Article 5 of the EU AI Act bans a short list of AI practices outright. These bans have applied since 2 February 2025, earlier than almost anything else in the Act, and they carry the highest fines: up to €35 million or 7% of worldwide annual turnover, whichever is higher.
Most businesses won’t be anywhere near these lines. But a few, especially emotion recognition at work, catch out ordinary companies, so it’s worth checking.
The eight practices banned since February 2025
1. Manipulative or deceptive techniques
AI that uses subliminal, manipulative or deceptive techniques to distort people’s behaviour in a way that impairs their ability to make an informed decision and causes, or is likely to cause, significant harm.
2. Exploiting vulnerabilities
AI that exploits people’s vulnerabilities due to their age, disability or social or economic situation to distort their behaviour in a way that causes significant harm.
3. Social scoring
Evaluating or classifying people over time based on their social behaviour or personal characteristics, where the resulting score leads to unfair or disproportionate treatment, especially in unrelated contexts.
4. Predicting crime from profiling alone
Assessing the risk that a person will commit a crime based solely on profiling or their personality traits. AI that supports a human assessment based on objective, verifiable facts linked to criminal activity is not covered by this ban.
5. Untargeted scraping of facial images
Building or expanding facial recognition databases by scraping facial images from the internet or CCTV footage without targeting specific people.
6. Emotion recognition at work and in education
Inferring people’s emotions in the workplace or in educational institutions, except for medical or safety reasons. This is the one most likely to affect ordinary businesses. Think of “sentiment analysis” of employees on video calls, or tools that score candidates’ emotions in recorded interviews.
7. Biometric categorisation of sensitive traits
Using biometric data to categorise people in order to infer their race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation. Lawful labelling or filtering of lawfully acquired biometric datasets, for example in law enforcement, is excluded.
8. Real-time remote biometric identification in public for law enforcement
Live facial recognition in publicly accessible spaces for law enforcement purposes, except in narrow, authorised cases such as searching for victims of abduction, trafficking or sexual exploitation, or missing persons; preventing an imminent threat to life or a terrorist attack; or locating suspects of certain serious offences.
Two more bans from 2 December 2026
The Digital Omnibus on AI, which entered into force on 27 July 2026, adds two bans to Article 5. They apply from 2 December 2026:
- Non-consensual sexual deepfakes. AI that generates or manipulates realistic images, video or audio showing an identifiable person’s intimate parts, or that person in sexually explicit activity, without their freely given, specific, informed, unambiguous and explicit consent.
- Child sexual abuse material. AI that generates or manipulates child sexual abuse material.
For companies that build or sell these tools, the ban applies where producing such content is the system’s intended purpose, or where it is a reasonably foreseeable and reproducible result and the system lacks adequate safeguards. Companies that only use such a tool are caught when they use it to create this material. If you offer image, video or voice generation, check your safeguards against both bans.
Where businesses actually get caught
- HR and recruitment tools that claim to read candidates’ emotions, honesty or “culture fit” from video or voice.
- Workplace monitoring that scores employee mood or engagement from facial expressions or voice.
- Marketing that crosses the line into exploiting vulnerable groups, for example targeting financially distressed people with manipulative AI-driven offers.
- Vendor features you didn’t ask for. Check whether your call-centre, video or HR software has “emotion AI” features switched on.
How to check you’re clear
- Go through your AI inventory and flag anything involving biometrics, emotions, profiling or behavioural influence.
- Ask vendors directly whether their product infers emotions or uses biometric categorisation, and get the answer in writing.
- Switch off or remove any feature that falls under a prohibition.
- Record the review, so you can show you checked.
The European Commission has published guidelines on the prohibited practices with more examples. They’re worth reading if you’re in a borderline case.
Official sources
- EU AI Act, Regulation (EU) 2024/1689: the official text on EUR-Lex
- Digital Omnibus on AI, Regulation (EU) 2026/1744: the July 2026 amendment that moved the high-risk dates
- European Commission: AI Act overview: timeline, guidelines and news, including the guidelines on prohibited practices
More primary sources, with a short note on each, are on our Sources page.
Last reviewed 25 October 2026. Based on Article 5 of Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI). This article is general information, not legal advice. If a use case is borderline, get qualified legal advice.