European UnionAI Act, Article 5 (prohibited AI practices)
Regulation (EU) 2024/1689, Article 5
In force since .
An AI prohibited practices rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Market targeting, Operator establishment, Place of effect
- Obligation class
- Prohibition
- Audit expectation
- none
What it requires
- Do not place on the market, put into service, or use an AI system that deploys subliminal, manipulative or deceptive techniques to materially distort a person's behaviour in a way that causes or is reasonably likely to cause significant harm.
- Do not place on the market, put into service, or use an AI system that exploits a person's or group's vulnerabilities due to age, disability, or social or economic situation, to materially distort their behaviour in a way that causes or is reasonably likely to cause significant harm.
- Do not place on the market, put into service, or use an AI system to evaluate or classify people by social behaviour or personal characteristics in a way that leads to unjustified or unrelated detrimental treatment (social scoring).
- Do not place on the market, put into service for this specific purpose, or use an AI system to assess or predict a person's risk of committing a crime based solely on profiling or personality traits, unless it supports a human assessment already based on objective, verifiable facts directly linked to criminal activity.
- Do not place on the market, put into service for this specific purpose, or use an AI system to build or expand facial recognition databases through untargeted scraping of facial images from the internet or CCTV footage.
- Do not place on the market, put into service for this specific purpose, or use an AI system to infer emotions in the workplace or in education, except for medical or safety reasons.
- Do not place on the market, put into service for this specific purpose, or use a biometric categorisation system that infers race, political opinions, trade union membership, religious or philosophical beliefs, sex life, or sexual orientation from biometric data, other than any labelling or filtering of lawfully acquired biometric datasets based on biometric data, or categorising of biometric data in the area of law enforcement.
- Do not use 'real-time' remote biometric identification in publicly accessible spaces for law enforcement unless a Member State has provided for it in national law and the use is strictly necessary for a targeted search for specific victims of abduction, trafficking or sexual exploitation or for missing persons, for preventing a specific, substantial and imminent threat to life or physical safety or a genuine terrorist threat, or for localising or identifying a person suspected of an offence listed in Annex II that is punishable in the Member State concerned by a custodial sentence or detention order of at least four years' maximum; and, in the ordinary case, only after prior authorisation from a judicial or independent administrative authority, a completed fundamental rights impact assessment, and EU database registration. In a duly justified urgent case, use may begin before the authorisation is granted, if it is requested without undue delay and at the latest within 24 hours, and before the EU database registration, if it is completed without undue delay.
These lines are LexLint's reading of the law's text. Also read by: Commission Guidelines on prohibited AI practices under the AI Act (C(2025) 5052 final) (guidance from the European Commission, issued ); European Commission (guidance, recorded ).
In the frameworks
- NIST AI RMF
- MAP 3.3Targeted application scope is specified and documented based on the system’s capability, established context, and AI system categorization.
- NIST AI 600-1
- GAI-RISK-08Information Integrity
- GAI-RISK-11Obscene, Degrading, and/or Abusive Content
- MIT mitigations Draft
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- ETSI EN 304 223
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
Article 99(3): non-compliance with the Article 5 prohibitions is fined up to EUR 35,000,000 or 7% of worldwide annual turnover, whichever is higher. Article 99(6) requires the lower of the two amounts for an SME, including a start-up. Article 99(6a), inserted by Regulation (EU) 2026/1744, gives small mid-cap enterprises the same lower-of treatment for paragraphs 4 and 5 only, not paragraph 3, so it does not reach Article 5 fines.
- Rule
- Lower of for SME
- As of
- Currency
- EUR
- Fixed cap
- 35,000,000
- Turnover percentage cap
- 7
Who enforces it
Enforcement body
National market surveillance authorities, at least one designated by each Member State under Article 70(1); the AI Office for an AI system within its exclusive competence under Article 75(1); the European Data Protection Supervisor for Union institutions, bodies, offices and agencies within the Regulation's scope, except the Court of Justice acting in its judicial capacity (Article 74(9)); for the 'real-time' remote biometric identification exception, a judicial authority or an independent administrative authority whose decision is binding authorises each use in advance or, in a duly justified urgent case, on a request made at the latest within 24 hours of starting the use.
Settledness
- As of
- Guidance link
- https://digital-strategy.ec.europa.eu/en/library/commission-publishes-guidelines-prohibited-artificial-intelligence-ai-practices-defined-ai-act
- Guidance body
- European Commission
- Open questions
- Does an AI agent that takes actions autonomously fall within the prohibitions on harmful manipulation and exploitation of vulnerabilities in Article 5(1), points (a) and (b), when the Commission describes its regulatory considerations on AI agents as 'only preliminary at this stage'?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Decision basis
Logging duty
The law-enforcement 'real-time' remote biometric identification exception in point (h) requires a completed fundamental rights impact assessment and EU database registration before use, and a notification to the relevant market surveillance authority and national data protection authority after each use. The other seven prohibitions in paragraph 1 state no record-keeping duty of their own.
- Kind
- Implicit
- As of
- Provision
- Article 5(2), (3) and (4)
Also on the record
EEA status
- Status
- Pending
- Source link
- https://www.efta.int/eea-lex/32024r1689
What this law does
Article 5 bans eight AI practices outright: subliminal, manipulative or deceptive techniques that materially distort a person's behaviour and cause or are reasonably likely to cause significant harm; exploiting the vulnerabilities of a person or group due to age, disability, or social or economic situation to the same effect; evaluating or classifying people by social behaviour or personal characteristics in a way that leads to unjustified or unrelated detrimental treatment (social scoring); assessing or predicting a person's risk of committing a crime based solely on profiling or personality traits, unless supporting a human assessment already grounded in objective, verifiable facts; building or expanding facial recognition databases by untargeted scraping of facial images from the internet or CCTV footage; inferring emotions in the workplace or education, except for medical or safety reasons; biometric categorisation to infer race, political opinions, trade union membership, religious or philosophical beliefs, sex life, or sexual orientation, other than any labelling or filtering of lawfully acquired biometric datasets based on biometric data, or categorising of biometric data in the area of law enforcement; and 'real-time' remote biometric identification in publicly accessible spaces for law enforcement, unless a Member State has provided for it in national law and it is strictly necessary for a targeted search for a specific victim or missing person, a specific and imminent threat to life or a genuine terrorist threat, or the localisation or identification of a suspect of an Annex II offence punishable by a custodial sentence or detention order of at least four years' maximum, and, in the ordinary case, only after prior authorisation from a judicial or independent administrative authority and a fundamental rights impact assessment.
Non-compliance with any of these prohibitions is fined up to EUR 35,000,000 or 7% of worldwide annual turnover, whichever is higher, with the lower of the two applying to an SME.
The Regulation gives any natural or legal person a right to lodge a complaint with a market surveillance authority under Article 85, while the Commission's non-binding guidelines on prohibited practices read the prohibitions as having direct effect, so that affected parties can enforce them in national courts and request interim injunctions.
The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since ) adds two further prohibited practices, on AI-generated non-consensual intimate imagery and AI-generated or manipulated child sexual abuse material, recorded as a separate instrument because they apply from a later date, .
Guidance on this law
How the bodies that enforce this law read it. Guidance binds nobody by itself, so LexLint never raises a finding from it; the duty is this law's.
- Commission Guidelines on prohibited AI practices under the AI Act (C(2025) 5052 final), the European Commission
When LexLint raises it
When your app profile says your app makes high-risk automated decisions, processes biometric data, crawls the web or deploys a chatbot.
Back to the example · Lint your app
Page updated .