The AI Act prohibits AI systems designed to manipulate human behavior in ways that could cause physical or psychological harm. This includes subliminal techniques and AI that exploits vulnerabilities related to age, disabilities, or other personal factors to distort decision-making in a harmful way.

AI-driven social scoring, similar to systems used in China, is banned in the EU. Governments and private companies cannot use AI to assign individuals a score based on their behavior, beliefs, or economic status to restrict their access to services or benefits.

The use of real-time biometric identification systems (such as facial recognition) in public spaces is prohibited, except in specific cases like counterterrorism operations or locating missing persons, and only under strict judicial oversight. Additionally, large databases of facial images collected without consent—such as those scraped from social media—are explicitly banned.

A major addition to the AI Act is the mandatory AI literacy requirement for providers, deployers, and affected stakeholders. Organizations must educate their staff about the risks, benefits, and ethical use of AI to ensure informed decision-making and responsible deployment.

Regulatory bodies, such as the Spanish Agency for AI Supervision (AESIA) and other national authorities across the EU, have been given broad enforcement powers. They can conduct inspections, request information, and impose penalties for non-compliance. The fines are among the highest in any tech-related regulation, reaching €35 million or 7% of global annual turnover, whichever is higher.