Overview of prohibited AI practices

Overview on the Prohibitions Provision Prohibition Content Article Harmful manipulation, AI systems that deploy subliminal techniques 5(1)(a) and deception beyond a person’s consciousness or purposefully manipulative or deceptive techniques, with the objective or with the effect of distorting behaviour, causing or reasonably likely to cause significant harm Article Harmful exploitation of AI systems that exploit vulnerabilities due to age, 5(1)(b) vulnerabilities disability or a specific social or economic situation, with the objective or with the effect of distorting behaviour, causing or reasonably likely to cause significant harm Article Social scoring AI systems that evaluate or classify natural persons 5(1)(c) or groups of persons based on social behaviour or personal or personality characteristics, with the social score leading to detrimental or unfavourable treatment when data comes from unrelated social contexts or such treatment is unjustified or disproportionate to the social behaviour Article Individual criminal AI systems that assess or predict the risk of people 5(1)(d) offence risk assessment committing a criminal offence based solely on and prediction profiling or personality traits and characteristics; except to support a human assessment based on objective and verifiable facts directly linked to a criminal activity Article Untargeted scraping to AI systems that create or expand facial recognition 5(1)(e) develop facial databases through untargeted scraping of facial recognition databases images from the internet or closed-circuit television (‘CCTV’) footage Article Emotion recognition AI systems that infer emotions at the workplace or 5(1)(f) in education institutions; except for medical or safety reasons Article Biometric categorisation AI systems that categorise people based on their 5(1)(g) biometric data to deduce or infer their race, political opinions, trade union membership, religious or philosophical beliefs, sex-life or sexual orientation; except for labelling or filtering of lawfully acquired biometric datasets, including in the area of law enforcement Article Real-time remote AI systems for real-time remote biometric 5(1)(h) biometric identification identification in publicly accessible spaces for the (‘RBI’) purposes of law enforcement; except if necessary for the targeted search of specific victims, the prevention of specific threats including terrorist attacks, or the search of suspects of specific offences (further procedural requirements, including for authorisation, outlined in Article 5(2- 7) AI Act).

The AI Act is supported by two legal bases: Article 114 of the Treaty on the Functioning of the European Union (‘TFEU’) (the internal market legal basis) and Article 16 TFEU (the data protection legal basis). Article 16 TFEU serves as a legal basis for the specific rules on the processing of personal data in relation to the prohibition on the use of remote biometric identification (‘RBI’) systems for law enforcement purposes, biometric categorisation systems for law enforcement purposes, and individual risk assessments for law enforcement purposes. All other prohibitions listed in Article 5 AI Act find their legal basis in Article 114 TFEU.

The practices prohibited by Article 5 AI Act relate to the placing on the market, the putting into service, or the use of specific AI systems. As regards real-time remote biometric identification (‘RBI’) systems, the prohibition in Article 5(1)(h) AI Act only applies to their use. Article 3(1) AI Act defines what constitutes an AI system. The Guidelines on the Definition of an AI system provide the Commission’s interpretation of that definition.

According to Article 3(9) AI Act, the placing on the market of an AI system is ‘the first making available of an AI system […] on the Union market’. ‘Making available’ is defined as the supply of the system ‘for distribution or use on the Union market in the course of a commercial activity, whether in return for payment or free of charge.’ 6 The making available of an AI system is covered regardless of the means of supply, such as access to the system and its service through an application programming interface (‘API’), via cloud, direct downloads, as physical copies, or embedded in physical products.

For example, a RBI system developed outside the Union by a third-country provider is placed on the Union market for the first time when it is offered in return for payment or free of charge in one or more Member States. Such placing on the market may occur by providing access to the system online through an API or other user interface.

