Prohibited AI Practices Under the EU AI Act: The Social Scoring Ban

The EU AI Act is a risk-based regulatory framework, but some practices are considered unacceptable and are prohibited outright.

This article examines the prohibition on social scoring drawing on the Commission’s final July 29, 2025 Guidelines on prohibited artificial intelligence practices. These guidelines superseded the February 2025 draft and provide the detailed examples discussed below.

For an overview of all prohibited practices, see Prohibited AI Practices Under the EU AI Act: Where Europe Draws the Line.

Social Scoring

The prohibition of Social Scoring under Article 5.1(c) aims to protect, in particular, the right to human dignity and other fundamental rights, including the right to non-discrimination and equality, to data protection, and to private and family life, as well as relevant social and economic rights, as applicable. It also aims to safeguard and promote the Union values of democracy, equality (including equal access to public and private services), and justice.

Perhaps no AI Act prohibition is more frequently oversimplified than social scoring.

Several cumulative conditions apply:

• The practice must involve the "placing on the market", "putting into service" or "use" of an AI system (see explanation in "Prohibited AI Practices Under the EU AI Act: Where Europe Draws the Line" under the sub-title "What Conduct Does Article 5 Regulate?").
• The AI system evaluates or classifies natural persons or groups over time based on their social behavior; or known, inferred or predicted personal or personality characteristics.
• The resulting social score leads, or is capable of leading to detrimental or unfavorable treatment in a social context unrelated to the context in which the underlying data were generated or collected; or treatment that is unjustified or disproportionate to the social behavior or its gravity.

The practice must involve an AI system that evaluates or classifies natural persons over time, and the resulting score must be capable of producing at least one of the two prohibited forms of treatment.

The prohibition applies to both providers and deployers and covers scoring by public authorities and private organizations. Commission Guidelines, §§ 4–4.2, paras. 146–150.

• Public-sector scoring can produce particularly serious consequences because individuals may depend on government services and have limited ability to avoid the system. But private-sector scores can also determine access to insurance, housing, credit, employment and other essential opportunities. Commission Guidelines, § 4.2.3, para. 170.

Practice Tip: A government may use unrelated information to determine access to public benefits, while an insurer or credit agency may use it to deny coverage, raise premiums or determine access to housing loans. In either sector, the concern is not the scoring but the potential use of unrelated information to impose unfavorable treatment.

• Providers and deployers should be prepared to demonstrate that their scoring practices are legitimate and justified. That includes explaining: how the system functions; what types of data it uses and where those data originate; why the data are relevant to the evaluation; whether the system operates as intended; and why any resulting unfavorable treatment is justified and proportionate. Commission Guidelines, § 4.2.3, para. 171.

Practice Tip: Document the relationship between each category of data, the purpose of the score and the resulting treatment. Article 5 risk increases when an organization cannot explain why particular information is relevant or why the consequence imposed is proportionate.

Not every score is prohibited: Lawful evaluation remains possible where people are assessed for a specific legitimate purpose, relevant information from the appropriate context is used, and any unfavorable treatment is justified and proportionate.

• User ratings are not necessarily social scoring: Individual customer ratings—such as ratings of drivers, passengers or accommodation hosts—do not necessarily constitute prohibited social scoring. They may simply aggregate human evaluations without using AI. Article 5(1)(c) may become relevant if an AI system combines those ratings with other information to evaluate or classify individuals and the resulting score satisfies the provision’s remaining conditions.
• Lawful practices may include: creditworthiness assessments based on relevant financial information; fraud detection using transactional behavior and other objectively relevant data; insurance pricing based on documented high-risk driving; health assessments using relevant clinical information; platform safety measures based on conduct occurring on the service; targeted advertising based on relevant user preferences; shopping-platform benefits based on purchasing and return history; and law-enforcement evaluations based on information relevant to a specific investigation and subject to applicable safeguards.
• Scoring AI systems—including certain credit, insurance and public-benefit systems—that are not prohibited may instead fall into the Act's high-risk category. Compliance with the requirements for high-risk systems—including risk management, data governance, transparency, human oversight, monitoring and fundamental-rights impact assessments—may help prevent a lawful scoring system from becoming prohibited social scoring.

