Prohibited AI Practices: Article 5 Is Already In Force

Last updated 4 November 2026

Prohibited AI practices have been enforceable longer than any other part of the EU AI Act and carry the largest fine in the Regulation. Article 5 has applied since 2 February 2025, and breaching it costs up to €35,000,000 or 7% of total worldwide annual turnover, whichever is higher.

The eight practices are also narrower than their headlines suggest. Nearly every one carries a qualifier that decides whether real-world systems are caught, and reading only the summary produces both false alarms and false comfort.

From 2 December 2026 the list grows to ten. Regulation (EU) 2026/1744, the Digital Omnibus on AI, inserts two further points into Article 5(1) — (ba) non-consensual intimate imagery and (bb) child sexual abuse material — along with Article 5(1a) and (1b), which set the qualifiers for both. The eight below have been enforceable since February 2025; the two new ones are set out further down.

The eight prohibited AI practices

Article 5(1) prohibits the placing on the market, putting into service or use of AI systems in eight categories, and from 2 December 2026 in two more. What follows is what each one actually says.

The two prohibited AI practices that turn on harm

(a) Subliminal, manipulative or deceptive techniques. The prohibition is not on persuasion. It applies where techniques operate beyond a person’s consciousness, or are purposefully manipulative or deceptive, with the objective or effect of materially distorting behaviour by appreciably impairing the ability to make an informed decision — causing a decision they would not otherwise have taken — in a manner that causes or is reasonably likely to cause significant harm.

(b) Exploiting vulnerabilities due to age, disability, or a specific social or economic situation, with the same material-distortion and significant-harm tests.

Both of these prohibited AI practices require significant harm. A recommendation engine that nudges purchasing is not caught by (a) merely because it is effective — the question is whether it impairs informed decision-making and risks significant harm. That is a genuinely high bar, and worth stating internally before a project is cancelled unnecessarily.

Social scoring: the consequence, not the score

(c) prohibits evaluating or classifying people over a period of time based on social behaviour or known, inferred or predicted personal characteristics, where the social score leads to either:

• detrimental or unfavourable treatment in social contexts unrelated to the contexts in which the data was originally generated or collected; or
• detrimental or unfavourable treatment that is unjustified or disproportionate to the behaviour.

The prohibition attaches to the consequence, not the scoring. Context transfer is the trigger most likely to catch a commercial system: using behaviour observed in one relationship to disadvantage someone in an unrelated one.

Four prohibited AI practices with explicit carve-outs

(d) Predictive policing based solely on profiling. Assessing or predicting the risk that a person will commit a criminal offence, based solely on profiling or on assessing personality traits. The carve-out is express: this does not apply to AI systems supporting a human assessment of involvement in criminal activity that is already based on objective and verifiable facts directly linked to criminal activity.

(f) Emotion inference in the workplace and education. Prohibited in workplaces and education institutions — except where the system is intended for medical or safety reasons. Note the two settings named: this is not a general ban on emotion recognition.

(g) Biometric categorisation of sensitive traits. Categorising individuals from biometric data to deduce or infer race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation. The prohibition does not cover labelling or filtering of lawfully acquired biometric datasets, such as images, or categorising biometric data in the area of law enforcement.

(h) Real-time remote biometric identification in publicly accessible spaces for law enforcement — unless strictly necessary for defined objectives, including targeted searches for victims of abduction, trafficking or sexual exploitation, searches for missing persons, and preventing a specific, substantial and imminent threat to life or physical safety.

The one prohibited AI practice with no qualifier

(e) Untargeted scraping of facial images. Creating or expanding facial recognition databases through untargeted scraping of facial images from the internet or CCTV footage.

No harm test, no carve-out, no purpose limitation in the text. Of the eight, this is the cleanest prohibition — and the one most likely to be inherited from a vendor whose training data provenance you never asked about.

Two more prohibited AI practices from 2 December 2026

Regulation (EU) 2026/1744 inserts points (ba) and (bb) into the first subparagraph of Article 5(1) and adds Article 5(1a) and (1b). Under Article 113 as amended, those four provisions apply from 2 December 2026, while the rest of Article 5 has applied since 2 February 2025.