Article 3(11) AI Act defines putting into service as ‘the supply of an AI system for first use to the deployer or for own use in the Union for its intended purpose’, therefore covering both supply for first use to third parties, as well as in-house development and deployment. The intended purpose of the system is the ‘use for which an AI system is intended by the provider, including the specific context and conditions of use, as specified in the information supplied by the provider in the instructions of use, promotional or sales materials and statements, as well as in the technical documentation.’ For example, a provider builds a RBI system outside the Union and supplies that system to a law enforcement authority or to a private company established in a Member State to be used for the first time, thereby putting it into service. For example, a public authority develops a scoring system in-house and deploys it to predict the risk of fraud of household allowance beneficiaries, thereby putting it into service.

security and justice (AFSJ) annexed to the TEU and TFEU, Ireland may decide not to apply the rules concerning the prohibition of real-time use of RBIs in public spaces for a law enforcement purpose as well as the procedural rules linked to that article (Article 5(2) to (6) AI Act) (see Recital 40). Denmark benefits from opt-out agreements when applying Protocol No. 22 to the TEU and TFEU and may decide not to fully apply the prohibitions based on Article 16 of the TFEU (see Recital 41).

While the ‘use’ of an AI system is not explicitly defined in the AI Act, it should be understood in a broad manner to cover the use or deployment of the system at any moment of its lifecycle after having been placed on the market or put into service. This may also cover the integration of the AI system in the services and processes of the person(s) making use of the AI system, including as part of more complex systems, processes or infrastructure. While providers of AI systems must consider the conditions of use which may be reasonably foreseen prior to placing their AI systems on the market (intended use and reasonably foreseeable misuse), deployers remain responsible for taking the lawful conditions for the use of the system into account. For the purposes of Article 5 AI Act, the reference to ‘use’ should be understood to include any misuse of an AI system (‘reasonably foreseeable’ or not) that may amount to a prohibited practice. For example, an AI system used by an employer to infer emotions at the workspace is prohibited, except when used for medical or safety purposes (Article 5(1)(f) AI Act). The prohibition applies to deployers regardless of whether the provider (the supplier of the system) has excluded such use in its contractual relationships with the deployer (the employer), i.e. in the terms of use.

The AI Act distinguishes between different categories of operators in relation to AI systems: providers, deployers, importers, distributors, and product manufacturers. The present Guidelines will focus only on providers and deployers given the scope of the prohibited practices in Article 5 AI Act.

According to Article 3(3) AI Act, providers are natural or legal persons, public authorities, agencies or other bodies, that develop AI systems or have them developed and place them on the Union market, or put them into service under their own name or trademark (see section 2. above). Providers established or located outside the Union are subject to the provisions of the AI Act if they place those systems on the market or put them into service in the Union, or if the output of the AI system is used in the Union. Providers must ensure their AI systems meet all relevant requirements before placing them on the market or putting them into service.

For example, a provider of a RBI system is the manufacturer of the system that markets the system in the Union under its trademark. The provider of such a system could also be a public authority that develops the system in-house and puts it into service for its own use.

Deployers are natural or legal persons, public authorities, agencies or other bodies using AI systems under their authority, unless the use is for a personal non-professional activity. ‘Authority’ over an AI system should be understood as assuming responsibility over the decision to deploy the system and over the manner of its actual use. Deployers fall within the scope of the AI Act, if their place of establishment or location is within the Union or, if they are located in a third country, the output of the AI system is used in the Union.

Where the deployer of an AI system is a legal person under whose authority the system is used, i.e. a law enforcement authority or a private security company, the individual employees that act within the procedures and under the control of that person should not be considered to be the deployer. A legal person also remains a deployer if it involves third parties (e.g. contractors, external staff) in the operation of the system on its behalf and under its responsibility and control.

Operators may fulfil more than one role concurrently in relation to an AI system. For example, if an operator develops its own AI system that it uses afterwards, it will be considered both the provider and the deployer of that system, even if that system is also used by other deployers to whom the system has been provided in return for payment or free of charge.

