EU AI Act's Prohibited Practices Take Effect Next Monday. Are You Ready?

It is Monday morning in my flat, the kettle is whining, and I am drawing a six-column grid on the back of an envelope. One column per day until next Monday, February 2, when the first hard deadline of the EU AI Act lands and a specific list of AI practices becomes flatly illegal across the bloc. I am not a lawyer. I am a news editor with too many group chats full of restaurant operators, and the chats have gone quiet in the way they go quiet when nobody wants to admit they have not read the thing.

So here is the contrarian take I want on the record before the week runs out: if you operate hospitality venues with any EU footprint — a loyalty kiosk in Lisbon, a face-matching no-show tool in a Paris fine-dining room, a Berlin pop-up running “AI-powered” marketing personalization — you do not have until next month to tidy this up. You have an audit-trail rev to ship this week, full stop. The penalty ceiling is up to 7% of global annual turnover or EUR 35 million, whichever is higher, and that is calibrated to bite a multinational chain, not just a SaaS vendor in Brussels.

What’s actually prohibited

The Act enters into application in staged waves. Most of the high-risk and general-purpose model rules ramp up over 2025 and 2026, but Chapter II — the prohibited practices — is the wave that crashes on February 2. As DLA Piper’s outlook lays out, eight categories are banned outright. The ones hospitality operators should re-read tonight:

• Subliminal, manipulative, or deceptive techniques that materially distort behavior and cause harm. Read: dark-pattern “AI personalization” that pushes upsells in ways a reasonable guest would not consent to if it were explained plainly.
• Exploiting vulnerabilities of age, disability, or socio-economic situation. Read: targeting price-sensitive guests with manufactured urgency, or surfacing higher-margin items to under-18 guests in family venues.
• Social scoring by public or private actors that leads to detrimental treatment. Read: any “guest score” that travels across venues and gates access.
• Biometric categorisation to infer race, political opinions, trade-union membership, religion, sex life, or sexual orientation. Read: vision systems quietly tagging guest demographics for marketing.
• Real-time remote biometric identification in publicly accessible spaces for law-enforcement purposes (narrow carve-outs apply, and they do not apply to you).
• Emotion recognition in workplaces and educational institutions. Read: front-of-house “smile detection” or back-of-house stress-monitoring of kitchen staff.
• Untargeted scraping of facial images from the internet or CCTV to build recognition databases.
• Predictive policing based solely on profiling — not your problem, but worth knowing it is in the same bucket.

The Commission has signalled detailed guidelines on these prohibitions are imminent — anticipated this week, per the artificial-intelligence-act.com tracker — but the prohibitions themselves do not wait on the guidance. February 2 is the date.

Where hospitality operators are exposed

My read: most restaurant groups think this is somebody else’s regulation. It is not. Three exposure surfaces in particular keep showing up when I walk through operator stacks.

The loyalty and CRM stack. As a later piece we publish on the loyalty and payments stack gets into, the modern loyalty kiosk is rarely “just” a sign-up form. It is often wired into a personalization engine that scores guests, ranks offers, and in some configurations infers attributes — household size, dietary patterns, even mood from review sentiment. If any inference touches a prohibited category, or if the persuasion patterns cross the “materially distort behavior” line, you are on the wrong side of Chapter II on Monday.

Front-of-house biometrics. No-show face-matching, VIP-recognition cameras at the door, “smart” host-stand tablets that tag returning guests by face. Real-time biometric ID in publicly accessible spaces is the prohibition most likely to surprise a group that bought a flashy hospitality-tech demo last quarter. The law-enforcement carve-outs are not yours.

Back-of-house emotion analytics. A handful of kitchen-management vendors have, charitably, leaned into “wellness” framing for what is functionally workplace emotion recognition. February 2 makes that framing irrelevant. Workplaces are explicitly named.

The deeper point — and as our later Mise framework on regulatory-cost layers argues — regulation is not a tax you pay once; it is a permanent layer in your unit economics. The operators who treat Feb 2 as a one-time clean-up will be back here in August when the general-purpose-model obligations land, and again in 2026 when the high-risk regime kicks in. Build the muscle now.

The AI literacy obligation, decoded

Buried in Article 4, and effective the same day, is an obligation that almost nobody is talking about: providers and deployers of AI systems must “take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems.” As Sourcing Speak summarises, this is not optional and it is not just for tech companies. It applies to deployers — meaning you, the restaurant group running a third-party AI tool.

My read: nobody expects a 40-cover bistro to run a Coursera curriculum by Monday. What regulators will expect, when something goes wrong, is evidence — a one-page internal note, a recorded all-hands, an acknowledgement from each manager that they know which AI tools are in the building, what those tools do, and which prohibitions apply. That is your audit-trail rev. Ship it this week.

Your checklist for the next 6 days

Here is the envelope grid, cleaned up:

• Monday–Tuesday: inventory. List every AI-touching system in your stack — POS personalization, loyalty CRM, reservations, hiring, scheduling, surveillance. For each, write one sentence on what it does and one sentence on what data it ingests.
• Wednesday: map to Chapter II. For each system, mark which of the eight prohibited categories it could plausibly touch. Be generous in your marking. “Probably not” is not the answer Brussels wants.
• Thursday: vendor letters. Email every vendor on the list and ask, in writing, for their Article 5 compliance statement and their plan for the anticipated EC guidelines. Save the replies. The replies are the audit trail.
• Friday: AI literacy note. A one-page internal memo. What tools we use. What they do. What is now prohibited. Who to call if a guest asks. Have every GM acknowledge in writing.
• Saturday: kill switches. For any tool flagged “could plausibly touch,” confirm you can disable it from a single console by Sunday night. If you cannot, disable it now and turn it back on when you can.
• Sunday: the calm read. Re-read your inventory with fresh eyes. Anything still ambiguous on Monday morning gets paused, not prayed over.

Six days. One envelope. The 7% number is the one that should make this feel real — it is calibrated to the parent company, not the venue, and it does not care how charming your tasting menu is.

I will be back later this week with the EC guidelines once they drop. Until then, the kettle is off and the grid is on the fridge.

— Hana edits The Pass. Tips: tips@tabletransfers.com.