Article 5 of the EU AI Act bans a short list of AI practices outright, the bans have applied since 2 February 2025, and breaching them carries the Act's highest fines. Unlike the high-risk rules, there is no conformity assessment to pass: a practice is either prohibited or it is not. The Digital Omnibus on AI, Regulation (EU) 2026/1744, added two further prohibitions on non-consensual intimate imagery and child sexual abuse material that apply from 2 December 2026. This guide explains each prohibition, the boundaries the Commission drew in its February 2025 guidelines, who is responsible, the penalties, and how to screen your AI systems and agents so that none drifts into a banned use. It is written for security, risk, privacy and product teams and for executives who sign off AI use cases. For the Act as a whole, see the EU AI Act Compliance Guide.
Key takeaways
- Ten practices are on the banned list. Article 5(1) lists harmful manipulation, exploitation of vulnerabilities, social scoring, crime prediction from profiling alone, untargeted facial scraping, emotion recognition at work and in education, sensitive biometric categorisation, law enforcement real-time remote biometric identification, and, from 2 December 2026, intimate imagery without consent and child sexual abuse material.
- The bans cover the whole lifecycle. They apply to placing on the market, putting into service and use, so providers and deployers are both exposed, including for in-house systems and systems offered through an API.
- Context decides most cases. Emotion inference about customers is outside Article 5(1)(f), but the same feature pointed at employees is banned; fatigue detection is not emotion recognition at all.
- Fines reach EUR 35 million or 7% of worldwide turnover. That is the top tier of Article 99, and the Omnibus lower cap for small mid-caps does not apply to it.
- General-purpose systems and agents are in scope. The Commission expects providers to build safeguards and contractual restrictions so that systems are not reasonably likely to be used in a prohibited way.
Scope: who and what is covered
Article 5 applies to any AI system within the Act's scope under Article 2: providers placing systems on the EU market or putting them into service, deployers in the EU, and third-country providers and deployers whose output is used in the EU. The usual exclusions apply: systems used exclusively for military, defence or national security; systems developed solely for scientific research; research, testing and development before placing on the market (real-world testing is not excluded); and personal non-professional use. Free and open-source systems are not exempt from Article 5.
The Commission's guidelines on prohibited practices, published on 4 February 2025, are non-binding: authoritative interpretation is reserved for the Court of Justice of the European Union. According to Covington's summary of the guidelines, they read the three activities broadly:
- Placing on the market: making a system available by any means, including via API, cloud or embedding in another product.
- Putting into service: includes in-house development and deployment, not only supply to third parties.
- Use: any use after placing on the market or putting into service, including misuse that amounts to a prohibited practice.
Only Article 5(1)(h), real-time remote biometric identification for law enforcement, is framed purely as a ban on use. The guidelines also note that a system falling within an Article 5 exception may still be high-risk under Article 6. See the EU AI Act High-Risk AI Systems Guide.
Key obligations
The core obligation is negative: do not place on the market, put into service or use a system for any of the practices below. The table summarises each prohibition from the consolidated Article 5 on the Commission's AI Act Service Desk, with examples taken from summaries of the Commission's guidelines (Covington and CMS).
| Article 5(1) | What is banned | Inside the ban (guideline examples) | Outside the ban |
|---|---|---|---|
| (a) Manipulation | Subliminal, purposefully manipulative or deceptive techniques that materially distort behaviour and cause or are likely to cause significant harm | Techniques that subvert autonomy to push harmful choices | Personalised advertising based on preferences is not inherently manipulative |
| (b) Exploiting vulnerabilities | Exploiting age, disability or a specific social or economic situation to distort behaviour with significant harm | Addictive reward loops; scams targeted at older people; predatory loans targeted at people in financial distress | Lawful persuasion that is transparent and consented |
| (ba) Intimate imagery (from 2 December 2026) | Generating or manipulating realistic intimate or sexually explicit material of an identifiable person without explicit consent | Systems whose intended purpose, or reasonably foreseeable reproducible outcome without safeguards, is such content | Edits that do not increase exposure or change the nature of the activity (Article 5(1b)) |
| (bb) Child sexual abuse material (from 2 December 2026) | Generating or manipulating material covered by Directive 2011/93/EU | Same intended purpose and safeguard test as (ba) | Where a national "without right" defence applies |
| (c) Social scoring | Scoring people on social behaviour or personal traits leading to detrimental treatment in unrelated contexts or disproportionate treatment | An insurer using spending data to decide life insurance eligibility | Some credit scoring and targeted advertising, subject to conditions |
| (d) Crime prediction | Assessing the risk of a person committing an offence based solely on profiling or personality traits | A private analytics firm asked by police to flag potential traffickers from bank and communication records | Supporting a human assessment based on objective, verifiable facts; private profiling to protect the business's own operations |
| (e) Facial scraping | Creating or expanding facial recognition databases by untargeted scraping from the internet or CCTV | Harvesting social media photos to build a recognition database | Voice samples; databases not used to recognise people; generating images of fictitious people |
| (f) Emotion recognition | Inferring emotions of people in the workplace or educational institutions, except for medical or safety reasons | Webcam or voice analysis of call centre staff; emotion analysis in recruitment or admissions tests | Customers' emotions; text-based sentiment; physical states such as pain or fatigue |
| (g) Biometric categorisation | Categorising people from biometric data to infer race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation | Sorting users by assumed political orientation from photos; deducing race from a voice | Labelling or filtering lawfully acquired biometric datasets; law enforcement categorisation |
| (h) Real-time remote biometric identification | Use in publicly accessible spaces for law enforcement | Live facial recognition on public streets by police | Strictly necessary targeted searches for victims, imminent threats to life or terrorism, and suspects of serious offences (Annex II, at least four years) |
Conditions on the law enforcement exception
Where a Member State permits the Article 5(1)(h) exceptions, each use must confirm the identity of a specifically targeted individual, follow a fundamental rights impact assessment under Article 27 and registration under Article 49, and have prior authorisation from a judicial or independent administrative authority. In urgent cases use may start first, but authorisation must be requested within 24 hours; if refused, use stops and all data and outputs are deleted. No adverse legal decision may rest solely on the system's output, and each use is notified to the market surveillance and data protection authorities. Remote biometric identification outside these bans is high-risk under Annex III point 1.