Continuous compliance with the AI Act is required during all phases of the AI lifecycle. This necessitates ongoing monitoring of and updates to AI systems placed on the market or put into service in the Union to ensure that an AI system remains compliant with the AI Act throughout its lifecycle and that it does not result in a practice prohibited under Article 5 AI Act. Providers and deployers of AI systems have different responsibilities depending on their roles and control over the design, the development and the actual use of the system to avoid a prohibited practice. For each of the prohibitions, these roles and responsibilities should be interpreted in a proportionate manner, taking into account who in the value chain is best placed to adopt specific preventive and mitigating measures and ensure compliant development and use of AI systems in line with the objectives and the approach of the AI Act.

Article 2 AI Act provides for a number of general exclusions from scope which are relevant for a complete understanding of the practical application of the prohibitions listed in Article 5 AI Act.

2... National security, defence and military purposes

According to Article 2(3) AI Act, the AI Act does not apply to areas outside the scope of Union law, and should not, in any event, affect the competences of the Member States concerning national security, regardless of the type of entity entrusted by the Member States with carrying out tasks in relation to those competences. The AI Act expressly excludes from its scope AI systems that are ‘placed on the market, put into service, or used with or without modification exclusively for military, defence or national security purposes, regardless of the type of entity carrying out those activities.’ Whether that exclusion applies therefore depends on the purposes or the uses of the AI system, not the entities carrying out the activities with that system, which may also cover private operators entrusted by the Member States with carrying out tasks in relation to those competences.

According to the CJEU, the term ‘national security’ refers to ‘the primary interest in protecting the essential functions of the State and the fundamental interests of society and encompasses the prevention and punishment of activities capable of seriously destabilising the fundamental constitutional, political, economic or social structures of a country and, in particular, of directly threatening society, the population or the State itself, such as terrorist activities.’ National security does not cover, for example activities relating to road safety, or the organisation or administration of justice. As stated by the CJEU, ‘it is for the Member States to define their essential security interests and to adopt appropriate measures to ensure their internal and external security, […] a national measure […] taken for the purpose of protecting national security cannot render EU law inapplicable and exempt the Member States from their obligation to comply with that law.’

For the exclusion in Article 2(3), second subparagraph, AI Act to apply, the AI system must be placed on the market, put into service or used exclusively for military, defence or national security purposes. Recital 24 AI Act further clarifies how the notion ‘exclusively’ should be interpreted and when an AI system used for such purposes may nevertheless fall within the scope of the AI Act.

For example, if an AI system placed on the market, put into service or used for military, defence or national security purposes is used (temporarily or permanently) for other purposes, such as for civilian or humanitarian purposes, law enforcement or public security purposes, that system will fall within the scope of the AI Act. In that case, the entity using the AI system for the other purposes should ensure compliance of the AI system with the AI Act, unless the system already complies with that act, which has to be verified before such use.

Furthermore, recital 24 AI Act clarifies that AI systems placed on the market or put into service for an excluded purpose, namely military, defence or national security, and for one or more non-excluded purposes, such as civilian or law enforcement purposes (so called ‘dual use’ systems), fall within the scope of the AI Act. Providers of those systems should ensure that they comply with the requirements in the AI Act. For example, if a company offers a RBI system for various purposes, including law enforcement and national security, that company is the provider of that ‘dual use’ system and must ensure its compliance with the requirements in the AI Act.

However, the fact that an AI system may fall within the scope of the AI Act should not affect the ability of entities carrying out national security, defence and military activities to use that system for national security, military and defence purposes, regardless of the type of entity carrying out those activities. For example, if a national security agency or a private operator is tasked by a national intelligence agency to use real-time RBI systems for national security purposes (such as to gather intelligence), such use would be excluded from the scope of the AI Act.

