What happened. Under Article 113 of Regulation (EU) 2024/1689, the AI Act's general provisions (Chapter I) and its list of prohibited practices (Chapter II, Article 5) became applicable on 2 February 2025, six months after the Regulation entered into force. On the same date the AI-literacy duty in Article 4 began to apply: providers and deployers must take measures to ensure a sufficient level of AI literacy among the staff who operate AI systems on their behalf. The Commission published non-binding guidelines on the prohibited practices on 4 February 2025 and guidelines on the definition of an 'AI system' two days later.
What is banned. Article 5 lists eight families of practice, among them: manipulative or deceptive techniques that materially distort behaviour and cause significant harm; exploiting vulnerabilities linked to age, disability or a social or economic situation; social scoring that leads to detrimental or disproportionate treatment; assessing the risk that a person will commit a crime based solely on profiling or personality traits; untargeted scraping of facial images from the internet or CCTV to build recognition databases; emotion recognition in workplaces and education, except for medical or safety reasons; biometric categorisation to infer sensitive characteristics such as political opinions or sexual orientation; and real-time remote biometric identification in publicly accessible spaces for law enforcement, which remains possible only for narrowly listed purposes and with prior authorisation.
Why it matters for governance. Several bans address the state directly. The social-scoring prohibition applies to public and private actors alike, and the ban on profiling-based crime prediction constrains tools that police forces have tested. Cases often cited in this debate, such as the Dutch childcare-benefits scandal or Australia's Robodebt, are better understood as failures of risk scoring, burden of proof and appeal than as banned practices; the Act addresses them mainly through its later high-risk rules.
Enforcement. Penalties became applicable on 2 August 2025. Under Article 99, breaches of Article 5 can draw fines of up to €35 million or 7% of worldwide annual turnover, whichever is higher, but each Member State decides to what extent fines can be imposed on its own public authorities. Enforcement lies with national market-surveillance authorities, whose designation was still under way in several countries during 2025.
What to watch. The first enforcement decisions under Article 5; how broadly authorities read 'social scoring' and 'emotion recognition'; whether uses of the law-enforcement exceptions for biometric identification are reported as the Act requires; and whether Member States expose their own administrations to fines. The timetable for high-risk systems was changed separately in 2026.