Prohibited AI Practices

What Is Prohibited AI Practices?

The EU AI Act draws clear red lines. Article 5 bans eight categories of AI practices outright, with the highest penalties in the regulation: up to 35 million euros or 7% of global turnover. In this exercise, you recognize prohibited deployments across your organization: including emotion recognition in the workplace, social scoring of customers, and untargeted scraping of facial images for biometric databases: and take the right action before each system goes live.

What You'll Learn in Prohibited AI Practices

• Identify the eight categories of AI practices prohibited under Article 5 of the EU AI Act
• Recognize prohibited practices even when disguised as beneficial tools or voluntary programs
• Understand that employee consent does not override Article 5 prohibitions
• Know the correct escalation path when discovering a prohibited AI deployment
• Understand the penalty tier for prohibited practices (35M euros / 7% turnover)

Prohibited AI Practices — Training Steps

1. The Absolute Red Lines

   Article 5 bans certain AI practices outright in the EU. Breaches carry the highest fines: up to 35 million euros or 7% of global annual turnover, whichever is higher. The eight prohibited categories under Article 5(1): (a) Manipulative or deceptive techniques that materially distort behavior and cause, or are likely to cause, significant harm (b) Exploiting vulnerabilities due to age, disability, or social or economic situation to materially distort behavior in a way that causes, or is likely to cause, significant harm (c) Social scoring leading to detrimental treatment in unrelated contexts, or treatment that is unjustified or disproportionate (d) Predicting crime based solely on profiling or personality traits (e) Untargeted scraping of facial images from the internet or CCTV for recognition databases (f) Emotion recognition at work or in education (except for medical or safety reasons) (g) Biometric categorization to infer sensitive attributes such as race, political opinions or sexual orientation (h) Real-time remote biometric identification in public spaces for law enforcement, except to search for victims of abduction, trafficking or sexual exploitation and missing persons, prevent a specific, substantial and imminent threat to life or a genuine and present or foreseeable threat of a terrorist attack, or locate suspects of listed serious crimes

2. Day 1: The Mood Tracker Email

   Alice receives an email from the HR Director announcing a new pilot program. The email describes an AI tool that will monitor employees during video meetings.

3. Recognizing the Violation

   This is emotion recognition in the workplace , which is explicitly prohibited under Article 5(1)(f) of the EU AI Act. It does not matter that it is framed as a 'wellness initiative' or that participation is described as voluntary. Any AI system that infers emotions from biometric data (facial expressions, voice tone, body language) in the workplace is banned unless it is used for medical or safety reasons - and wellness and morale do not qualify. The level of anonymization and whether employees consent make no difference.

4. Escalating to Compliance

   Alice recognizes the compliance risk immediately. She replies to David's email, flagging the issue and copying the Data Protection Officer.

5. Knowledge Check

6. Day 3: The Social Scorer

   Two days later, Alice receives a WhatsApp message from a colleague about a concerning new CRM feature the sales team has activated.

7. Spotting Social Scoring

   Alice reads Jamie's message carefully. Two details stand out: customers are being scored on social media activity, and low-scoring customers are being routed to slower support queues.

8. Understanding Social Scoring

   This is social scoring , prohibited under Article 5(1)(c). Returns and support tickets are ordinary business data. The line is crossed by scoring customers on their social media activity, an unrelated context, and using that score to slow their support. That is detrimental treatment in an unrelated context, and also unjustified and disproportionate; either condition alone is enough. It applies to existing and prospective customers alike.

9. Day 5: The Facial Scraper

   Two days later, Alice discovers that the marketing team has built an internal tool demo. She opens it in her browser to review what they have been working on.

10. Untargeted Facial Scraping

    The FaceWatch tool scrapes publicly available photos from social media profiles to build a facial recognition database. Under Article 5(1)(e), untargeted scraping of facial images from the internet or CCTV footage to build or expand facial recognition databases is explicitly prohibited.