The clear delineation of the national security exclusion is particularly important where AI systems are placed on the market, put into service or used for law enforcement purposes that fall within the scope of the AI Act. This is relevant for the prohibitions regarding individual crime predictions and assessments and regarding the use of real- time RBI systems for law enforcement purposes laid down in Article 5(1)(d) and (h) AI Act respectively. Police and other law enforcement authorities are tasked with the prevention, detection, investigation and prosecution of criminal offences or the execution of criminal penalties, including safeguarding against and preventing threats to public security. Whenever AI systems are used for such purposes, they will fall within the scope of the AI Act.

The activities of Europol and other Union security agencies, such as Frontex, fall within the scope of the AI Act.

2... Judicial and law enforcement cooperation with third countries

According to Article 2(4) AI Act, the AI Act does not apply to public authorities in a third country or international organisations, where those authorities or organisations use AI systems in the framework of international cooperation or agreements for law enforcement and judicial cooperation with the Union or with one or more Member States, provided that such a third country or international organisation provides adequate safeguards with respect to the protection of fundamental rights and freedoms of individuals. Where relevant, this exclusion may cover the activities of private entities entrusted by the third country in question to carry out specific tasks in support of such law enforcement and judicial cooperation. At the same time, for the exclusion to apply, these frameworks for cooperation or international agreements must include adequate safeguards with respect to the protection of the fundamental rights and freedoms of individuals, to be assessed by the market surveillance authorities competent for the supervision of AI systems used in the area of law enforcement and justice. Recital 22 AI Act clarifies that the recipient national authorities and Union institutions, bodies, offices and agencies making use of such AI outputs in the Union remain accountable to ensure their use complies with Union law. When those international agreements are revised or new ones are concluded in the future, the contracting parties should make utmost efforts to align those agreements with the requirements of the AI Act.

2... Research & Development

According to Article 2(8) AI Act, the AI Act does not apply ‘to any research, testing or development activity regarding AI systems or AI models prior to their being placed on the market or put into service’. This exclusion is in line with the market-based logic of the AI Act, which applies to AI systems once they are placed on the market or put into service.

For example, during the research and development (R&D) phase, AI developers have the freedom to experiment and test new functionalities which might involve techniques that could be seen as manipulative and covered by Article 5(1)(a) AI Act, if used in consumer-facing applications. The AI Act allows for such experimentation by recognising that early-stage R&D is essential for refining AI technologies and ensuring that they meet safety and ethical standards prior to their placing on the market.

As clarified in recital 25 AI Act, the AI Act aims to support innovation and recognises the importance of scientific research in advancing AI technologies and contributing to scientific progress and innovation. Article 2(6) AI Act therefore provides an exclusion for ‘AI systems or AI models, including their outputs, specifically developed and put into service for the sole purpose of scientific research and development’. For example, research into cognitive and behavioural responses to AI-driven subliminal or deceptive stimuli can provide valuable insights into human-AI interactions, informing safer and more effective AI applications in the future. Such research is permitted, since it is excluded from the scope of the AI Act, notwithstanding the prohibition in Article 5(1)(a) AI Act.

The exclusion in Article 2(8) AI Act is, however, without prejudice to the obligation to comply with the AI Act where an AI system is placed on the market or put into service as a result of such research and development activity. Testing in real-world conditions within the meaning of the AI Act is also not covered by that exclusion. For example, a municipality wishing to test facial recognition software using a RBI system in the streets during carnival recruits volunteers to be identified by the system in real-world conditions. Because real-world testing does not fall within the exclusion of Article 2(8) AI Act, the planned testing must be fully compliant with the requirements for RBI systems in the AI Act, unless the system is tested in an AI regulatory sandbox or in accordance with the special regime for testing in real world conditions outside the sandbox, as provided for in Articles 60 and 61 AI Act.

