Article 5

Prohibited practices

In force since 2 February 2025

Additions apply from 2 December 2026

Some uses of AI are prohibited outright, with no transition period, no exemption by company size and no compliance route that makes them acceptable. They have applied since 2 February 2025, and the Digital Omnibus added two more with effect from 2 December 2026.

What is prohibited

Subliminal, purposefully manipulative or deceptive techniques that materially distort behaviour and cause or are likely to cause significant harm.
Exploiting vulnerabilities arising from age, disability, or a specific social or economic situation.
Social scoring that leads to detrimental treatment in contexts unrelated to where the data was gathered, or that is disproportionate to the behaviour.
Assessing the risk of someone committing a criminal offence based solely on profiling or personality traits.
Untargeted scraping of facial images from the internet or CCTV to build or expand facial recognition databases.
Inferring emotions in the workplace or in education, except for medical or safety reasons.
Biometric categorisation to deduce race, political opinions, trade union membership, religious beliefs, sex life or sexual orientation.
Real-time remote biometric identification in publicly accessible spaces for law enforcement, outside the narrow listed exceptions.
From 2 December 2026: AI systems that generate or manipulate non-consensual intimate imagery, or child sexual abuse material.

Who it applies to

Everyone placing such a system on the market and everyone using one. There is no size threshold anywhere in the article.
The two most likely to catch an ordinary company are emotion inference at work and biometric categorisation. Tools that score employee or candidate sentiment fall squarely in the first.
For the prohibitions added in 2026, a provider is caught where the system is intended to produce that material, or where producing it is a reasonably foreseeable and reproducible outcome and no adequate safeguards are in place. A deployer is caught by using a system for that purpose; accidental generation is not.

What changed in July 2026

Regulation (EU) 2026/1744 added points to Article 5(1) covering non-consensual intimate material and child sexual abuse material, together with provisions defining their scope.
Those additions apply from 2 December 2026 rather than immediately, which Article 113 was amended to say.
The existing prohibitions were not altered and have applied since 2 February 2025.

What most guidance still gets wrong

The penalty figure. Nearly every article quotes EUR 35 million or 7% of worldwide annual turnover. Article 99 caps fines for SMEs at whichever of those two amounts is lower, and the Digital Omnibus extended the same cap to small mid-caps. For a company turning over a few million, the ceiling is a percentage of that, not the number in the headline.
Assuming none of this reaches an ordinary business. Emotion inference in the workplace is prohibited outright, and it is sold as an ordinary HR and customer-service feature.
Treating a prohibition as a compliance task. There is no documentation that makes a prohibited practice lawful. The only response is to stop.

Which of these apply to you?

Ten questions, about three minutes, no account and nothing stored on our side. It tells you which of these obligations reach your organisation and which dates you are already past.

Start the free assessment

Written against Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744. Not legal advice. Every change to this drafting is dated and published on the change history page.