Prohibited AI practices

Overview

Article 5 of the EU AI Act establishes a category of AI practices that are entirely prohibited across the Union — not subject to risk management, not conditioned on prior notification, but flatly banned 32024R1689 Article 5@2024-06-13. The prohibitions attach to placing on the market, putting into service, and using the relevant systems, with narrow carve-outs stated explicitly where they apply.

The Eight Prohibited Practices

1. Subliminal, manipulative, and deceptive techniques An AI system is prohibited if it deploys subliminal techniques operating beyond a person's consciousness, or purposefully manipulative or deceptive techniques, where the objective or effect is to materially distort the behaviour of a person or group by appreciably impairing their ability to make an informed decision — causing them to take a decision they would not otherwise have taken — in a manner that causes or is reasonably likely to cause that person, another person, or group of persons significant harm 32024R1689 Article 5@2024-06-13. Both intent and effect trigger the prohibition; a system need not be designed to manipulate if it demonstrably produces that outcome.

2. Exploitation of vulnerabilities AI systems that exploit vulnerabilities arising from age, disability, or a specific social or economic situation are prohibited where the objective or effect is to materially distort the behaviour of the affected person or group in a manner that causes or is reasonably likely to cause that person or another person significant harm 32024R1689 Article 5@2024-06-13. The prohibition covers exploitation of any of these vulnerability types, individually or in combination.

3. Social scoring AI systems used to evaluate or classify natural persons or groups over time on the basis of social behaviour or known, inferred, or predicted personal or personality characteristics are prohibited where the resulting social score leads to detrimental or unfavourable treatment in social contexts that are unrelated to the contexts in which the data was originally generated or collected, or to treatment that is unjustified or disproportionate to the social behaviour concerned or its gravity 32024R1689 Article 5@2024-06-13.

4. Predictive policing based solely on profiling AI systems that make risk assessments of natural persons to assess or predict the risk of committing a criminal offence, based solely on profiling or the assessment of personality traits and characteristics, are prohibited 32024R1689 Article 5@2024-06-13. The prohibition does not apply to systems that support a human assessment of a person's involvement in a criminal activity that is already grounded in objective and verifiable facts directly linked to a criminal activity 32024R1689 Article 5@2024-06-13.

5. Untargeted facial image scraping Creating or expanding facial recognition databases through untargeted scraping of facial images from the internet or CCTV footage is prohibited 32024R1689 Article 5@2024-06-13. The qualifier "untargeted" is structurally significant: the prohibition is directed at mass indiscriminate collection, not at targeted lawful acquisition.

6. Emotion recognition in the workplace and educational institutions AI systems that infer the emotions of a natural person in the areas of workplace and education institutions are prohibited, except where the use is intended for medical or safety reasons 32024R1689 Article 5@2024-06-13.

7. Biometric categorisation inferring sensitive attributes Biometric categorisation systems that classify individuals based on their biometric data to deduce or infer race, political opinions, trade union membership, religious or philosophical beliefs, sex life, or sexual orientation are prohibited 32024R1689 Article 5@2024-06-13. The prohibition does not cover labelling or filtering of lawfully acquired biometric datasets, such as images, based on biometric data, or categorisation of biometric data in the area of law enforcement 32024R1689 Article 5@2024-06-13.

8. Real-time remote biometric identification in publicly accessible spaces The use of real-time remote biometric identification systems in publicly accessible spaces for law enforcement purposes is prohibited unless strictly necessary for one of three narrow objectives: the targeted search for specific victims of abduction, trafficking in human beings, or sexual exploitation, or for missing persons; the prevention of a specific, substantial, and imminent threat to life or physical safety, or a genuine and present or genuine and foreseeable threat of a terrorist attack; or the localisation or identification of a person suspected of having committed a criminal offence, for the purpose of conducting a criminal investigation or prosecution or executing a criminal penalty for offences referred to in Annex II and punishable in the Member State concerned by a custodial sentence or a detention order for a maximum period of at least four years 32024R1689 Article 5@2024-06-13.

Conditions Governing the Real-Time Biometric Exception

Where one of the three exceptions applies, deployment remains subject to cumulative procedural and substantive safeguards 32024R1689 Article 5@2024-06-13:

• Use is limited to confirming the identity of the specifically targeted individual; it does not authorise general surveillance.
• The deploying authority must take into account the nature of the situation, in particular the seriousness, probability and scale of the harm that would be caused if the system were not used, and the consequences of the use for the rights and freedoms of all persons concerned.
• A fundamental rights impact assessment under Article 27 must be completed, and the system must be registered in the EU database under Article 49 before deployment; in duly justified cases of urgency, registration may follow without undue delay.
• Prior authorisation from a judicial authority or an independent administrative authority with binding decision-making power is required. In genuine urgency, deployment may begin without prior authorisation provided that authorisation is requested without undue delay and no later than 24 hours after commencement; if refused, use must stop immediately and all data, results, and outputs must be discarded and deleted 32024R1689 Article 5@2024-06-13.
• Each use must be notified to the relevant market surveillance authority and the national data protection authority.
• No decision producing an adverse legal effect on a person may be based solely on the output of such a system 32024R1689 Article 5@2024-06-13.

This block connects to your organisation's own AI governance policy. In the full product it shows, cited to your policy, how YOUR organisation implements the regulation above — private to your organisation. (Demo placeholder.)

No recent cases are cached for this topic.