For Heads-of · Practitioner
Prohibited AI Practices
Also known as: Article 5 AI Act · banned AI practices
The uses of AI that Article 5 of the EU AI Act bans outright. Eight have applied since 2 February 2025, and the 2026 Digital Omnibus adds two more from 2 December 2026: systems that create non-consensual intimate material and systems that generate child sexual abuse material.
- EU AI Act
- Article 5
- prohibited practices
- social scoring
- emotion recognition
- biometrics
The original eight
Harmful manipulation or deception, exploitation of vulnerabilities, social scoring, predicting criminality from personality traits alone, untargeted scraping of facial images, emotion recognition at work or in education, biometric categorisation by sensitive attributes, and real-time remote biometric identification in public spaces for law enforcement, with narrow exceptions. Each is a risk in the register, starting with subliminal or manipulative AI techniques and AI-driven social scoring.
The 2026 additions
Regulation (EU) 2026/1744 adds AI systems that create or manipulate intimate images of identifiable people without their consent, and AI systems that generate child sexual abuse material, both from 2 December 2026 and both in the top penalty tier. They matter to any organisation whose products generate or edit images, including through a vendor's feature.
Why controls are not the answer
Prohibited practices carry the Act's highest fines: up to 35 million euros or 7% of worldwide annual turnover, whichever is higher. The correct response is not to build or use the system, which is why the register maps few controls to these risks. The control that matters is classification: checking every system in the AI inventory, including vendor features, against the list through the AI impact assessment process.
Sources
Related Terms
Deepfake
AI-generated or manipulated image, audio or video content that resembles real people, objects, places or events and would falsely appear to a person to be authentic. For an organisation, the most immediate risk is impersonation fraud: a cloned voice or a faked video call instructing a payment.
Digital Omnibus on AI
Regulation (EU) 2026/1744, the 2026 law that amended the EU AI Act. It deferred the high-risk obligations to December 2027 and August 2028, softened the AI literacy duty, added two prohibited practices, and extended documentation concessions to small mid-cap companies.
EU AI Act
The European Union's regulation of AI systems by risk category, in force since 1 August 2024 and applying in stages. As of October 2026 the prohibitions, the AI literacy duty, the general-purpose model obligations and the Article 50 transparency duties all apply. The 2026 Digital Omnibus, Regulation (EU) 2026/1744, deferred the high-risk obligations to December 2027 and August 2028, softened the literacy duty and added two prohibitions. It reaches any organisation whose AI output is used in the EU, wherever the organisation sits.
High-Risk AI System
An AI system that the EU AI Act subjects to its full set of requirements, either because it is a safety component of a product covered by EU product law (Annex I) or because it is used in one of eight listed areas (Annex III), which include credit scoring and life and health insurance pricing. Since the 2026 Digital Omnibus the obligations apply from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems.
Related risks and controls
Subliminal or manipulative AI techniques
Article 5(1)(a).
AI-driven social scoring
Article 5(1)(c).
Workplace and education emotion recognition
Article 5(1)(f).
Real-time public biometric identification
Article 5(1)(h).
AI impact assessment process
Classification against Article 5 before anything is built or bought.