AI Act, Article 5 (prohibited AI practices)

Regulation (EU) 2024/1689, Article 5

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 2 February 2025.

An AI prohibited practices rule binding public and private bodies.

As of 23 September 2026.

What it requires

Do not place on the market, put into service, or use an AI system that deploys subliminal, manipulative or deceptive techniques to materially distort a person's behaviour in a way that causes or is reasonably likely to cause significant harm.
Do not place on the market, put into service, or use an AI system that exploits a person's or group's vulnerabilities due to age, disability, or social or economic situation, to materially distort their behaviour in a way that causes or is reasonably likely to cause significant harm.
Do not place on the market, put into service, or use an AI system to evaluate or classify people by social behaviour or personal characteristics in a way that leads to unjustified or unrelated detrimental treatment (social scoring).
Do not place on the market, put into service, or use an AI system to assess or predict a person's risk of committing a crime based solely on profiling or personality traits, unless it supports a human assessment already based on objective, verifiable facts directly linked to criminal activity.
Do not place on the market, put into service, or use an AI system to build or expand facial recognition databases through untargeted scraping of facial images from the internet or CCTV footage.
Do not place on the market, put into service, or use an AI system to infer emotions in the workplace or in education, except for medical or safety reasons.
Do not place on the market, put into service, or use a biometric categorisation system that infers race, political opinions, trade union membership, religious or philosophical beliefs, sex life, or sexual orientation from biometric data, other than lawful labelling or filtering of biometric datasets in law enforcement.
Do not use 'real-time' remote biometric identification in publicly accessible spaces for law enforcement unless strictly necessary for a targeted victim or missing-person search, a specific and imminent threat to life or a genuine terrorist threat, or investigating a serious offence listed in Annex II, and, other than in a duly justified urgent case, only after prior authorisation from a judicial or independent administrative authority, a completed fundamental rights impact assessment, and EU database registration.

If you get it wrong

Criminal exposureNo

Private right of actionNo

Penalty structure

Article 99(3): non-compliance with the Article 5 prohibitions is fined up to EUR 35,000,000 or 7% of worldwide annual turnover, whichever is higher. Article 99(6) requires the lower of the two amounts for an SME, including a start-up. Article 99(6a), inserted by Regulation (EU) 2026/1744, gives small mid-cap enterprises the same lower-of treatment for paragraphs 4 and 5 only, not paragraph 3, so it does not reach Article 5 fines.

Rule: Lower of for SME
As of: 23 September 2026
Currency: EUR
Fixed cap: 35,000,000
Turnover percentage cap: 7

Who enforces it

Enforcement body

National market surveillance authorities, at least one designated by each Member State under Article 70(1); for the 'real-time' remote biometric identification exception, a judicial authority or an independent administrative authority whose decision is binding authorises each use in advance.

What it reaches

How the hook was established

express

What makes it apply

Market targeting, Operator establishment, Place of effect

Obligation class

Prohibition

What it makes you log

Who may demand the log

Regulator

What the log must hold

Decision basis

Logging duty

The law-enforcement 'real-time' remote biometric identification exception in point (h) requires a completed fundamental rights impact assessment and EU database registration before use, and a notification to the relevant market surveillance authority and national data protection authority after each use. The other seven prohibitions in paragraph 1 state no record-keeping duty of their own.

Kind: Implicit
As of: 23 September 2026
Provision: Article 5(2), (3) and (4)

Who checks it

Audit expectation

none

Also on the record

EEA status

Status: Pending
Source link: https://www.efta.int/eea-lex/32024r1689

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 5 bans eight AI practices outright: subliminal, manipulative or deceptive techniques that materially distort a person's behaviour and cause or are reasonably likely to cause significant harm; exploiting the vulnerabilities of a person or group due to age, disability, or social or economic situation to the same effect; evaluating or classifying people by social behaviour or personal characteristics in a way that leads to unjustified or unrelated detrimental treatment (social scoring); assessing or predicting a person's risk of committing a crime based solely on profiling or personality traits, unless supporting a human assessment already grounded in objective, verifiable facts; building or expanding facial recognition databases by untargeted scraping of facial images from the internet or CCTV footage; inferring emotions in the workplace or education, except for medical or safety reasons; biometric categorisation to infer race, political opinions, trade union membership, religious or philosophical beliefs, sex life, or sexual orientation, other than lawful labelling or filtering of biometric datasets in law enforcement; and 'real-time' remote biometric identification in publicly accessible spaces for law enforcement, unless strictly necessary for a targeted search for a specific victim or missing person, a specific and imminent threat to life or a genuine terrorist threat, or the investigation of a serious offence listed in Annex II, and, in the ordinary case, only after prior authorisation from a judicial or independent administrative authority and a fundamental rights impact assessment.

Non-compliance with any of these prohibitions is fined up to EUR 35,000,000 or 7% of worldwide annual turnover, whichever is higher, with the lower of the two applying to an SME. The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026) adds two further prohibited practices, on AI-generated non-consensual intimate imagery and AI-generated or manipulated child sexual abuse material, recorded as a separate instrument because they apply from a later date, 2 December 2026.

When LexLint raises it

high_risk_decisions
processes_biometrics
crawls_web
deploys_chatbot

Read the law

official consolidated Official Journal text, EUR-Lex

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app