On 2 February 2025 the provisions of the EU AI Act (Regulation (EU) 2024/1689) on prohibited practices and AI literacy began to apply. This is the first set of substantive obligations in the Act’s staged timetable, and it moves EU AI governance from legislation into enforcement.
Two obligations applying from 2 February
The first is prohibited practices. The Act lists a set of absolutely prohibited uses, including harmful manipulation and deception, exploitation of vulnerabilities, social scoring, and real-time remote biometric identification in certain contexts. There is no compliance exception for these uses; they are simply banned.
The second is the AI literacy obligation. Providers and deployers must take measures to support sufficient AI literacy among their staff and among those operating AI systems on their behalf. The wording is comparatively soft, but it brings “human understanding of the system” within the compliance scope, not only the system itself.
Note that the prohibition on generating non-consensual intimate content or child sexual abuse material applies later, from 2 December 2026. A staged timetable means companies should sequence compliance by provision rather than complete it in one pass. See our notes on transparency rules in force and on GPAI obligations in force.
The 4 February guidelines
On 4 February 2025 the European Commission published guidelines on prohibited practices, giving legal interpretation and practical examples for these provisions, covering harmful AI manipulation and deception, social scoring and real-time remote biometric identification. The guidelines reduce uncertainty in application but do not change the provisions themselves.
For companies providing or deploying AI systems in the EU, the guidelines are the most direct comparison material: they allow a company to judge whether its product has a function falling within the prohibited range, particularly designs involving emotion inference, behavioural manipulation or biometric matching. See our notes on the GPAI code of practice and on the scientific panel regulation.
The judgement to make first
Before launching a full compliance effort, one preliminary judgement matters more: is the company a provider or a deployer, is the product a high-risk system, and does it touch a prohibited use. The answers determine the scope and intensity of everything that follows.
Getting this step right gives the later documentation, testing and labelling work clear boundaries.
This article is based on Regulation (EU) 2024/1689 and the European Commission’s guidelines on prohibited practices of 4 February 2025 and is for reference only; it does not constitute legal advice.