In any event, any research and development activity (including when excluded from the scope of the AI Act) should be carried out in accordance with recognised ethical and professional standards for scientific research and should be conducted in accordance with applicable Union law (e.g., data protection law that remains applicable). 2... Personal non-professional activity

Article 2(10) AI Act provides that the AI Act ‘does not apply to obligations of deployers who are natural persons using systems in the course of a purely personal non- professional activity’. The definition of deployer also excludes users engaged in such activities (see section 2.. above). Any activity through which a natural person gains an economic benefit on a regular basis or is otherwise involved in a professional, business, trade, occupational or freelance activity should be considered as a ‘professional’ activity. The specification of ‘personal’ is a qualifier of non-professional, meaning that the person should act in both a personal and a non-professional capacity. The exclusion should therefore, for example, not encompass criminal activities since these should not be considered purely personal.

For example, an individual using a facial recognition system at home (e.g. to control access and to monitor for safety the entrance to the home) would fall under the exclusion of Article 2(10) AI Act and, hence, would not be subject to the obligations for deployers under the AI Act, even in cases where it is required to transmit (parts of) the footage to law enforcement authorities.

By contrast, a natural person using an AI system for professional activities such as freelancers, journalists, doctors, etc. would need to comply with the obligations for deployers of facial recognition systems under the AI Act. Any use by natural persons where they are acting on behalf or under the authority of a deployer acting in a professional capacity will also fall within the scope of the AI Act. Furthermore, criminal activities cannot be considered purely personal activities, even if no economic benefit is sought or attained. For other unlawful activities, such as non- compliance with consumer protection or data protection law and national administrative legislation, the exclusion in the AI Act applies, but the other relevant legal frameworks continue to apply).

The exclusion in Article 2(10) AI Act applies only as regards the obligations of deployers when using the system for purely personal non-professional activities. The system as such remains within the scope of the AI Act as regards the obligations of providers placing the system on the market or putting it into service, other professional deployers, and other responsible actors, such as importers and distributors. For example, an emotion recognition system, if intended to be used by natural persons for purely personal non-professional activities, remains a high-risk AI system as classified in Article 6 AI Act and must be fully in compliance with the AI Act. At the same time the deployer that uses it for purely personal non-professional use (e.g., an autistic person) will not be covered by specific obligations for deployers under the AI Act and the use would be out of scope.

2... AI systems released under free and open source licences

According to Article 2(12) AI Act, the AI Act does not apply to AI systems released under free and open-source licences, unless they are placed on the market or put into service as high-risk AI systems or as an AI system that falls under Article 5 (prohibited AI practices) or Article 50 AI Act (transparency obligations for certain AI systems). This means that providers of AI systems cannot benefit from this exclusion if the AI system they place on the market or put into service constitutes a prohibited practice under Articles 5 AI Act.

The AI practices prohibited by Article 5 AI Act should be considered in relation to the AI systems classified as high-risk in accordance with Article 6 AI Act, in particular those listed in Annex III. That is because the use of AI systems classified as high-risk may in some cases qualify as a prohibited practice in specific instances if all conditions under one or more of the prohibitions in Article 5 AI Act are fulfilled. Conversely, most AI systems that fall under an exception from a prohibition listed in Article 5 AI Act will qualify as high-risk.

For example, emotion recognition systems, where they do not fulfil the conditions for the prohibition in Article 5(1)(f) AI Act, classify as high-risk AI systems according to Article 6(2) and Annex III, point (1)(c) AI Act. Similarly, certain AI-based scoring system, such as those used for credit-scoring or assessing risk in health and life insurance, will be considered high-risk AI systems where they do not fulfil the conditions for the prohibition listed in Article 5(1)(c) AI Act. Another example are AI systems evaluating persons and determining if they are entitled to receive essential public assistance benefits and services, such as healthcare services and social security benefits that are classified as high-risk. If such systems involve unacceptable social scoring and fulfil the conditions of Article 5(1)(c) AI Act, their placing on the market, putting into service and use will be prohibited in the Union. In such cases, the risk assessment and management done by the provider and the compliance with the other requirements for high-risk AI systems (e.g., data governance, transparency and human oversight), as well as the deployer’s obligations for appropriate use in accordance with the instructions of use and human oversight (Article 26) and in some cases a fundamental rights impact assessment (Article 27), should help to ensure that the high-risk AI system placed on the market or deployed is lawful and does not constitute a prohibited practice.

