AI Governance Best Practices: A Guide for Leaders

Strong AI governance best practices start with knowing where the line is. This guide walks leaders through the AI practices regulators have decided are too harmful to permit at all — and the governance habits that keep your organization safely on the right side of that line.

Artificial Intelligence has immense potential to drive innovation and improve business operations, but without proper oversight, it can lead to unintended and harmful outcomes. Following sound AI governance best practices is what transforms AI from a tool with uncertain outcomes into a trusted, scalable resource that aligns with business objectives. As AI becomes central to modern operations, leaders must weigh not just technical performance but ethical implications — overlooking them exposes the business to legal, ethical, and reputational risk.

The EU AI Act is currently the clearest expression of what "the line" looks like in practice. It sets firm boundaries on AI use, and a small set of practices are banned outright because of their potential to harm individuals or society, regardless of context or intent. Understanding these prohibitions is one of the most concrete AI governance best practices any leadership team can adopt — because knowing what's forbidden clarifies what "responsible" actually means in practice, rather than leaving it as an abstract value.

This guide covers why these practices are prohibited, what they look like in the real world, and the actionable steps that translate into durable AI governance best practices for both AI developers and AI deployers.

Why Some AI Practices Are Prohibited

AI systems, if not properly governed, can have unintended consequences ranging from privacy violations to societal harm. AI can reinforce bias, manipulate vulnerable individuals, or violate human rights — outcomes that erode trust and invite backlash. This is precisely why "prohibited practices" sit at the foundation of any serious set of AI governance best practices: they represent the floor below which no amount of good intent or business justification is an acceptable defense.

It's worth going a layer deeper than compliance here. Understanding why these practices are harmful — not just that they're illegal — is what separates organizations that treat AI governance best practices as a checkbox from those that build genuinely responsible AI programs. The EU AI Act provides the clarity; the challenge most organizations actually face is practical implementation.

8 Prohibited AI Practices Under the EU AI Act

The EU AI Act categorizes AI systems by risk level, but certain practices are banned outright regardless of risk tier, because of their potential to cause harm. Treating avoidance of each one as a non-negotiable AI governance best practice — not a legal afterthought — is the safest posture for both AI-developing and AI-using organizations.

1. Manipulative and Deceptive AI Practices

AI systems that subtly influence human behavior, particularly without users’ awareness or consent, are prohibited. These AI systems may manipulate individuals by using hidden methods or tactics to alter their decision-making, which can lead to harmful outcomes. For instance, AI-driven marketing campaigns might exploit emotional triggers to pressure consumers into buying products or services they don’t need.

Governance best practice for developers: Ensure customer-facing AI — advertising, product recommendations — never manipulates users. Any AI-generated content should be clearly labeled as such.

Governance best practice for deployers: Confirm the AI tools you adopt prioritize user preferences over pressure tactics, and that AI-driven content is transparently labeled.

2. Exploiting Vulnerabilities of Individuals

AI systems that exploit the vulnerabilities of certain individuals, such as children, people with disabilities, or those in financially unstable situations, are banned. This involves using AI to manipulate these individuals' decisions, for example, encouraging them to make purchases they can’t afford or making unfair decisions about their eligibility for certain services based on their vulnerabilities.

Governance best practice for developers: Regularly test systems that interact with vulnerable groups to confirm fairness and design in protections up front.

Governance best practice for deployers: Evaluate AI tools used in sensitive areas like education or financial services specifically for exploitation risk, and build in safeguards.

3. Biometric Categorization and Use of Sensitive Personal Data

AI systems that use biometric data, like facial recognition, to infer sensitive personal information such as race, political beliefs, or religious views are prohibited, unless there is a strict legal justification. The misuse of such AI systems can lead to discrimination, privacy violations, and the infringement of individuals' rights. This includes the improper collection or analysis of personal attributes that should remain private, potentially causing harm or exploitation.

Governance best practice for developers: Build biometric-data systems to comply with privacy laws like GDPR from the start, with explicit user consent as a hard requirement.

