EU AI Act prohibited practices

EU AI Act Article 5(1) bans eight uses of AI outright, from manipulative techniques and social scoring to emotion recognition at work and in education. They have applied since 2 February 2025 to every system, old or new. Regulation (EU) 2026/1744 adds two bans, on non-consensual intimate imagery and child sexual abuse material, from 2 December 2026.

The requirement in plain English

A prohibited practice may not be placed on the market, put into service or used in the EU. The ban binds providers and deployers alike, and it has no transitional relief: EU AI Act Article 111(2) protects older high-risk systems but expressly leaves Article 5 untouched. The eight original bans, paraphrased, are:

• Point (a): subliminal, manipulative or deceptive techniques that materially distort someone’s behaviour and cause, or are likely to cause, significant harm.
• Point (b): exploiting a person’s vulnerability because of age, disability or a specific social or economic situation, with the same effect.
• Point (c): social scoring, that is, rating people over time on their behaviour or traits so that they are treated badly in unrelated settings or out of proportion. It applies to companies as well as public bodies.
• Point (d): predicting that a person will commit a crime based only on profiling or personality traits.
• Point (e): building or expanding facial recognition databases by scraping faces from the internet or CCTV without a target.
• Point (f): inferring people’s emotions in the workplace or in education, except for medical or safety reasons.
• Point (g): biometric categorisation that deduces race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation.
• Point (h): real-time remote biometric identification in publicly accessible spaces for law enforcement, except for three narrow purposes under prior authorisation.

From 2 December 2026, under EU AI Act Article 113 as amended, new points (ba) and (bb) of Article 5(1) ban systems that generate or manipulate realistic intimate images, video or audio of an identifiable person without explicit consent, and systems that generate child sexual abuse material. New paragraph 1a sets the test for providers: the ban applies where that output is the intended purpose, or is a foreseeable and reproducible result without significant technical changes and the system lacks reasonable safeguards. A deployer is caught when it uses a system for that purpose. Paragraph 1b says that a manipulation which does not add exposure or alter sexual activity is not caught.

The Commission’s guidelines on prohibited practices, first published in February 2025, explain each ban with examples. They are not binding, but authorities read the Act through them. The consolidated text on EUR-Lex is the authority.

This is guidance to help you understand the requirement, not legal advice.

What good looks like

A 20-person education technology company screens every AI feature against Article 5 when the use case is approved, and again whenever its purpose or market changes. The screen is a short record per feature: each point, the answer, and the reasoning where the answer is not a plain no. The product lead completes it; the compliance lead signs it; anything borderline goes to outside counsel before build.

In January 2025 the screen caught an “engagement detection” feature in its exam proctoring product that read students’ facial expressions. Emotion recognition in education is banned, and the company removed the feature before 2 February 2025, with the decision minuted.

Its adaptive learning engine is checked against point (b), because its users are children: personalisation may adapt difficulty, but no design choice may exploit age to push behaviour that harms the learner.

The company also resells an image generation feature. For the December 2026 bans it records the safeguards it relies on, prompt and output filters and the provider’s own controls, with the results of its tests against attempts to produce intimate imagery of real people.

Evidence an auditor expects

• A dated Article 5 screen per system (usual, not a prescribed format): a market surveillance authority asks how you know a system is not prohibited.
• Decisions on features removed or redesigned: minutes or change records showing what changed and when.
• For workplace and education tools: evidence that no emotion inference from biometric data runs, or that it serves a medical or safety purpose.
• For generative image, video or audio systems: the safeguards against the December 2026 bans and the tests that show they work.
• For bought-in tools: the provider’s statements, and your own record of the purpose you use the tool for.

Common mistakes

Thinking social scoring only catches governments

Point (c) applies to anyone. A platform that downgrades users across unrelated services because of behaviour scored elsewhere can fall inside it.

Confusing emotion recognition with sentiment analysis

The Act defines emotion recognition by reference to biometric data. Inferring a mood from a face or a voice is in scope; classifying the tone of an email’s text is not. Map each feature to its input before deciding.

Assuming older systems are covered by the transition

The transition protects high-risk systems already on the market, not prohibited ones. A banned practice had to stop on 2 February 2025, however long the system had been running.

Treating the December 2026 bans as a provider problem only

A deployer that uses a general image tool to produce intimate imagery of a real person is caught by its own use. Set acceptable-use rules for generative tools and enforce them.

Screening once

A feature that passed the screen at launch can drift: a new data source, a new user group or a new optimisation goal. Re-screen on change, not only on a calendar.

How Sted helps

Related guides and terms

• EU AI Act: the hub, with who the Act reaches and who enforces it.
• Risk classification: the next test once a system passes the prohibited-practice screen.
• EU AI Act timeline: when each ban took or takes effect.
• ISO 42001 context, scope and AI policy: where the AI policy sets the uses your organisation rules out.
• Policy adoption and rollout guide: getting acceptable-use rules for AI tools read and followed.

Frequently asked questions