Article 5: prohibited AI practices.
Reviewed
Short answer
Article 5 of the AI Act has banned eight AI practices since 2 February 2025, including manipulative or exploitative AI, social scoring, predicting crime from profiling alone, untargeted scraping of facial images, emotion recognition at work and in schools, and biometric categorisation by sensitive traits; real-time remote biometric identification for law enforcement is allowed only in narrow cases. From 2 December 2026 two more bans apply, on AI that generates non-consensual intimate imagery of identifiable people and on AI that generates child sexual abuse material.
Official sources: AI Act, Article 5 (consolidated) · Article 113(a)
The banned practices
| Point | Banned | Limits and exceptions | From |
|---|---|---|---|
| (a) | Subliminal, purposefully manipulative or deceptive techniques that materially distort behaviour and cause, or are reasonably likely to cause, significant harm | Requires the distortion and the (likely) significant harm | 2 Feb 2025 |
| (b) | Exploiting vulnerabilities due to age, disability or a specific social or economic situation, with that effect | Requires the distortion and the (likely) significant harm | 2 Feb 2025 |
| (ba) | Generating or manipulating realistic images, videos, audio or similar material of an identifiable person’s intimate parts or sexually explicit activities without their explicit consent | Providers: if it is the intended purpose, or foreseeable without adequate safeguards; users: if used for that purpose | 2 Dec 2026 |
| (bb) | Generating or manipulating child sexual abuse material (Directive 2011/93/EU, Article 2(c) and (e)) | Except where a “without right” defence applies under national law | 2 Dec 2026 |
| (c) | Social scoring leading to detrimental treatment in unrelated contexts, or treatment that is unjustified or disproportionate | — | 2 Feb 2025 |
| (d) | Predicting the risk that a person commits a crime based solely on profiling or personality traits | Not systems supporting a human assessment already based on objective, verifiable facts | 2 Feb 2025 |
| (e) | Creating or expanding facial recognition databases by untargeted scraping of facial images from the internet or CCTV | — | 2 Feb 2025 |
| (f) | Inferring emotions of a person at the workplace or in education institutions | Except for medical or safety reasons | 2 Feb 2025 |
| (g) | Biometric categorisation to deduce race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation | Not labelling or filtering of lawfully acquired biometric datasets, or categorisation in law enforcement | 2 Feb 2025 |
| (h) | Real-time remote biometric identification in publicly accessible spaces for law enforcement | Allowed only for listed objectives (victims, imminent threats, serious crimes), with prior authorisation and national law | 2 Feb 2025 |
Who the bans cover
Each ban covers placing such a system on the market, putting it into service and using it, so it reaches both providers and deployers, inside and outside the EU under Article 2. For the two new bans, Article 5(1a) narrows it: a provider is caught when generating such material is the system’s intended purpose, or a reasonably foreseeable and reproducible outcome without reasonable safeguards against misuse; a user is caught when they use a system for that purpose. Edits that do not increase the exposure of intimate parts or change the nature of sexual activities are not “manipulation” for point (ba) (Article 5(1b)).
Fines
Breaching Article 5 carries the highest fines in the Act: up to EUR 35 000 000 or, for an undertaking, 7 % of total worldwide annual turnover for the preceding financial year, whichever is higher (Article 99(3)). For SMEs, including start-ups, the lower of the two is the cap (Article 99(6)); the new reduction for small mid-caps (Article 99(6a)) does not cover Article 5. See fines and penalties.
The Commission’s guidelines
The Commission published guidelines on the prohibited practices on 4 February 2025. They explain each ban with examples, are not binding, and leave authoritative interpretation to the Court of Justice of the EU (Commission page).
Questions
- Is emotion recognition banned?
- Only at the workplace and in education institutions, and even there it is allowed for medical or safety reasons (Article 5(1)(f)). Elsewhere, emotion recognition is listed as high-risk in Annex III, and deployers must inform the people exposed to it (Article 50(3)).
- Are deepfakes banned?
- Not in general: professional deployers must disclose them under Article 50(4). From 2 December 2026, AI that generates non-consensual intimate imagery of identifiable people, and AI that generates child sexual abuse material, are prohibited under Article 5(1)(ba) and (bb).
Sources
- AI Act, Article 5: Prohibited AI practicesEuropean Commission, AI Act Service Desk (AI Act Explorer)Consolidated text as at 27 July 2026 (includes the Digital Omnibus, Regulation (EU) 2026/1744), shown in the Commission’s AI Act Explorer.read
- AI Act, Article 113: Entry into force and applicationEuropean Commission, AI Act Service Desk (AI Act Explorer)Consolidated text as at 27 July 2026 (includes the Digital Omnibus, Regulation (EU) 2026/1744), shown in the Commission’s AI Act Explorer.read
- AI Act, Article 99: PenaltiesEuropean Commission, AI Act Service Desk (AI Act Explorer)Consolidated text as at 27 July 2026 (includes the Digital Omnibus, Regulation (EU) 2026/1744), shown in the Commission’s AI Act Explorer.read
- Commission Guidelines on prohibited artificial intelligence practices (published 4 February 2025)European Commissionread
- Regulation (EU) 2026/1744 (Digital Omnibus on AI) — Article 111(4) transition, Article 50(7)EUR-Lex / Official Journal of the EURead on 2 November 2026 from the EU Publications Office’s copy of the Official Journal text (publications.europa.eu, same act); EUR-Lex blocks scripted fetches.read
- Regulation (EU) 2024/1689 (AI Act), Annex III — high-risk areas (not amended by 2026/1744)EUR-Lex / Official Journal of the EURead on 2 November 2026 from the EU Publications Office’s copy of the Official Journal text (publications.europa.eu, same act); EUR-Lex blocks scripted fetches.read
Last reviewed by Volkan Çatak, Founder, Proofcan.
Not legal advice. This page explains official texts in plain words and links each one; check the sources, or a lawyer, before relying on it for a decision.