Finally, AI systems that are exceptionally not considered high-risk based on Article 6(3) AI Act, despite falling under a high-risk use case of Annex III, may still fall within the scope of the prohibitions of Article 5 AI Act. Article 6(3) AI Act only results in an AI system being considered non-high-risk; it does not exclude such AI systems from the scope of the AI Act and the prohibitions.

The prohibitions apply to any AI system, whether with an ‘intended purpose’ or ‘general-purpose’ (i.e. that can serve a variety of purposes), for direct use or for integration in other AI systems. Accordingly, each operator should take measures for which they are best placed based on their role and control over the system in the value chain to ensure a responsible and safe provision and use of AI systems, balancing their risks and benefits with a view to achieving the twin objectives of the AI Act.

Deployers are thus expected not to use any AI system in a manner prohibited under Article 5 AI Act, including not to bypass any safety guardrails implemented by the providers of the system. While the harm often arises from the way the AI systems are used in practice, providers also have a responsibility not to place on the market or put into service AI systems, including general-purpose AI systems, that are reasonably likely to behave or be directly used in a manner prohibited by Article 5 AI Act. In this context, providers are also expected to take effective and verifiable measures to build in safeguards and prevent and mitigate such harmful behaviour and misuse to the extent they are reasonably foreseeable and the measures are feasible and proportionate depending on the specific AI system and circumstances of the case. In their contractual relationships with deployers (i.e. in the terms of use of the AI system), providers are also expected to exclude use of their AI system for prohibited practices and provide appropriate information in the instructions of use for deployers and regarding the necessary human oversight.

For example, a general-purpose AI system used as a chatbot may deploy manipulative and deceptive techniques which is likely to cause significant harm. To prevent prohibited behaviour of the AI system and uses that are reasonably likely to manipulate, deceive and cause significant harms under Article 5(1)(a) AI Act, the provider is expected to take appropriate and proportionate measures (e.g., appropriate safe and ethical design, integration of technical and other safeguards, restrictions of use, transparency and user control, appropriate information in the instructions of use) before the AI system is placed on the market (Article 5(1)(a) AI Act) to ensure the chatbot does not cause significant harm to users or other persons or groups of persons (see also section 3...(c)).

In certain cases, in particular where the prohibitions are linked to a very specific purpose of the system, providers may have limited possibilities to integrate other preventive and mitigating measures and will have to rely on primarily providing appropriate instructions and information to the deployers and the required human oversight and restricting prohibited use of the system. Where appropriate, such measures may also include monitoring for compliance with that restriction, depending on the means through which the AI system is supplied and the information at the provider’s disposal for possible misuse. Any possible monitoring measures to detect misuse should not amount to a general monitoring of the activities of the deployers and should be in line with Union law.

For example, a general-purpose AI system that can recognise or infer emotions should not be used by deployers at the workplaces or in education institutions, unless an exception for medical or safety reasons applies. However, the provider may not be in a position to know the specific context in which the emotion recognition functionality of the system will be used and whether an exception to the prohibition in Article 5(1)(f) AI Act may apply. Such providers may nevertheless explicitly exclude such prohibited use in their terms of use and include appropriate information in the instructions of use to guide deployers. They are also expected to take appropriate measures if they become aware that the system is misused for this specific prohibited purpose by specific deployers, for example, if such misuse is reported or the provider becomes otherwise aware, which may be the case if the system is directly operated through a platform under the control of the provider and the provider performs checks.

