Ready set go! Parts of the EU's AI Act commence soon

The AI Act will trickle into effect over time, but a critical aspect commences shortly. To get things started, Chapter II which deals with prohibited AI practices will apply from 2 February 2025.

Prohibited AI practices

It is prohibited to place on the market, put into service or use AI systems that have certain features or are intended to be used for particular purposes (see Article 5). These are considered to present an unacceptable risk – they have been identified as particularly harmful uses of AI that, incongruous with EU values, violate fundamental rights.

At the moment these are (noting that they will be reassessed annually):

• subliminal, manipulative or deceptive techniques;
• techniques exploiting vulnerable groups in each case which materially distorts behaviour and risks significant harm;
• social scoring in certain use cases;
• predicting criminality based on profiling;
• scraping the web or CCTV for facial recognition databases;
• interferences with emotions at workplaces or schools;
• biometric categorisation to infer race, political opinion, trade union membership, religious or political beliefs, sex life or sexual orientation;
• real-time remote biometric identification in public spaces for law enforcement purposes.

There are exceptions to these, but case-by-case analysis is needed. Be mindful that these prohibitions do not curtail any other restrictions or limitations placed on AI practices under other laws (eg the GDPR and consumer protection laws).

The prohibitions are sweeping and do not attach to particular roles (eg provider, deployer, distributor or importer of an AI system).

Importantly, non-compliance can be sanctioned by fines of up to €35 million or 7% of total worldwide annual turnover for the proceeding financial year (whichever is higher) (noting that the penalties provisions commence on 2 August 2025).

Extends to certain Australian AI systems and practices

AI systems can fall within the scope of the AI Act even when they are not placed on the market, put into service or used in the EU (eg where an operator established in the EU contracts certain services to an operator established in a third country) (see Article 2). There are some exceptions (eg certain law enforcement exercises, military defence and national security activities, and particular preliminary research and development activities).

Action to be taken

An immediate next step is to examine your AI systems to see whether they are captured by the AI Act. If so, you will need to check whether they fall under a prohibited category and whether any exceptions apply. Once that is sorted, track any updates to the prohibitions as the list may change over time.