EU Guidance on the AI Act

The question

How is the European Commission helping businesses interpret the EU’s Artificial Intelligence Act (AI Act)?

The key takeaway

The ban on prohibited AI practices under the AI Act is now in force and sanctions come into force on 2 August 2025. The European Commission has published two new draft guidelines which will help businesses interpret the AI Act and explores prohibited AI practices, AI systems and related concepts.

The background

On 13 June 2024, the President of the Council of the EU and President of the European Parliament signed the AI Act which seeks to establish a comprehensive legal framework for the development, supply and use of AI systems in the EU.

The development

Prohibited AI practices

On 4 February 2025, the European Commission published draft guidelines on prohibited AI practices under the AI Act. These guidelines provide explanations and examples of terminology contained within the AI Act as it relates to banned uses of AI, to help businesses apply these in practice. The AI Act bans 8 practices, subject to certain exemptions, which are deemed to be incompatible with the fundamental rights and values of the EU, including: (i) subliminal techniques, such as attempting to influence behaviours by displaying almost imperceptible messages in media; (ii) exploiting vulnerabilities of specific persons or groups; (iii) indiscriminate web-scraping to create or enhance facial recognition databases; and (iv) real-time biometric identification in public places for law enforcement purposes.

The guidance considers a wide variety of practical examples of prohibited activities, including systems which: (i) reach a conclusion that an employee is unhappy through inferences made using pictures or video; (ii) tag people as being associated with a particular political party by analysing photos of them uploaded to a social media website; and (iii) predict criminal behaviour for crimes such as terrorism solely based on individuals’ age, nationality, address, type of car, and marital status.

Definition of an AI system

The above guidance was closely followed by the European Commission issuing additional draft guidelines on 6 February 2025 covering the definition of an AI system. This guidance was aimed at clarifying when a machine-based system constitutes an AI system as opposed to a simpler traditional software system or programming approach.

Examples of software which are not AI systems, and therefore fall outside of the scope of the AI Act, include: (i) systems which only conduct basic data processing and which are usually based on a fixed ruleset such as sales reports visualisation software; (ii) financial forecasting systems using an estimator with a “mean” strategy to establish a baseline prediction; and (iii) basic pattern recognition and rules-based systems which may use trial-and-error strategies such as certain chess game engines and programmes.

Why is this important?

It is important that businesses consider the guidelines and are up to speed with the requirements of the AI Act before the sanctions for non-compliance become applicable on 2 August 2025. The sanctions for non-compliance are punitive and companies could be fined up to €30m or 7% of global turnover, whichever is higher. The guidance is also valuable given the wide variety of concepts introduced by the AI Act and as there is still likely to be discussion, and potentially enforcement action, turning on how such foundational concepts are to be interpreted, particularly in relation to prohibited practices.

Any practical tips?

Businesses should consider whether any of the AI systems they use or procure fall under the prohibited AI practices section of the AI Act and consider whether any exceptions may apply. They should also consider whether any systems being used or procured meet the definition of an AI system to determine whether the AI Act applies in the first instance. Whilst the guidelines are non-binding, they provide valuable insight on how to interpret the AI Act.

Spring 2025