EU AI Act’s first prohibitions are in force: what builders and buyers must change now

The EU AI Act’s first prohibited practices are already live, and the immediate operational question for companies is narrower than the full law: what can no longer be built, deployed, or procured in the EU, and what must now be shown in contracts, reviews, and internal controls?

The European Commission’s AI Act page says the first set of prohibited practices took effect in February 2025. Independent legal briefings published this week also frame the live regime as the Act’s opening prohibitions, with broader application dates continuing through 2026 and beyond. European Commission Victor Grösser North End Law

What is enforceable now

The Commission says the AI Act’s prohibited practices are already in effect. The practical takeaway is simple: organizations cannot treat these items as future compliance work. They are now part of vendor review, model selection, data sourcing, and deployment approval.

Legal commentary linked to the live regime highlights several categories that matter most to builders and buyers:

• prohibited practices under Article 5 are already active;
• AI literacy obligations remain in force;
• transparency obligations for some systems are still staged for later application;
• general-purpose AI obligations started earlier than the wider high-risk system regime. European Commission North End Law Victor Grösser

That matters because many compliance programs are still built around a single “EU AI Act” project. In practice, the law arrives in pieces.

What teams should stop and check now

For engineering teams, the first task is to map use cases against the prohibited-practice list before features ship or vendors are approved. That means checking:

• whether a system relies on facial-recognition scraping or other data collection patterns covered by the prohibition signal in the Commission materials;
• whether a product feature depends on manipulation, exploitation, or other use cases that may fall into Article 5 territory;
• whether the same workflow is being reused across regions without a jurisdictional gate.

For procurement teams, the immediate change is that AI vendor review is no longer just about privacy and security questionnaires. Contracting now needs explicit questions about:

• where the model or service is deployed;
• whether the vendor has screened the use case against prohibited practices;
• what documentation the vendor can provide on training data, intended use, and known exclusions;
• whether the vendor’s standard terms shift compliance responsibility back to the buyer.

For governance teams, the main work is not policy language alone. It is control evidence: who approved the use case, what legal basis was checked, what was excluded, and how that decision is tracked over time.

Why the date matters to buyers

The strongest reason this story matters now is that buyers often inherit AI risk through procurement. A team may not be training a model or writing frontier systems, but it can still expose itself by purchasing a product whose use case lands inside a prohibited category.

That is why the EU AI Act’s first prohibitions should be treated as an intake-control issue, not just a legal memo. If a product owner cannot answer whether a system depends on banned data practices or a prohibited deployment context, the review is incomplete.

The counterargument: this is important, but not the whole regime

The strongest pushback is that the headlines can overstate the immediate burden. The live prohibitions are only one part of a much larger law, and many of the detailed obligations that most companies worry about — including broader transparency and high-risk compliance requirements — phase in later. Legal briefings this week also differ on how to frame the rollout timeline and which obligations are already biting in practice. North End Law Victor Grösser

That uncertainty does not erase the immediate point: the first prohibitions are no longer theoretical. Companies selling into Europe, or buying AI systems that touch European users or data, need a way to prove they screened those uses now.

Bottom line

The EU AI Act is no longer a future-policy story. Its first prohibitions are active, and the operational response is familiar to any regulated technology program: classify the use case, document the decision, tighten procurement, and make sure the system cannot quietly drift into a prohibited category after launch.