European Commission publishes guidelines on the AI Act's banned AI practices

The European Commission's guidelines on prohibited artificial intelligence practices are official guidance explaining which AI uses the EU AI Act treats as posing unacceptable risk.

The Commission published the guidance in February 2025, shortly after the AI Act's first set of bans became applicable.

What it is

The guidelines address the AI Act's list of banned practices, including harmful manipulation, social scoring and real-time remote biometric identification.

They are meant to ensure the bans are read and applied the same way across every EU member state.

The document itself is non-binding, and the Commission notes that only the Court of Justice of the European Union can give an authoritative reading of the prohibitions.

It provides legal explanations and practical examples intended to help organisations understand and comply with the requirements.

What it requires

Under the AI Act, systems considered a clear threat to safety, livelihoods or rights cannot be placed on the market at all.

The February 2025 guidance covers the first eight of the Act's nine banned practices, which had just become subject to application.

The Commission issued this guidance alongside a companion document on the AI system definition, published two days later, which is also non-binding and is designed to evolve over time as new questions and use cases arise.

Both documents were framed as support for the limited set of rules that started to apply on 2 February 2025, covering the AI system definition, AI literacy and a narrow set of prohibited use cases.

What security leaders should do

Use the guidance as a checklist to review any product feature that personalises, scores or profiles people, since these are the categories the Commission's examples focus on. Treat the document as interpretive rather than final, and track how national regulators and eventually the Court of Justice apply it in practice, since the Commission itself reserves authoritative interpretation for the court. Pair a review of the prohibited-practices guidance with the companion AI system definition guidance so that teams first confirm whether a given tool is an AI system under the Act before assessing whether it falls into a banned category. Build the review into existing AI governance and procurement processes rather than treating it as a one-off legal exercise, since the guidance is expected to be updated as new use cases surface.