Governance best practice for deployers: Monitor how biometric data is collected and used, and run periodic audits for privacy-law compliance.

4. Social Scoring Systems

AI systems that evaluate or rank individuals based on their social behavior or personal traits are prohibited. These systems can be used to assign scores to individuals based on their actions or social media presence, which can negatively affect their access to services such as loans, jobs, or housing.

Governance best practice for developers: Anchor systems used for hiring or lending in objective, job-relevant factors — skills and qualifications, not social media activity.

Governance best practice for deployers: Run fairness audits to confirm decisions rely on job-related criteria, not personal or social behaviors.

5. Criminal Risk Profiling Based on Personality Traits

Using AI to predict an individual’s likelihood of committing a crime based solely on personality traits or profiling is prohibited. This type of profiling, often seen in predictive policing, can lead to discriminatory outcomes and violates individuals' rights by assuming that personality traits determine criminality.

Governance best practice for developers: Base any risk-assessment tools on verifiable, objective data — never personality traits alone.

Governance best practice for deployers: Require human oversight in every criminal-risk decision process, and confirm tools rely on verifiable data.

6. Unauthorized Facial Recognition Data Scraping

AI systems that scrape publicly available images from the internet or CCTV footage to build facial recognition databases are prohibited. This practice violates privacy laws and undermines trust in AI systems by collecting biometric data without individuals' consent.

Governance best practice for developers: Follow strict consent protocols for any facial-recognition data collection, with full transparency to individuals.

Governance best practice for deployers: Obtain explicit consent before collecting or using biometric data, and audit these systems periodically for compliance.

7. Emotion Recognition in Workplaces and Educational Institutions

Using AI to detect emotions in workplaces or educational settings is prohibited unless it is for specific health or safety reasons. The use of emotion-detecting AI in these environments can invade personal privacy and lead to manipulation or unnecessary stress.

Governance best practice for developers: Avoid building emotion-monitoring AI for these settings absent a clear health/safety rationale.

Governance best practice for deployers: If deployed, ensure use is transparent, voluntary, wellness-focused, and clearly communicated to those affected.

8. Real-Time Remote Biometric Identification

The use of real-time biometric identification, such as facial recognition, in public spaces for law enforcement purposes is highly restricted under the EU AI Act. While there are specific exceptions (e.g., preventing imminent threats or identifying missing persons), the use of such technologies is subject to strict regulations.

Governance best practice for developers: Build these systems to comply with strict legal and ethical requirements, deployed only when absolutely necessary and fully accountable.

Governance best practice for deployers: Run a formal impact assessment before deployment, secure necessary legal authorization, and apply proper oversight throughout use.

Core AI Governance Best Practices Checklist

Beyond avoiding outright-prohibited practices, these habits form the backbone of a mature AI governance program:

• Maintain a current inventory of every AI system in use or development
• Screen new and existing AI use cases against the EU AI Act's prohibited-practices list, regardless of where you operate
• Require explicit, transparent labeling of AI-generated content in customer-facing contexts
• Build fairness audits into any AI system influencing hiring, lending, or access to services
• Require documented consent for any AI system processing biometric or sensitive personal data
• Mandate human oversight for high-impact decisions — never allow full automation of consequential outcomes
• Run impact assessments before deploying any AI system with public or biometric-identification implications
• Periodically re-audit deployed systems, not just at launch — risk profiles shift as models and use cases evolve

Building a Culture Around AI Governance Best Practices

The EU AI Act gives organizations clear guidelines on what's prohibited, but implementation is the real work — and it falls on both AI-developing and AI-using organizations alike. Understanding these boundaries, acting on them, and embedding them into everyday AI governance best practices is what actually reduces risk and keeps AI systems compliant over time.

Education is the multiplier here. When employees across the business — not just legal or compliance teams — understand why these practices are prohibited, AI governance best practices stop being a document people consult only when something goes wrong and start becoming part of how the organization builds and uses AI by default. Governed responsibly, AI delivers real innovation and value without causing harm to individuals or society.