The safeguard test for the new prohibitions
Article 5(1a) sets how the Omnibus prohibitions attach. Placing on the market or putting into service is prohibited only if generating the material is the intended purpose, or a reasonably foreseeable and reproducible outcome that the system does not reasonably safeguard against. For deployers, use is prohibited where they use the system to generate such material. For any provider of an image, video or audio generation capability, safeguards are the compliance evidence.
Provider and deployer duties in practice
- Providers, including of general-purpose AI: according to the guidelines summary, providers should not place on the market systems reasonably likely to behave or be used in a prohibited manner, which in practice means technical safeguards, terms that forbid prohibited uses, and oversight instructions to deployers.
- Deployers: the deployer chooses the context, so the deployer usually decides whether a lawful feature becomes a banned one, for example switching on sentiment analysis for staff calls.
- Other law still applies: Article 5(8) leaves prohibitions under other Union law untouched, and processing of biometric data remains subject to GDPR Article 9. See the AI and GDPR Guide.
Timeline and current status
| Date | Status |
|---|---|
| 2 February 2025 | Article 5(1)(a) to (h) apply (Chapter II) |
| 4 February 2025 | Commission guidelines on prohibited practices published (page updated 31 July 2025) |
| 2 August 2025 | Penalties chapter applies, so Article 5 breaches can be fined |
| 27 July 2026 | Digital Omnibus, Regulation (EU) 2026/1744, enters into force |
| 2 December 2026 | Article 5(1)(ba) and (bb), and Article 5(1a) and (1b), apply |
Dates are from the consolidated Article 113 on the Commission's AI Act Service Desk. The guidelines pre-date the Omnibus and do not cover points (ba) and (bb); watch for updated guidance.
Enforcement and penalties
Article 99(3) sets the highest tier for Article 5: up to EUR 35 million or, for an undertaking, 7% of total worldwide annual turnover for the preceding year, whichever is higher. For SMEs and start-ups the lower of the two applies. The Omnibus lower cap for small mid-cap companies covers only the lower tiers, not Article 5. National market surveillance authorities enforce, and for the law enforcement exceptions they and data protection authorities report annually to the Commission. Authorities weigh gravity, duration, the number of people affected, intent or negligence, mitigation and cooperation (Article 99(7)), so being able to show when a prohibited use was detected and switched off matters.
What it means for AI agents and non-human identities
Agents rarely set out to perform a prohibited practice; they reach one through tools, data and instructions. A general-purpose agent with access to HR call recordings and a sentiment tool can perform workplace emotion recognition without anyone designing it to.
- Constrain tools by purpose: scope each agent's credentials and tool permissions to its approved use case. An agent that cannot reach biometric data stores or facial image sources cannot scrape or categorise. See the AI Agent Identity Security Buyer's Guide.
- Treat prompt injection as a route to prohibited use: OWASP LLM01:2025 Prompt Injection and LLM06:2025 Excessive Agency describe how injected instructions and broad permissions let an agent act outside its purpose. MITRE ATLAS AML.T0051 LLM Prompt Injection is the matching threat case.
- Log against agent identity: if each agent has its own identity, logs show which agent processed which data, which is how you prove a prohibited use did not happen, or how quickly it was stopped.
- Find unmanaged AI: shadow AI tools adopted by teams are where unreviewed emotion analysis or scraping features appear. See the Shadow AI Discovery Guide.
- Generation agents need content safeguards: from 2 December 2026, any agent that can generate realistic images, video or audio of real people needs the safeguards Article 5(1a) refers to. See the Deepfake and AI Impersonation Guide.
Compliance steps
- Inventory systems and agents: record purpose, data sources, affected people (employees, students, customers, public) and biometric inputs. See the AI Register and AI Inventory Template.