The AI Act is a regulation that applies horizontally across all sectors without prejudice to other Union legislation, in particular on the protection of fundamental rights, consumer protection, employment, the protection of workers, and product safety. The AI Act complements such legislation through its preventative and safety logic (AI systems may not be placed on the market or used in a certain way) and provides additional protection by addressing specific harmful AI practices which may not be prohibited by other laws. Furthermore, by addressing the earlier stages of the AI systems’ lifecycle (i.e. the placing on the market and putting into service) and deployment (i.e. the use), the AI Act’s prohibitions enable action to be taken against harmful practices involving AI at various points in the AI value chain.

At the same time, the AI Act does not affect prohibitions that apply where an AI practice falls within other Union law. Thus, even where an AI system is not prohibited by the AI Act, its use could still be prohibited or unlawful based on other primary or secondary Union law (e.g., because of the failure to respect fundamental rights in a given case, such as the lack of a legal basis for the processing of personal data required under data protection law, discrimination prohibited by Union law, etc.). The respect of the prohibitions in the AI Act are therefore not a sufficient condition for compliance with other Union legislation that remains applicable to providers and deployers of AI systems.

For example, AI-enabled emotion recognition systems used in the workplace that are exempted from the prohibition in Article 5(1)(f) AI Act, because they are used for medical or safety reasons, remain subject to data protection law and Union and national law on employment and working conditions, including health and safety at work, which may foresee other restrictions and safeguards in relation to the use of such systems.

When specific activities related to the placing on the market or use of AI systems are also covered under other Union legislation, the AI Act aims to ensure the consistent implementation of the different provisions. Moreover, it enables effective cooperation between the competent authorities responsible for the enforcement of the AI Act and the authorities protecting fundamental rights pursuant to Article 77 AI Act and other provisions of the AI Act. More generally, in accordance with Article 4(3) TEU, the various authorities concerned are bound to cooperate sincerely when giving effect to their respective tasks under Union law.

In the context of the prohibitions, the interplay between the AI Act and Union data protection law is particularly relevant, since AI systems often process information relating to identified or identifiable natural persons (‘personal data’). Depending on the prohibition and the context, the most relevant legal acts in relation to such systems are Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation, hereinafter ‘GDPR’), Directive (EU) 2016/680 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data (Law Enforcement Directive, hereinafter ‘LED’), and Regulation (EU) 2018/1725 which lays down data protection rules for the EU Institutions, bodies, offices and agencies (hereinafter ‘EUDPR’). In accordance with Article 2(7) AI Act, these acts remain unaffected and will continue to apply alongside the AI Act, which is consistent and complementary to the EU data protection acquis. Several aspects of these EU data protection rules have been clarified by the CJEU and the European Data Protection Board has adopted a series of guidelines (e.g. on the notion of ‘profiling’, which is particularly relevant for the prohibition in Article 5(1)(d) AI Act, since it uses the same notion).

Concerning the prohibitions/restrictions on the use of biometric categorisation systems and real-time RBI systems for law enforcement purposes, the AI Act applies as lex specialis to Article 10 LED, thus regulating such use and the processing of biometric data involved in an exhaustive manner. In that context, the AI Act is not intended to provide the legal basis for the processing of personal data under Article 8 of Directive (EU) 2016/680. All other provisions of that Directive apply in addition to the conditions set out in the AI Act, in particular for the use of real-time (RBI) systems for law enforcement purposes when permitted, subject to the limited exceptions in Article 5(1)(h) AI Act. More generally, the LED must also be complied with for any processing of personal data by competent law enforcement authorities (i.e. competent authorities under Article 3(7) LED) when they process the data for law enforcement purposes.

In accordance with Article 2(9) AI Act, EU consumer protection and safety legislation also remain fully applicable to AI systems falling within scope of those acts. For example, - Social scoring practices by traders (including natural persons acting in a professional capacity in business-to-consumer relations), subject to case-by-case assessment, may also be considered ‘unfair’ and therefore in breach of consumer law (i.e. Directive 2005/29/EC);

- The use of an AI system to infer emotions may also have to comply with Regulation (EU) 2017/745 (Medical Device Regulation) if the AI system is used for medical diagnosis or medical treatment purposes.