Practice Takeaway: The dividing line is not “scoring versus no scoring.” The critical questions are what is being scored, which information is used, where that information originated, what consequence follows and whether the resulting treatment is contextually related, justified and proportionate. If the AI scoring system is not prohibited, it will likely fall into the high-risk category instead.

Commission Guidelines, § 4.2 and 4.3, paras. 172–177.

Example: Lawful Scoring - An insurer uses telematics data showing that a policyholder regularly speeds or drives unsafely to increase that person’s premium. The information comes from the relevant driving context, and a proportionate increase may be justified by the greater accident risk.

Example: Lawful Scoring - An online retailer gives customers with a strong purchase history and few returns access to faster return processing or returnless refunds, while other customers retain the standard return process. The benefit is connected to the conduct being assessed and may be a proportionate reward.

1. Evaluation or classification of natural persons over time

The AI system must evaluate or classify an individual or group and assign some form of score. The score does not need to be a conventional numerical rating. It may take the form of:

• a number or probability;
• a ranking;
• a label;
• a category; or
• another assessment that differentiates among people.

“Evaluation” generally involves an assessment or judgment about a person. “Classification” is broader and may include placing people into categories without making an express judgment about them.

Practice Tip: A score does not need to be called a “social score.” Numerical ratings, risk categories, rankings, labels and probability values may all qualify if they evaluate or classify people and are used to determine how they will be treated.

The prohibition applies only to the evaluation or classification of natural persons or groups of natural persons. Scoring legal entities is generally outside its scope.

Commission Guidelines, § 4.2.1(a), paras. 151–153; § 4.3, para. 173.

Profiling may constitute evaluation: AI-enabled profiling may qualify as an evaluation under Article 5(1)(c). Profiling uses information about an individual or group to evaluate characteristics or patterns and place the person into a category, often to analyze or predict interests, abilities or likely behavior.

Example: In SCHUFA I, a computer-generated score predicted whether a person would meet future payment obligations by comparing that person with others who shared similar characteristics. The CJEU held that this constituted profiling under the GDPR. It may also qualify as an evaluation under Article 5(1)(c), but becomes prohibited social scoring only if the provision’s remaining conditions are satisfied.

Commission Guidelines, § 4.2.1(a), para. 154.

The evaluation must occur over time: Article 5(1)(c) applies to evaluation or classification conducted “over a certain period of time.” This generally requires more than a one-time rating based on data from a single, specific interaction.

• The duration is not fixed. Whether the requirement is satisfied depends on the circumstances, including the period covered by the data and the nature of the assessment. The condition should not be interpreted in a manner that permits organizations to evade the prohibition by artificially dividing a continuing evaluation into separate events.

Example: A migration authority uses cameras, motion sensors and other surveillance infrastructure to monitor people in refugee camps. If the system analyzes data collected over time to score particular migrants on their likelihood of absconding, the assessment may satisfy the “over a certain period of time” requirement.

Commission Guidelines, § 4.2.1(b), para. 155.

What information may produce a social score?: The evaluation or classification must be based on social behavior or known, inferred or predicted personal or personality characteristics.

• Social behavior: “Social behavior” is broad. It can encompass a person’s actions, habits and interactions in public, private and commercial settings, including: participation in cultural events or volunteering; payment of debts; use of particular services; relationships with businesses or public authorities; interactions with the police or legal system; compliance with traffic rules; or online and social-media activity. The information may come from a single source or be combined across multiple sources. Commission Guidelines, § 4.2.1(c), para. 157.
• Personal and personality characteristics: Personal or personality characteristics may include a broad range of information, such as age, sex, gender identity or sexual orientation; race, ethnicity or family situation; address, income or household composition; profession, employment status or workplace performance; health or financial circumstances; preferences and interests; reliability or behavior; location or movements; level of debt; or type of car. The characteristics need not be verified facts. Article 5(1)(c) expressly covers known (i.e. provided to the system as input and generally capable of verification); inferred (i.e. derived from other information, often by the AI system); or predicted (i.e. estimated from patterns with less than complete certainty.) Commission Guidelines, § 4.2.1(c), paras. 158–159.

