The latest EU AI Act legal requirements came into effect on 2 February 2025:

AI Literacy Rules

Providers and deployers of AI systems must now implement measures to ensure that personnel and other persons dealing with the operation and use of AI systems possess adequate AI literacy in order to do so in an informed way. The threshold for AI literacy should take into account the context the AI systems are to be used in and the groups of people on whom the systems are to be used.

Unacceptable Risk Ban

The Act enforces a prohibition on AI systems identified as posing an "unacceptable risk" in accordance with Article 5. The Act prohibits systems which have the consequence of undermining fundamental human rights. AI systems prohibited since 2 February 2025 include those which have the following functions or characteristics:

• Engage in deception, manipulation, or use subliminal techniques;
• Use social scoring for public or private purposes;
• Exploit biometric data in real-time or for categorisation purposes (i.e. to deduce or infer race, political opinions, trade union membership, religious or philosophical beliefs or sexual orientation);
• Scrape internet or CCTV for facial images to build-up or expand databases;
• Recognise emotions in the workplace and education institutions;
• Conduct certain types of predictive risk profiling; and
• Exploit vulnerable persons;

The maximum penalty for breaches in respect of prohibited AI systems is the higher of: (a) EUR 35 million, or (b) up to 7% of worldwide annual turnover.

While the provisions in relation to these prohibitions came into effect on 2 February 2025, the penalties will not apply until 2 August 2025. The EU Commission conducted a consultation on prohibitions and AI system definitions under the Act in late 2024 and early 2025, and published draft Guidelines on 4 February 2025 (which are approved by the EU Commission but not yet adopted).