Prohibited AI is an AI use case that the EU AI Act treats as unacceptable risk and therefore does not allow. The ban is about the use of the system, not just the model itself: a tool can be legal in one context and prohibited in another if it is deployed for a forbidden purpose. Typical examples include AI that enables harmful manipulation, unfair social scoring, or certain intrusive biometric practices.
For cyber security teams, this matters because AI governance is now part of access control, vendor review, and change management. Security and compliance staff must know where AI is embedded, what it is used for, and whether a new workflow turns a lower-risk system into a banned one. In attacks, prohibited AI may appear as a governance red flag when an adversary tries to deploy tools for surveillance, profiling, or other abusive automation. In defense, it means documenting intent, blocking disallowed use cases, and keeping evidence that a system was assessed before deployment.