EU AI Act bans on prohibited practices and AI literacy duty start to apply

The first binding parts of the EU AI Act took effect on 2 February 2025: the list of prohibited AI practices and the obligation on providers and deployers to build AI literacy. Everything else in the regulation was still on a later timetable.

What it is

The Commission groups the banned uses under one rule: systems seen as a clear threat to people's safety, livelihoods and rights are banned outright. Eight prohibitions became effective in February 2025, among them untargeted scraping of the internet or CCTV to build or expand facial recognition databases. Two days after the start date, on 4 February 2025, the Commission published guidelines covering harmful manipulation, social scoring and real-time remote biometric identification, among others. The guidelines are non-binding; authoritative interpretation rests with the Court of Justice of the EU.

What it requires

The literacy article obliges providers and deployers to take measures ensuring a sufficient level of AI literacy among staff and others who operate or use AI systems on their behalf. The 2026 AI Omnibus later simplified that company requirement and gave the Commission and member states a larger role in promoting literacy. The same amendment added a ninth prohibition, on systems generating non-consensual intimate content or child sexual abuse material, effective December 2026.

What security leaders should do

Several banned practices sit close to tools security teams already buy: facial recognition, emotion analytics and biometric categorisation can appear inside physical-security, insider-risk or workplace-monitoring products. Ask vendors in writing whether any feature falls under the prohibited list, and switch off modules you cannot clear. For literacy, fold AI risk into existing security awareness training rather than building a separate programme, and keep attendance records as evidence.