- Screen every entry against Article 5: use the table above as a questionnaire, recording the answer and reasoning for each point (a) to (h), plus (ba) and (bb) for generation capabilities.
- Escalate borderline cases: emotion inference, profiling and biometric features go to legal review with the guidelines; document the conclusion.
- Stop and remediate: switch off any prohibited feature immediately, revoke the credentials and data access that enabled it, and keep evidence of the date and scope of the change.
- Write prohibitions into policy and contracts: add Article 5 uses to the acceptable use policy and to supplier and customer terms. See the AI Acceptable Use Policy Template.
- Gate new use cases: make Article 5 screening a mandatory step in AI intake and change management, including when an existing system gains a new data source or tool.
- Test safeguards: red-team generation and agent systems for prohibited outputs and purpose drift before release and after major changes. See the AI Red Teaming Guide.
- Re-screen periodically: repeat at least annually and whenever the Commission updates guidance.
Decision guidance
| Situation | Likely position | Action |
|---|---|---|
| Sentiment analysis on customer calls | Outside 5(1)(f); may raise transparency and GDPR issues | Keep, document, confirm staff voices are not analysed |
| Same tool scoring agent (employee) stress | Prohibited unless for medical or safety reasons | Disable for employees |
| Driver or pilot fatigue detection | Not emotion recognition | Assess under high-risk and data protection rules |
| Fraud scoring of customers | Not crime prediction where it protects the business's own operations | Document purpose and limits |
| Face matching for staff building access by consent | Verification, outside Article 5 and Annex III point 1(a) | Apply GDPR Article 9 safeguards |
| Image generator open to the public | In scope of 5(1)(ba) and (bb) from 2 December 2026 unless safeguarded | Implement and test content safeguards |
Small organisations usually face the question as deployers of bought tools: the work is reviewing features and switching off the wrong ones. Large organisations and providers need a formal intake gate, contractual restrictions and safeguard testing.
Detection and measurement
- Percentage of inventoried AI systems and agents with a recorded Article 5 screening result.
- Number of borderline cases escalated and resolved, with time to decision.
- Time from discovery of a prohibited feature to its disablement and credential revocation.
- Shadow AI tools discovered per quarter that had not been screened.
- Red-team pass rate for prohibited-output tests on generation systems.
Framework mapping
| Activity | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 |
|---|---|---|
| Know the legal prohibitions | PM-9 Risk Management Strategy | GV.OC-03 |
| Policy forbidding prohibited uses | PM-9 | GV.PO-01 |
| Inventory and screening | CM-8 System Component Inventory, RA-3 Risk Assessment | ID.AM-02, ID.RA-04 |
| Privacy and biometric impact | RA-8 Privacy Impact Assessments | GV.OC-03 |
| Limit agent tools and data | AC-6 Least Privilege | PR.AA-05 |
| Supplier and customer terms | SR-3 Supply Chain Controls and Processes | GV.SC-05 |
Common failure patterns
- Feature creep in bought tools: contact centre, HR and proctoring platforms ship emotion analytics that a deployer switches on for staff or students.
- Screening once: a system cleared at intake later gains a new data source, such as webcam feeds, and nobody re-screens it.
- Assuming research or open-source exemptions: open-source systems are not exempt from Article 5, and the research exclusion ends once a system is put into service.
- Ignoring in-house systems: internal tools are "put into service" even if never sold.
- Agents with broad access: an agent able to reach image sources and biometric stores can perform scraping or categorisation without any human deciding to.
- Relying on old guidance for the new bans: the 2025 guidelines do not cover the December 2026 prohibitions.
Practitioner checklist
- Screen every AI system and agent against Article 5(1)(a) to (h) and record the result.
- Screen every image, video and audio generation capability against points (ba) and (bb) before 2 December 2026.
- Disable emotion recognition for employees and students unless it is for medical or safety reasons.
- Confirm no system builds face databases from untargeted scraping.
- Add Article 5 practices to the acceptable use policy, supplier contracts and customer terms.
- Scope agent credentials and tools to approved purposes, with separate identities per agent.
- Make Article 5 screening part of AI intake and change management.
- Keep evidence of screening, escalation and remediation dates.
Standards and references
- European Commission AI Act Service Desk: Article 5 Prohibited AI practices
- European Commission: Guidelines on prohibited artificial intelligence practices
- European Commission AI Act Service Desk: Article 113 Entry into force and application
- European Commission AI Act Service Desk: Article 99 Penalties
- European Commission AI Act Service Desk: Article 2 Scope
- Covington Inside Privacy: European Commission guidelines on prohibited AI practices
- CMS: EU Commission issues guidelines on prohibited AI practices, Part II
- OWASP: Top 10 for LLM Applications 2025
Related NHI Mgmt Group resources: EU AI Act Compliance Guide · EU AI Act High-Risk AI Systems Guide · AI Governance Guide · Biometrics Guide. This guide summarises Article 5 of the EU AI Act as amended by Regulation (EU) 2026/1744 and is not legal advice.