Practice Tip: Review both the information directly collected and the characteristics the system derives from it. A scoring system may rely on inferred or predicted attributes that are never expressly collected from the person but still affect how that person is classified and treated.

2. Unfavorable, Detrimental, Unjustified, or Disproportionate Treatment

The score must lead, or be capable of leading, to:

1. unfavorable or detrimental treatment  in unrelated social contexts and/or
2. unjustified or disproportionate treatment to the gravity of the social behavior

There must be a plausible causal connection between the score and the resulting treatment. This causal connection is interpreted broadly:

• The consequences need not have already occurred. A system placed on the market for use in making adverse decisions may fall within the prohibition if it is capable of producing the prohibited treatment.
• The AI-generated score also does not need to be the sole basis for the decision. A human may consider additional information, but the AI score must play a sufficiently important role in the outcome.
• Nor must the organization producing the score be the organization that acts upon it. A credit agency, for example, may create a score that a public authority, lender or other organization later uses to determine how the person will be treated.

Commission Guidelines, § 4.2.2(a), paras. 160–162.

Practice Tip: Human involvement does not necessarily remove a scoring practice from Article 5. If the AI-generated score plays a sufficiently important role in the final decision, the prohibition may still apply even when a person reviews or supplements the score.

A scoring practice may involve both unrelated data and unjustified or disproportionate consequences.

Example: A government monitors and rates citizens based on social interactions, online activity, purchasing habits and payment history. People with lower scores face restrictions on public services, travel, housing, employment and access to credit. The system uses information across unrelated social contexts while also imposing severe penalties for relatively minor conduct.

Commission Guidelines, § 4.2.2(b), para. 168.

The prohibition can also apply when the system gives awards to certain people if that advantage necessarily results in less favorable treatment for others.

Practice Tip: Favorable treatment can still disadvantage others. Prioritizing certain people for employment support, housing or resettlement may result in less favorable treatment for those who are deprioritized.

Commission Guidelines, § 4.2.2(b), para. 169.

2.(a) Unfavorable Or Detrimental Treatment In An Unrelated Social Context:

“Unfavorable treatment” does not necessarily require proof of particular harm. Selecting someone for additional fraud inspections, for example, may constitute unfavorable treatment. “Detrimental treatment” requires some actual harm or disadvantage. The treatment may also be discriminatory or exclude people from services or opportunities, but discrimination is not a required element. Article 5(1)(c) can reach unfair treatment even when it does not concern a characteristic protected by EU non-discrimination law. Commission Guidelines, § 4.2.2(b), para. 165.

• The critical question is whether there is an apparent and legitimate connection between: the context in which the information was generated or collected; the purpose of the evaluation; and the treatment resulting from the score. Using information from unrelated areas of a person’s life often conflicts with reasonable expectations and may produce generalized surveillance. It may also violate data-protection or sector-specific rules governing which information is relevant and necessary for a particular assessment. Commission Guidelines, § 4.2.2(b), paras. 163–166.

Examples: A tax authority uses social habits or internet-connection data, together with legitimate financial information, to select taxpayers for additional inspections. A welfare agency predicts benefits fraud using a spouse’s nationality, social-media activity, workplace performance or other characteristics unrelated to eligibility. A public employment agency determines access to employment support using marital status, chronic health conditions or addiction data with no apparent connection to the purpose of the assessment.

Commission Guidelines, § 4.2.2(b), para. 166.

Practice Tip: Examine contextual relevance, not merely predictive value. Information may correlate statistically with an outcome without having a legitimate connection to the purpose of the evaluation. Predictive power alone does not make data appropriate for use in a social score.

2.(b) Unjustified Or Disproportionate Treatment To The Gravity Of The Social Behavior:

• Treatment may be unjustified when it lacks a legitimate purpose. It may be disproportionate when the severity of the consequence exceeds what the underlying conduct reasonably warrants.
• The assessment should consider: the seriousness of the behavior; the severity of the resulting treatment; the extent of interference with fundamental rights; the legitimacy of the purpose pursued; applicable legal standards and procedures; and broader principles of fairness and social justice.

Commission Guidelines, § 4.2.2(b), para. 167.

