
AI Governance in Software: What UK Enterprises Are Getting Right (and Wrong) in 2026
What good AI governance looks like in practice for UK enterprises: what companies are getting right, what they miss, and the regulatory landscape for 2026.
Custom Software vs Off-the-Shelf ESG Platform: A Cost Comparison for UK SMEs
Build vs buy for ESG reporting software: licence costs, integration reality, and when custom development makes more sense than an off-the-shelf platform.
AI Integration Costs for Enterprise Apps: What UK Businesses Actually Pay
Real figures for AI integration in UK enterprise apps: chatbots, document processing, fine-tuning. Plus the hidden costs nobody quotes upfront.
ESG Software Requirements: What UK Companies Need to Build Before the UK SRS Deadline
What software UK companies need to build or buy before the UK SRS deadline: data integration, reporting, audit trails and realistic timelines.
How Much Does a Penetration Test Cost in the UK? (2026 Prices)
Real penetration testing prices in the UK for 2026: from £3,000 for a basic web pentest to £80,000 for red team. What's included, what drives costs, and how to hire without overpaying.
How Much Does Enterprise App Development Cost in 2026? Real Prices by Project Type
Enterprise app development costs in 2026 vary widely by project type, technology, and team location. Here are real price ranges and what drives them up or down.
MVP in 6 Weeks: A Step-by-Step Guide for Companies That Want to Test Before Investing
An MVP in 6 weeks is achievable — if you know what to put in it. This guide covers the phases, what to cut, realistic costs, and how to measure whether it worked.
