In force

EU AI Act Article 5: Prohibited AI practices

Article 5 of the EU AI Act prohibits eight categories of AI practice: subliminal manipulation (5(1)(a)), exploitation of vulnerabilities (5(1)(b)), social scoring (5(1)(c)), individual criminal-risk profiling (5(1)(d)), untargeted facial-image scraping (5(1)(e)), emotion inference in workplace and education (5(1)(f)), biometric categorisation inferring sensitive attributes (5(1)(g)), and real-time remote biometric identification in publicly accessible spaces for law enforcement, with narrow exceptions (5(1)(h)). The prohibitions are absolute. Applicable from 2 February 2025 (Art. 113(a)); sanctionable under Chapter XII (Articles 99–100) since 2 August 2025 (Art. 113(b)).

Who
Anyone placing on the market or using AI in the EU. Eight uses are banned outright, and no consent or mitigation rescues them.
From when
2 Feb 2025
Art. 113(a)
Maximum fine
€35M or 7%
Art. 99(3)

Quoted from EUR-Lex

What Article 5 says

5(1)

1. The following AI practices shall be prohibited:

5(1)(a)

(a) the placing on the market, the putting into service or the use of an AI system that deploys subliminal techniques beyond a person’s consciousness or purposefully manipulative or deceptive techniques, with the objective, or the effect of materially distorting the behaviour of a person or a group of persons by appreciably impairing their ability to make an informed decision, thereby causing them to take a decision that they would not have otherwise taken in a manner that causes or is reasonably likely to cause that person, another person or group of persons significant harm;

5(1)(b)

(b) the placing on the market, the putting into service or the use of an AI system that exploits any of the vulnerabilities of a natural person or a specific group of persons due to their age, disability or a specific social or economic situation, with the objective, or the effect, of materially distorting the behaviour of that person or a person belonging to that group in a manner that causes or is reasonably likely to cause that person or another person significant harm;

5(1)(e)

(e) the placing on the market, the putting into service for this specific purpose, or the use of AI systems that create or expand facial recognition databases through the untargeted scraping of facial images from the internet or CCTV footage;

5(1)(f)

(f) the placing on the market, the putting into service for this specific purpose, or the use of AI systems to infer emotions of a natural person in the areas of workplace and education institutions, except where the use of the AI system is intended to be put in place or into the market for medical or safety reasons;

Selected paragraphs, quoted exactly. Read the whole article in Regulation (EU) 2024/1689 on EUR-Lex. Checked 4 Oct 2026.

Regulation (EU) 2026/1744 · in force 27 Jul 2026

What changed

Change in lawArticle 5(1), first subparagraph, points (ba) and (bb)
Added: (ba) the placing on the market, the putting into service or the use of an AI system that generates or manipulates realistic images, videos, audio or similar material of an identifiable natural person’s intimate parts, or of an identifiable natural person engaged in sexually explicit activities, without that person’s freely-given, specific, informed, unambiguous and explicit consent for that generation or manipulation;Added: (bb) the placing on the market, the putting into service or the use of an AI system that generates or manipulates material or performance within the meaning of Article 2, points (c) and (e), of Directive 2011/93/EU, except where a “without right” defence applies under national law;

The same point also inserts paragraphs 1a and 1b into Article 5. These apply from 2 Dec 2026. Added lines quote the amending Regulation.

Source: Regulation (EU) 2026/1744, Article 1, point (7), verified 4 Oct 2026

Change in lawArticle 113, third paragraph, point (a)
Removed: (a) Chapters I and II shall apply from 2 February 2025;Added: (a) Chapters I and II shall apply from 2 February 2025, with the exception of Article 5(1), first subparagraph, points (ba) and (bb), and Article 5(1a) and (1b) which shall apply from 2 December 2026;

Removed and context lines quote Regulation (EU) 2024/1689 as adopted; added lines quote the amending Regulation.

Source: Regulation (EU) 2026/1744, Article 1, point (40), verified 4 Oct 2026

In plain words

What you must produce

Nothing. Article 5 bans practices outright; it does not ask for a document.

A summary to help you plan. The quoted text above is the law.

Coverage: Covered

LitmusAI

LitmusAI screens an AI system description against all eight Article 5 prohibitions and returns Red / Amber / Clear verdicts with primary-source citations. The reference ruleset shipped with v1.0 is UNREVIEWED (no external EU AI Act lawyer review yet); a Bring-Your-Own signed-ruleset path is available for teams that need lawyer-reviewed output today.

Install

bashpip install litmus-screener

Writes: Prohibited-practices verdict (SARIF)

From the fact register

Questions about Article 5

When does Article 5 apply?
It has applied since 2 Feb 2025 (Art. 113(a)). Points (ba) and (bb), added by Regulation (EU) 2026/1744, apply from 2 Dec 2026 (Art. 113(a), as amended).
What is the maximum fine for breaching Article 5?
Up to €35 million or 7% of total worldwide annual turnover for the preceding financial year, whichever is higher (Art. 99(3)). For SMEs, including start-ups, the fine is capped at whichever of the two is lower (Art. 99(6)).
Did the Digital Omnibus change Article 5?
Yes. Regulation (EU) 2026/1744, in force since 27 Jul 2026, makes these changes. Two new prohibitions: points (ba) and (bb). Points (ba) and (bb) apply from 2 Dec 2026. The section "What changed" quotes the old and new text.
Is there an AiExponent tool for Article 5?
Yes. LitmusAI is released and open source. It writes a Prohibited-practices verdict (SARIF).

Content verified 4 Oct 2026 · Not legal advice.