← Back to all briefings
AI 7 min read Published Updated Credibility 94/100

EU AI Act

EU AI Act prohibited practices enforcement began February 2, 2025. Social scoring, untargeted facial recognition scraping, and emotion recognition in certain contexts are now illegal. Verify your AI systems do not fall into prohibited categories.

Kodi C.

Editor & Research Lead

Accuracy-reviewed by the editorial team

AI pillar illustration for Zeph Tech briefings
AI deployment, assurance, and governance briefings

The transition period granted under Article 113(2)(a) of the EU AI Act expired at midnight CET. From , national market-surveillance authorities (MSAs) can investigate and penalise any unacceptable-risk AI system that remains in service. this brief concluded its final shutdown rehearsals overnight and is now running day-one enforcement drills to show that manipulative behavioral engines, untargeted biometric scraping, emotion inference, and social scoring prototypes are fully withdrawn. this analysis explains the governance model, universal opt-out integration, and evidence artifacts that leadership expects to have ready when inspectors make first contact.

Immediate regulatory expectations

Articles 65 through 77 help MSAs to request information, conduct unannounced inspections, impose corrective measures, and levy fines up to €35 million or 7% of global turnover. Early supervisory communications show that authorities will prioritize providers and deployers with prior complaints, consumer advocacy reports, or whistleblower alerts. This brief has mapped potential points of contact within Germany’s Bundesnetzagentur, France’s CNIL, Spain’s AEPD, and Ireland’s Coimisiún um Chumarsáide to simplify escalation.

Inspectors will request:

  • Inventories: Definitive lists of Article 5 systems, including internal prototypes, pilot deployments, and third-party integrations.
  • Shutdown proof: Timestamped change records, deployment logs, and configuration states showing that prohibited functions cannot be reactivated.
  • Governance artifacts: Board minutes, ethics committee decisions, and risk acceptance statements that authorized retirement plans.
  • Universal opt-out reconciliation: Evidence that individuals impacted by the systems received notices, had their preferences respected, and saw downstream systems updated.
  • Supplier attestations: Documentation that vendors providing AI modules to this brief have also removed prohibited features.

To prepare, The regulatory affairs team has drafted standard response packets for each authority, localized in the relevant language and reviewed for legal privilege.

Governance framework for Article 5 exit

The board’s Responsible AI Committee convened an extraordinary meeting on 1 February to approve the final shutdown status. Minutes document sign-offs from the CEO, Chief Trust Officer, Chief Technology Officer, and General Counsel. A dedicated Article 5 program Office coordinates execution, staffed by leads from product, security, privacy, compliance, HR, and communications. The office maintains a runbook that specifies:

  • Decision authority: Only the Article 5 program Director can authorize temporary reactivation of components (for example, to reproduce historical behavior for evidence), and any such action requires legal approval and MSA notification.
  • Escalation paths: Issues escalate from squad leads to the program Director within one hour, and to the board committee within four hours.
  • Documentation checkpoints: No workstream can close without uploading evidence to the vault and completing universal opt-out verification steps.

Internal audit observers attend daily stand-ups during the enforcement launch window to capture independent assurance notes. Their observations feed into the Q1 2025 audit plan and will be available for regulators seeking third-party corroboration.

Universal opt-out execution and communications

The AI Act does not explicitly mandate universal opt-outs, but EU privacy regimes and consumer protection laws require respect for objections, marketing opt-outs, and fairness commitments. This brief has integrated its universal opt-out service—already used for GDPR Article 21 objections, CPRA global privacy control signals, and US state-level universal opt-out mechanisms—into the Article 5 exit workflow. The service performs three tiers of reconciliation:

  1. People affected: Identify customers, citizens, or employees whose data flowed through the prohibited system, using model usage logs and data lineage maps. Cross-reference the list with the universal opt-out registry to ensure preferences were honored during shutdown.
  2. Channel updates: Confirm that every product surface, API, and communications platform removed access to the prohibited capability and now points to alternative workflows. Opt-out banners and consent dialogs were refreshed to explain the change and provide links to updated privacy policies.
  3. Downstream services: Propagate updated opt-out states to analytics warehouses, training datasets, and partner ecosystems to stop secondary processing that could recreate prohibited logic.

Customer operations teams have scripts explaining why statutory obligations require retention of minimal historical data despite opt-outs. Support portals display new FAQs describing how individuals can confirm their opt-out status, request evidence of shutdown, or seek redress if they suspect residual usage.

Evidence vault contents

The Article 5 evidence vault follows a structured template so inspectors can navigate swiftly:

  • System dossiers: For each prohibited system, the dossier includes business purpose descriptions, risk assessments, DPIAs, and the legal analysis concluding that Article 5 applied. Additional attachments cover design artifacts, data catalogs, and user interface screenshots.
  • Shutdown records: Deployment pipeline logs, infrastructure change tickets, source control tags, and screenshots of disabled feature flags. For SaaS products, this brief captures before/after states demonstrating removal.
  • Human oversight evidence: Rosters of the shutdown working groups, training attendance logs, and sign-off forms. These show that staff understood responsibilities and that the “four eyes” principle was enforced.
  • Universal opt-out reconciliations: Reports showing opt-out requests received before and during shutdown, actions taken, and communications sent. Each record references customer relationship management (CRM) case numbers and privacy ticket IDs.
  • Supplier attestations: Signed statements from third parties confirming they disabled prohibited functions, plus clauses from updated contracts describing ongoing monitoring rights.

