EU AI Act prohibited practices and what an AI agent must never do

A short list of AI practices has been banned outright in the EU since 2 February 2025. They include manipulating people to their harm, exploiting vulnerability, social scoring and certain uses of biometrics. No AI agent may carry them out, and the real risk is drift: a collections or sales agent that learns to push.

What does the Act prohibit?

In substance, the prohibited practices are:

1. Manipulation. Using subliminal, purposefully manipulative or deceptive techniques that materially distort a person's behaviour by impairing their ability to make an informed decision, causing or likely to cause significant harm.
2. Exploiting vulnerability. Exploiting vulnerabilities due to age, disability or a specific social or economic situation to materially distort behaviour in a way that causes or is likely to cause significant harm.
3. Social scoring. Evaluating or classifying people over time based on their social behaviour or personal characteristics, where the resulting score leads to detrimental treatment in unrelated contexts or treatment that is unjustified or disproportionate.
4. Predicting crime from profiling alone. Assessing the risk that a person will commit a criminal offence based solely on profiling or personality traits.
5. Untargeted facial scraping. Building or expanding facial recognition databases by untargeted scraping of images from the internet or CCTV.
6. Emotion recognition at work and in education, except for medical or safety reasons.
7. Biometric categorisation to infer race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation.
8. Real-time remote biometric identification in public spaces for law enforcement, subject to narrow exceptions.

The short answer to whether the EU AI Act bans any uses of AI agents is yes: these practices are banned whatever system carries them out, including an agent.

Who do the prohibitions apply to?

Everyone. Providers may not place such systems on the market, and deployers may not use them. There is no high-risk classification step and no conformity route. A practice is either prohibited or it is not, and breach falls in the Act's highest penalty tier.

For most regulated businesses, practices 4 to 8 are remote. Practices 1 to 3 are not. They describe what can happen when an agent is given a goal involving people's money and behaviour, and allowed to pursue it.

How could an agent drift into a prohibited practice?

Agents pursue goals through language and action. That combination creates specific routes to the first three prohibitions.

Collections. An agent asked to maximise repayment, with freedom to choose tone and timing, may learn that messages implying legal consequences, or sent late at night, or repeated, work better. Aimed at someone in financial difficulty, that approaches both manipulation and exploitation of economic vulnerability.

Sales and retention. An agent measured on conversions or saves may use false urgency, hide the cancel route, or target people who show signs of confusion. The harm test is significant harm; locking a struggling customer into a product they cannot afford can meet it.

Scoring across contexts. An agent that builds a customer profile from service interactions, then uses it to decide eligibility for an unrelated product or to deprioritise service, edges towards the logic of social scoring.

Emotion signals. A workforce agent that reads employees' messages or voice for mood, or a contact-centre agent that scores staff by detected emotion, runs into the workplace emotion recognition ban.

None of these requires anyone to intend harm. Each requires only a goal, a degree of freedom and no hard limit.

How do you make sure no capability can drift into one?

The last row matters most. Prompts and briefs can be changed by a well-meaning team. A floor that no configuration can lower is the only control that holds when someone tries to improve results.

A related principle applies to payments: some approvals must never sit with an agent at all, as argued in the payment approver must never be the agent.

What will a supervisor or auditor ask?

• Which of your agents interact with people about money, products or debts?
• Show us the briefs and templates for collections and retention agents.
• How do you detect a vulnerable customer, and what does the agent do then?
• What can no agent do, whatever its configuration?
• What did monitoring show about tone and contact patterns last quarter?

What do the prohibitions not cover?

They do not ban persuasion; ordinary marketing and reminders are lawful. The tests are material distortion and significant harm. They do not cover practices that are merely high-risk, such as credit scoring, which are allowed with duties attached. And they do not replace consumer protection or conduct rules, which often set a lower bar for unfair treatment. If a prohibited practice does occur, the incident route in EU AI Act serious incidents: what a deployer must do applies. For the full map of duties, see AI agent regulation, mapped to controls.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.

Where Pryme fits

In Pryme, the platform floor withholds certain actions for every agent at every depth, and no customer setting can lower it. Customers narrow agents further through their own limits, which produce refused or held verdicts. Every verdict is filed, so a supervisor can see not just that a practice was barred but each time an agent reached for it.