The European Union has taken its first enforcement actions under the AI Act's ban on social scoring systems, issuing formal warnings to three companies operating within the EU. The move marks the transition of the world's most comprehensive AI regulation from paper to practice.
First Enforcement Actions
The European AI Office, the body responsible for enforcing the AI Act, announced that it has issued formal compliance warnings to three companies whose products fall under the Act's "unacceptable risk" category. Two have been publicly identified: a Berlin-based fintech company that used behavioral pattern scoring for credit decisions, and a Paris-based hiring platform that employed personality prediction models to rank job candidates.
Both companies have been given 90 days to cease the prohibited practices or face formal proceedings. The third company has not been named, as the investigation is still in its preliminary phase.
What Counts as Social Scoring
The AI Act defines social scoring broadly. It covers any AI system that evaluates or classifies natural persons based on their social behavior, known or predicted personal characteristics, in ways that lead to detrimental treatment unrelated to the context in which the data was generated. The prohibition targets systems reminiscent of China's social credit experiments — but the language is broad enough to capture subtler implementations.
The fintech case is particularly instructive. The company's system analyzed users' app usage patterns, social media activity, and spending behavior to generate a "reliability score" used in loan decisions. The company argued this was standard credit assessment. The AI Office disagreed, ruling that behavioral profiling beyond financial data constitutes social scoring under the Act.
Penalties
The stakes are significant. Violations of the AI Act's prohibited practices tier carry fines of up to 35 million euros or 7% of global annual revenue, whichever is higher. These are the strictest AI-related penalties in the world, exceeding even GDPR's 4% revenue cap.
No fines have been levied yet. The current phase focuses on warnings and compliance timelines. But regulators made clear that penalties will follow if companies do not comply.
Industry Response
The enforcement has sent a chill through Europe's AI sector. Several companies have preemptively engaged auditors to review their systems against the Act's prohibited practices list. Legal firms specializing in AI compliance report a surge in inquiries since the warnings were announced.
Global Implications
Other jurisdictions are watching closely. Canada's Artificial Intelligence and Data Act and Brazil's AI regulatory framework both reference the EU Act as a model. If EU enforcement proves effective, similar prohibitions are likely to spread. For global AI companies, compliance with the EU standard is quickly becoming the de facto baseline.
