Prohibited AI Practice (Article 5 EU AI Act)

8 prohibited applications since 2 February 2025

26 April 2026 · Category: EU AI Act · Compliance-Kit

TL;DR

Art. 5 of the EU AI Act lists 8 prohibited AI practices that have been unlawful EU-wide since 2 February 2025: manipulation by subliminal techniques, exploitation of vulnerabilities, social scoring (by public or private actors), real-time biometrics in public spaces (with exceptions), predictive policing, image databases built by untargeted scraping, emotion recognition in the workplace, biometric categorisation. Fine up to EUR 35 million / 7 % of turnover.

What is a prohibited AI practice (Art. 5 EU AI Act)?

The 8 prohibitions in detail:

Subliminal manipulation capable of causing harm
Exploitation of vulnerabilities (age, disability, social situation)
Social scoring (by public or private actors)
Real-time remote biometrics in public spaces (law enforcement exceptions)
Predictive policing based on profiling
Untargeted scraping for facial recognition databases (Clearview AI was the trigger)
Emotion recognition in the workplace (exception: safety or health reasons)
Biometric categorisation by race, political opinion, sexual orientation, etc.

Germany and Austria: Applies equally in Germany and Austria (Regulation (EU) 2024/1689). The EU AI Act is a directly applicable EU regulation; the prohibitions under Art. 5 apply in identical wording in both countries, with no differing national implementation.

Practical example

Commission guidelines C(2025) 884 final (4 February 2025) set out the prohibitions in more detail. Examples that are clearly prohibited: an HR tool that detects employees' mood when under stress; an insurer that categorises biometrically by 'origin'; a school tool that manipulates pupils' behaviour.

Frequently asked questions

Do the prohibitions also apply outside the EU?

Yes, where EU citizens or the EU market are affected. As with the marketplace principle under the GDPR.

What about ChatGPT-based analysis of employee mood?

Where emotions are recognised in the workplace — prohibited. Where it is only sentiment analysis of texts relating to work results — permitted subject to GDPR compliance.

Law enforcement exceptions?

To be construed narrowly — only for serious criminal offences and with judicial authorisation. In practice: police authorities must document implementation files.