Example: A public agency uses AI to identify children considered at risk based on parental unemployment, mental health and behavior drawn from multiple contexts. Families are subjected to inspections or separated based on relatively minor conduct, such as missing medical appointments or receiving traffic fines. Removing a child because of such minor behavior may be unjustified or grossly disproportionate.

Example: A municipality scores residents’ trustworthiness using conduct such as insufficient volunteering, returning library books late, placing rubbish outside on the wrong day or delaying local tax payments. Residents with low scores are blacklisted, lose public benefits and face increased surveillance. Those consequences may be disproportionate to the minor behavior being scored.

Commission Guidelines, § 4.2.2(b), para. 167.

NOTE: A scoring practice that does not satisfy every element of Article 5(1)(c) may therefore still be unlawful or regulated under a legal framework other than the EU AI Act. Social scoring may also be regulated by: the GDPR, including its requirements concerning lawfulness, fairness, transparency, data minimization and automated decision-making; EU consumer-protection law; EU non-discrimination law; the Consumer Credit Directive; and sector-specific EU and national rules governing the information that may be used and the procedures required for particular assessments. Commission Guidelines, § 4.4, paras. 178–182.

Other Resources and Recommended Reading

• EU AI Act — Social Scoring — Article 5(1)(c) defines the prohibited scoring and resulting treatment. Recital 31 explains the risks to equality, dignity and fundamental rights.
• European Commission — Guidelines on Prohibited AI Practices — Examines evaluation over time, social behavior and personal characteristics, adverse treatment and the distinction from lawful sector-specific assessment. See § 4, paragraphs 145–182.
• EU AI Act — High-Risk Assessment Systems — Article 6 and Annex III, points 5(a)–(c), address certain benefits, creditworthiness and insurance systems. See recital 58 for essential services.
• General Data Protection Regulation — Articles 4(4) and 22 address profiling and automated decisions; Articles 5–6 govern processing. See recital 71.
• Consumer Credit Directives — Directive (EU) 2023/2225, Article 18 and recitals 54–56, addresses creditworthiness. Under Articles 47–48, the new rules apply from November 20, 2026; until then, compare Directive 2008/48/EC, Article 8.

Related The De La Torre Review Articles

• Prohibited AI Practices Under the EU AI Act: Where Europe Draws the Line — Introduces the prohibited-practices framework and its cumulative statutory conditions. Read the Article.
• Prohibited AI Practices Under the EU AI Act: When AI Persuasion Becomes Prohibited Manipulation — Explains the elements separating persuasion from prohibited harmful manipulation and deception. Read the Article.
• Prohibited AI Practices Under the EU AI Act: When AI Exploits Vulnerability — Examines exploitation linked to age, disability and social or economic circumstances, including the requirements of behavioral distortion and significant harm. Read the Article.
• Prohibited AI Practices Under the EU AI Act: Limits on Crime Prediction — Examines the prohibition on predicting individual criminal conduct based solely on profiling or personal characteristics and the exception for supporting human assessments grounded in objective, verifiable facts. Read the Article.
• Prohibited AI Practices Under the EU AI Act: Facial-Recognition — Explains the ban on untargeted scraping of facial images from the internet or CCTV footage to create or expand facial-recognition databases. Read the Article.
• Prohibited AI Practices Under the EU AI Act: Emotion Recognition at Work and School — Examines prohibited emotional inferences from biometric data in workplaces and educational institutions, including the medical and safety exceptions. Read the Article.
• Prohibited AI Practices Under the EU AI Act: Inferring Sensitive Characteristics From Biometrics — Explains the prohibition on individual biometric categorization used to infer specified sensitive characteristics, its exclusions and its relationship with data-protection law. Read the Article.
• Prohibited AI Practices Under the EU AI Act: Real-Time Remote Biometric Identification — Explains the conditions, exceptions and safeguards governing real-time biometric identification in publicly accessible spaces for law-enforcement purposes. Read the Article.
• Prohibited AI Practices Under the EU AI Act: Non Consensual Intimate Material and Child Sexual Abuse — Examines the new Digital Omnibus prohibitions on generating or manipulating non-consensual intimate material or child sexual abuse material, including provider safeguards and deployer responsibilities. Read the Article.