(ba) Non-consensual intimate imagery. An AI system that generates or manipulates realistic images, videos, audio or similar material of an identifiable natural person’s intimate parts, or of an identifiable natural person engaged in sexually explicit activities, without that person’s freely given, specific, informed, unambiguous and explicit consent for that generation or manipulation. Consent is the carve-out, and it is consent to the generation itself, not to the underlying image.

(bb) Child sexual abuse material. An AI system that generates or manipulates material or a performance within the meaning of Article 2, points (c) and (e), of Directive 2011/93/EU, except where a “without right” defence applies under national law. That defence is what leaves room for activity carried out under domestic legal powers, and for red-teaming and evaluation done to test a system against this prohibition.

Article 5(1a) carries the qualifiers, and they decide who is caught. Placing on the market or putting into service is prohibited only where either that generation or manipulation is the intended purpose of the system, or the system’s design, training, architecture, capabilities or user-facing functionalities make it a reasonably foreseeable and reproducible outcome without significant technical modification and the system lacks reasonable and adequate technical safety measures and other safeguards to reliably prevent it, taking account of reasonably foreseeable misuse, and to correct misuse that is observed or reported. For a deployer, use is prohibited only where the system is used for the purpose of generating or manipulating such material.

For a general-purpose generative system, then, the operative question is not whether such an output is conceivable. It is whether the safeguards reliably prevent it and whether reported misuse is actually corrected — an evidence question, which is why these two prohibited AI practices land on documentation rather than on legal opinion.

Article 5(1b) is a definition, not an exemption. For point (ba), manipulating material in a way that does not increase the exposure of any depicted intimate parts and does not alter the nature of any depicted sexually explicit activities is not “manipulation” for the purposes of that point.

Why prohibited AI practices are urgent and the rest is not

Article 113 staggers application. The Regulation applies generally from 2 August 2026, but Chapters I and II — which contain Article 5 — applied from 2 February 2025. The high-risk obligations in Chapter III, Sections 1 to 3, come later still: 2 December 2027 for systems classified as high-risk under Article 6(2) and Annex III, and 2 August 2028 for systems classified as high-risk under Article 6(1) and Annex I. Regulation (EU) 2026/1744 postponed both — from 2 August 2026 and 2 August 2027 respectively.

So the sequencing for most organisations is the opposite of how they are planning: the high-risk classification work has time, and the prohibition screen does not. It has already been live for over a year.

The fine reinforces it. Article 99(3) sets non-compliance with Article 5 at up to €35 million or 7% of worldwide annual turnover, against €15 million or 3% for most other operator breaches. The Omnibus left Article 99(3) alone, so the two new points carry the same top tier from the day they apply; it did insert Article 99(6a), which caps each fine for a small mid-cap enterprise at whichever of the percentage or the fixed amount is lower.

How prohibited AI practices fit your AI governance

Where to start screening for prohibited AI practices

1. Screen the AI inventory against all ten — including systems you bought rather than built, and including the two points that apply from 2 December 2026.
2. Read the qualifiers before concluding. Most of the practices require harm, context transfer, or a specific setting.
3. Check training data provenance for anything involving facial recognition, because (e) has no carve-out.
4. Look hardest at workplace tools, where (f) applies by setting rather than by intent.
5. For generative systems, test the safeguards and keep the evidence — points (ba) and (bb) turn on intended purpose, on reasonably foreseeable and reproducible outputs, and on whether misuse is prevented and then corrected.
6. Record the screening conclusion per system, with the reasoning — a defensible “not prohibited” is an asset.
7. Re-screen on change, since a repurposed system can cross into Article 5 without any new procurement.

This guide reflects Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI), read on EUR-Lex at 4 November 2026.

The EU AI Act Toolkit provides 60 editable templates covering the AI system inventory, the prohibited practice and risk classification screening, the technical documentation and the governance records the Regulation expects.