In force

EU AI Act Article 5: Prohibited AI practices

Article 5(1) lists ten prohibited AI practices: the original eight, points (a) to (h), and two added by Regulation (EU) 2026/1744, points (ba) and (bb), which apply from 2 Dec 2026. The original eight: subliminal manipulation (5(1)(a)), exploitation of vulnerabilities (5(1)(b)), social scoring (5(1)(c)), individual criminal-risk profiling (5(1)(d)), untargeted facial-image scraping (5(1)(e)), emotion inference in workplace and education (5(1)(f)), biometric categorisation inferring sensitive attributes (5(1)(g)), and real-time remote biometric identification in publicly accessible spaces for law enforcement, with narrow exceptions (5(1)(h)). The two added: AI systems that generate or manipulate realistic images, video or audio of an identifiable person’s intimate parts or of that person in sexually explicit activity, without that person’s explicit consent (5(1)(ba)), and AI systems that generate or manipulate child sexual abuse material or performances within the meaning of Article 2, points (c) and (e), of Directive 2011/93/EU, unless a “without right” defence applies under national law (5(1)(bb)). Points (a) to (h) have applied since 2 February 2025 (Art. 113(a)) and have been sanctionable under Chapter XII (Articles 99–100) since 2 August 2025 (Art. 113(b)).

Who
Anyone placing on the market or using AI in the EU. Article 5(1) lists ten prohibited practices: eight have applied since 2 Feb 2025, and points (ba) and (bb) apply from 2 Dec 2026. The only exceptions are those Article 5 itself sets out, in the points and in paragraphs 1a to 7.
From when
2 Feb 2025
Art. 113(a)
Maximum fine
€35M or 7%
Art. 99(3)

Quoted from EUR-Lex

What Article 5 says

5(1)

1. The following AI practices shall be prohibited:

5(1)(a)

(a) the placing on the market, the putting into service or the use of an AI system that deploys subliminal techniques beyond a person’s consciousness or purposefully manipulative or deceptive techniques, with the objective, or the effect of materially distorting the behaviour of a person or a group of persons by appreciably impairing their ability to make an informed decision, thereby causing them to take a decision that they would not have otherwise taken in a manner that causes or is reasonably likely to cause that person, another person or group of persons significant harm;

5(1)(b)

(b) the placing on the market, the putting into service or the use of an AI system that exploits any of the vulnerabilities of a natural person or a specific group of persons due to their age, disability or a specific social or economic situation, with the objective, or the effect, of materially distorting the behaviour of that person or a person belonging to that group in a manner that causes or is reasonably likely to cause that person or another person significant harm;

5(1)(e)

(e) the placing on the market, the putting into service for this specific purpose, or the use of AI systems that create or expand facial recognition databases through the untargeted scraping of facial images from the internet or CCTV footage;

5(1)(f)

(f) the placing on the market, the putting into service for this specific purpose, or the use of AI systems to infer emotions of a natural person in the areas of workplace and education institutions, except where the use of the AI system is intended to be put in place or into the market for medical or safety reasons;

Selected paragraphs, quoted exactly. Read the whole article in Regulation (EU) 2024/1689 on EUR-Lex. Checked 4 Oct 2026.

Regulation (EU) 2026/1744 · in force 27 Jul 2026

What changed

Change in lawArticle 5(1), first subparagraph, points (ba) and (bb)
Added: (ba) the placing on the market, the putting into service or the use of an AI system that generates or manipulates realistic images, videos, audio or similar material of an identifiable natural person’s intimate parts, or of an identifiable natural person engaged in sexually explicit activities, without that person’s freely-given, specific, informed, unambiguous and explicit consent for that generation or manipulation;Added: (bb) the placing on the market, the putting into service or the use of an AI system that generates or manipulates material or performance within the meaning of Article 2, points (c) and (e), of Directive 2011/93/EU, except where a “without right” defence applies under national law;

The same point also inserts paragraphs 1a and 1b into Article 5. These apply from 2 Dec 2026. Added lines quote the amending Regulation.

Source: Regulation (EU) 2026/1744, Article 1, point (7), verified 4 Oct 2026

Change in lawArticle 113, third paragraph, point (a)
Removed: (a) Chapters I and II shall apply from 2 February 2025;Added: (a) Chapters I and II shall apply from 2 February 2025, with the exception of Article 5(1), first subparagraph, points (ba) and (bb), and Article 5(1a) and (1b) which shall apply from 2 December 2026;

Removed and context lines quote Regulation (EU) 2024/1689 as adopted; added lines quote the amending Regulation.

Source: Regulation (EU) 2026/1744, Article 1, point (40), verified 4 Oct 2026

In plain words

What you must produce

Nothing. Article 5 bans practices outright; it does not ask for a document.

A summary to help you plan. The quoted text above is the law.

Coverage: Partial

LitmusAI

LitmusAI screens an AI system description against the Article 5 prohibitions and returns Red / Amber / Clear verdicts with primary-source citations. It screens the original eight, points (a) to (h). It does not yet screen points (ba) and (bb), which apply from 2 Dec 2026. The reference ruleset shipped with v1.0 is UNREVIEWED (no external EU AI Act lawyer review yet); a Bring-Your-Own signed-ruleset path is available for teams that need lawyer-reviewed output today.

Install

bashpip install litmus-screener

Writes: Prohibited-practices verdict (SARIF)

Fictional example. MoodSync Technologies GmbH, its system and the law firm named as reviewer come from the example file shipped with LitmusAI (examples/example-red.yaml). The screening output is real litmus-screener 1.0.1 output, captured 2026-10-25.

From the fact register

Questions about Article 5

When does Article 5 apply?
It has applied since 2 Feb 2025 (Art. 113(a)). Points (ba) and (bb), added by Regulation (EU) 2026/1744, apply from 2 Dec 2026 (Art. 113(a), as amended).
What is the maximum fine for breaching Article 5?
Up to €35 million or 7% of total worldwide annual turnover for the preceding financial year, whichever is higher (Art. 99(3)). For SMEs, including start-ups, the fine is capped at whichever of the two is lower (Art. 99(6)).
Did the Digital Omnibus change Article 5?
Yes. Regulation (EU) 2026/1744, in force since 27 Jul 2026, makes these changes. Two new prohibitions: points (ba) and (bb). Points (ba) and (bb) apply from 2 Dec 2026. The section "What changed" quotes the old and new text.
Is there an AiExponent tool for Article 5?
Partly. LitmusAI covers part of Article 5. It writes a Prohibited-practices verdict (SARIF).

Content verified 26 Oct 2026 · Not legal advice.