Prohibited AI practices
Closed list of AI uses the European regulation prohibits with no commercial derogation, notably social scoring and exploitation of a person's vulnerabilities.
Article 5 of Regulation (EU) 2024/1689 of June 13, 2024 on artificial intelligence, applicable since February 2, 2025, opens the risk pyramid with outright bans that no conformity procedure can lift. The list is closed and targets uses, not technologies. It covers subliminal or manipulative techniques that materially distort behavior so as to cause harm, and exploitation of vulnerabilities arising from age, disability or a social or economic situation. Next come social scoring that leads to detrimental treatment in a context unrelated to the data collected, building facial recognition databases through untargeted scraping of images, emotion recognition in the workplace and in education, and biometric categorization aimed at inferring sensitive attributes. Added to these are assessing the risk that a person will commit a crime based solely on profiling and, save for narrow exceptions, real-time remote biometric identification in publicly accessible spaces for law enforcement. Two of these prohibitions bear directly on insurance. Social scoring forbids applying to a contract a score built on behaviors unrelated to the insured risk. And exploitation of vulnerabilities targets the profiling of a person in financial difficulty by a system designed to take advantage of that difficulty, which moves the compliance question out of data protection and into product design.
Article 5 of Regulation (EU) 2024/1689 has applied since February 2, 2025, only six months after the text entered into force, and it is the block whose deadline came first. The European Commission published guidelines on these prohibitions in early 2025. They are indispensable reading, because the line between legitimate segmentation and social scoring cannot be deduced from the article alone.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.