EU AI Act first enforcement actions — prohibited AI practices take effect
Date: 2025-02
Affected: AI providers and deployers operating in EU market with prohibited AI systems
Attack vector: rce
Category: real-world
Severity: High

The EU AI Act's prohibited practices provisions took effect on 2 February 2025, banning social scoring systems, emotion recognition in workplaces/schools, and untargeted facial recognition scraping. Several companies received enforcement warnings for AI systems that fell under prohibited categories. The enforcement created precedent for how the regulation would be interpreted in practice, particularly around emotion recognition in hiring tools and biometric categorisation.

Impact: Systems decommissioned; enforcement precedent set; compliance costs for AI industry; clarity on regulatory interpretation

Mitigations:
AI system inventory and risk classification against EU AI Act categories
Legal review of AI use cases against prohibited practices list
Pre-deployment regulatory compliance assessment
Monitoring for regulatory updates and enforcement guidance

Architectural layers (MAESTRO):
label: Security & Compliance
notes: First binding enforcement of EU AI Act prohibited practices
role: origin
label: Foundation Models
notes: Models used for social scoring and emotion recognition must be decommissioned
role: impact
label: Data Operations
notes: Biometric data collected for prohibited purposes must be deleted
role: propagation