The vault is hosted on a segregated evidence platform with immutable storage and detailed access logs. Any download triggers automated notifications to legal and security leaders so they can monitor regulator access.

Cross-functional drills on enforcement day

At 07:00 CET on 2 February, this brief initiated a cross-functional drill. The scenario assumed the French CNIL requested inspection of historical biometric categorization pilots. The drill tested the following:

  • Alerting: How quickly the request triggered notifications through the incident-response platform and Slack emergency channels.
  • Document delivery: Whether the evidence vault could assemble the dossier index within 30 minutes and provide a secure download link.
  • Universal opt-out verification: Validation that all impacted individuals were already notified and that opt-out statuses were locked across downstream systems.
  • Executive communication: Preparation of briefings for the CEO, board, and public relations in case media inquiries followed.

The drill identified two improvement actions: add multilingual support to automated notification templates, and accelerate translation of board minutes into French and German. Owners have 48 hours to remediate.

Supplier and partner management

Article 5 applies to deployers as well as providers, so practitioners evaluated every partner integration. Procurement issued updated questionnaires requiring partners to describe prohibited-system usage, universal opt-out handling, and audit cooperation processes. Partners providing ad-tech, recommendation engines, or conversational AI had to furnish independent assurance reports or allow practitioners to review their shutdown documentation.

Contracts now include clauses that:

  • Mandate notification within 24 hours if a partner receives an MSA inquiry involving this brief data or services.
  • Grant Step-in rights to disable prohibited functionality if a partner fails to act.
  • Require partners to respect The universal opt-out registry and to propagate preferences across their systems.

The Vendor Governance Office monitors partner compliance and will suspend integrations if evidence is insufficient.

Stakeholder communications and transparency

Transparency reduces enforcement risk. Publishing an updated Responsible AI Report describing the Article 5 shutdown program, including metrics on the number of systems retired, universal opt-out requests processed, and evidence packages assembled. The report links to trust-center pages where enterprise customers can download compliance attestations, board oversight summaries, and guidance for embedding the shutdown requirements in their own governance processes.

Customer success teams host webinars explaining how the enforcement milestone affects API behaviors, sandbox availability, and product roadmaps. They provide templates for clients who must document The compliance within their own regulatory filings. Feedback from these sessions informs the next iteration of FAQs and support scripts.

Forward-looking risk management

With Article 5 enforcement active, This brief shifting focus to sustained monitoring. Risk teams added scenarios for inadvertent reactivation, shadow AI development, and third-party misconfigurations to the enterprise risk register. Mitigations include continuous scanning of code repositories for deprecated models, periodic review of MLOps pipelines, and expansion of internal whistleblowing channels.

Lessons from Article 5 exit are feeding into preparations for high-risk AI conformity assessments and general-purpose AI transparency obligations due later in 2025. The company is investing in automated evidence capture tools that can generate regulator-ready packages within hours and in advanced preference orchestration to honor universal opt-outs across voice, AR/VR, and IoT interfaces.

By combining disciplined governance, full universal opt-out integration, and meticulous evidence management, practitioners can credibly show day-one Article 5 compliance and build trust with regulators, customers, and civil society.

Similar analysis

Additional analysis covering similar themes.

Continue in the AI pillar

Return to the hub for curated research and deep-dive guides.

Visit pillar hub

Latest guides

  • AI Governance Implementation Guide

    Operationalise the EU AI Act, ISO/IEC 42001, and U.S. OMB M-24-10 requirements with accountable inventories, controls, and reporting workflows.

  • AI Incident Response and Resilience Guide

    Coordinate AI-specific detection, escalation, and regulatory reporting that satisfy EU AI Act serious incident rules, OMB M-24-10 Section 7, and CIRCIA preparation.

  • AI Procurement Governance Guide

    Structure AI procurement pipelines with risk-tier screening, contract controls, supplier monitoring, and EU-U.S.-UK compliance evidence.

Coverage intelligence

Published
Coverage pillar
AI
Source credibility
94/100 — high confidence
Topics
EU AI Act · Article 5 prohibited AI · Market surveillance
Sources cited
3 sources (eur-lex.europa.eu, ec.europa.eu, data.consilium.europa.eu)
Reading time
7 min

Further reading

  1. Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonized rules on artificial intelligence — eur-lex.europa.eu
  2. Questions and Answers: The EU's Artificial Intelligence Act — ec.europa.eu
  3. EU AI Act: timeline of application — data.consilium.europa.eu
  • EU AI Act
  • Article 5 prohibited AI
  • Market surveillance
Back to curated briefings

Comments

Community

We publish only high-quality, respectful contributions. Every submission is reviewed for clarity, sourcing, and safety before it appears here.

    Share your perspective

    Submissions showing "Awaiting moderation" are in review. Spam, low-effort posts, or unverifiable claims will be rejected. We verify submissions with the email you provide, and we never publish or sell that address.

    Verification

    Complete the CAPTCHA to submit.