EU AI ACT: PROHIBITED AI PRACTICES NOW IN FORCE

The EU AI Act came into force on 1 August 2024. Most of its provisions apply from 2 August 2026, but the first provisions prohibiting certain AI practices came into force on 2 February 2025. They are relevant to UK companies if they work in the EU.

Article 5 of the EU AI Act lists various categories of prohibited AI practices. These are banned outright because they are deemed to be incompatible with the fundamental values and rights of the EU. These include AI systems that scrape facial images from the internet or CCTV footage, infer emotions in the workplace or educational institutions, and categorise people based on their biometric data. However, some exceptions are made for law enforcement.

The EU AI Act prohibits the placing on the market, the putting into service or the use of an AI system:

• that deploys subliminal techniques which can materially distort a person’s behaviour by impairing their ability to make an informed decision in a way that causes or is reasonably likely to cause them significant harm;
• that exploits the vulnerabilities of a person or specific group of people which can materially distort their behaviour in a way that causes or is reasonably likely to cause them significant harm;
• for social scoring based on known, inferred or predicted personality characteristics which causes detrimental or unfavourable treatment that is disproportionate or used in a context unrelated to the context in which the data was originally collected;
• for making risk assessments which assess the risk of a person to commit a crime or re-offend;
• that indiscriminately web-scrape for the purposes of creating or enhancing facial recognition databases;
• to infer emotion in the areas of workplace or educational institutions;
• that is a biometric categorisation system used to infer characteristics, such as race, political opinions or religion; and
• that utilises real-time, remote biometric identification systems in publicly accessible spaces for the purpose of law enforcement except for limited circumstances.

Breach of the prohibited AI practices can result in a maximum fine which is the higher of €35 million or 7% of total worldwide annual turnover for the preceding financial year.

The UK is no longer a member of the EU, but the EU AI Act is still potentially relevant to clients in the UK and operating internationally. In particular, our clients in the built environment who use AI-driven tools for design, safety and project management. They could be impacted by the EU AI Act if their tools or services are used in EU projects or involve EU stakeholders. This is because the EU AI Act has extraterritorial scope, meaning UK companies supplying or deploying AI systems on EU projects must comply.

Companies should take a number of steps to ensure they remain compliant:

• Conduct AI audits – regularly assess AI systems to ensure they do not engage in prohibited practices.
• Implement AI literacy training – ensure that staff and suppliers have a sufficient understanding of AI, including its opportunities and risks.

Stay informed – keep up to date on further developments in AI and regulation.