Furthermore, the AI Act applies in conjunction with relevant obligations for providers of intermediary services that embed AI systems or models into their services regulated by Regulation (EU) 2022/2065 (‘the Digital Services Act’). Specifically, Article 2(5) AI Act indicates that the AI Act does not affect the application of the provisions on the liability of such providers as set out in Chapter II of the Digital Services Act.

In addition, the prohibitions in the AI Act are without prejudice to any liability that the provider or deployer might incur for the harm caused according to applicable Union or national liability laws.

Finally, the prohibitions in Article 5 AI Act and the explicit exceptions to those prohibitions may not be used to circumvent or as a justification to infringe obligations under other Union legislation.

As secondary Union legislation, the AI Act must be interpreted in the light of the fundamental rights and freedoms guaranteed by the EU Treaties and the Charter, as well as those protected by international conventions to which the Union is a party.

Additional clarifications on the interplay of specific prohibitions with other Union law are provided under the relevant sections below.

Market surveillance authorities designated by the Member States as well as the European Data Protection Supervisor (as the market surveillance authority for the EU institutions, agencies and bodies) are responsible for the enforcement of the rules in the AI Act for AI systems, including the prohibitions. Such enforcement takes place within the system of market surveillance and compliance of products established by Regulation (EU) 2019/1020, in line with other Union product safety legislation. The enforcement powers of market surveillance authorities in relation to AI systems are laid down in the AI Act and in Regulation (EU) 2019/1020. Those authorities can take enforcement actions in relation to the prohibitions on their own initiative or following a complaint, which every affected person or any other natural or legal person having grounds to consider such violations has the right to lodge. Member States must designate their competent market surveillance authorities by 2 August 2025.

The procedure in the AI Act to deal with AI systems presenting a risk at national level is particularly relevant in the context of enforcing the prohibitions. Where there are cross-border implications beyond the territory of the market surveillance authority, the authority of the Member State concerned must inform the Commission and the market surveillance authorities of other Member States. All market surveillance authorities should follow a Union safeguard procedure with a decision taken by the Commission determining whether the AI system constitutes a prohibited practice. That procedure aims to ensure that the prohibitions are applied uniformly across all Member States, so as to provide legal certainty to both providers and deployers of AI systems. To ensure the uniform application of the AI Act, national market surveillance authorities should also strive for a harmonized application of the prohibitions for comparable cases that do not cross the Member State’s territory by drawing inspiration from these Guidelines and cooperating within the AI Board. 2... Penalties

The AI Act follows a tiered approach in setting the penalties for non-compliance with its various provisions, depending on the seriousness of the infringement. Non- compliance with the prohibitions in Article 5 AI Act are considered to constitute the most severe infringement and they are therefore subject to the highest fine. Providers and deployers engaging in prohibited AI practices may be fined up to EUR 35 000 000 or, if the offender is an undertaking, up to 7% of its total worldwide annual turnover for the preceding financial year, whichever is higher. Each Member State should lay down rules if and to the extent that administrative fines may be imposed on public authorities and bodies established in that Member State as providers and deployers of AI systems. EU institutions, bodies and agencies that violate the prohibitions may be subject to administrative fines of up to EUR 1 500 000.

It is possible that one and the same prohibited conduct constitutes a violation of two or more provisions of the AI Act (i.e. the non-labelling of deep fakes may also constitute a deceptive technique under Article 5(1)(a) AI Act). In such cases, the principle of ne bis in idem should be respected. In any event, the criteria for determining the penalty as provided for in Article 99(7) AI Act must be taken into account.

Since violations of the prohibitions in Article 5 AI Act interfere the most with the freedoms of others and give rise to the highest fines, their scope should be interpreted narrowly.