There is no compliant version of a banned practice
Every other tier in the Act gives you a route to lawful deployment through documentation, assessment, or disclosure. Article 5 gives you none. Consent does not cure it, a human reviewer does not cure it, and no filing makes it acceptable. The behaviour has to go.
The eight prohibitions
Each entry below gives the legal test the Act applies and the exceptions written into the statute. Several prohibitions turn on harm or on materially distorted behaviour, so the test matters as much as the label.
Subliminal and manipulative techniques
Test: Deploying subliminal techniques beyond a person's consciousness, or purposefully manipulative or deceptive techniques, that materially distort behaviour by impairing informed decision-making and cause or are likely to cause significant harm.
Exceptions: None.
Exploiting vulnerabilities
Test: Exploiting vulnerabilities tied to age, disability, or a specific social or economic situation, to materially distort behaviour in a way that causes or is likely to cause significant harm.
Exceptions: None.
Social scoring
Test: Evaluating or classifying people over time based on social behaviour or personal characteristics, where the resulting score causes detrimental treatment in social contexts unrelated to where the data came from, or treatment that is unjustified or disproportionate.
Exceptions: Lawful credit and insurance risk assessment carried out under EU or national law.
Predictive policing on individuals
Test: Assessing or predicting the risk that a person will commit a criminal offence, based solely on profiling or on assessing their personality traits and characteristics.
Exceptions: AI supporting a human assessment already grounded in objective, verifiable facts directly linked to criminal activity.
Untargeted facial scraping
Test: Creating or expanding facial recognition databases through untargeted scraping of facial images from the internet or from CCTV footage.
Exceptions: None for untargeted scraping. Targeted acquisition for a specific authorised investigation stays possible.
Emotion recognition at work and in education
Test: Inferring the emotions of a natural person in the workplace or in education institutions.
Exceptions: Systems put in place for medical or safety reasons, such as monitoring driver or pilot fatigue.
Biometric categorisation of sensitive traits
Test: Categorising people individually on the basis of biometric data to deduce race, political opinions, trade union membership, religious or philosophical beliefs, sex life, or sexual orientation.
Exceptions: Labelling or filtering of lawfully acquired biometric datasets, and categorisation by law enforcement in line with Union law.
Real-time remote biometric identification
Test: Real-time remote biometric identification in publicly accessible spaces for law enforcement purposes.
Exceptions: Narrow and judicially authorised: searching for abduction or trafficking victims, preventing an imminent threat to life or a terrorist attack, or locating a suspect in a listed serious crime.
The two that catch ordinary software
Most of Article 5 reads like it targets state surveillance. Two entries do not, and they are where commercial teams get caught.
Emotion inference in HR and learning tools
Candidate video interview scoring that reads affect, employee monitoring suites that flag engagement or stress from webcam or voice, and learning platforms that infer student attention all sit inside Article 5(1)(f). The vendor may market it as sentiment or engagement analytics. The test is whether the system infers emotions of a person at work or in education.
Personalisation that crosses into manipulation
Article 5(1)(a) needs three things together: a subliminal, manipulative, or deceptive technique, material distortion of behaviour that impairs informed decisions, and significant harm. Ordinary recommendation and pricing systems clear that bar. Optimisation that deliberately exploits a user against their own interest does not.
Audit third-party tools as carefully as your own code. The obligation follows the deployer, so buying the capability from a vendor does not move the liability. Start by finding what you run with the free AI Posture Analyzer.
Penalties
Article 99 reserves its highest tier for Article 5. This is the only band that reaches 7%, and it sits above the GDPR ceiling of 4%.
€35M / 7%
Up to 35 million euro or 7% of total worldwide annual turnover, whichever is higher. SMEs and startups pay whichever is lower.
National market surveillance authorities can also order the system withdrawn or recalled from the EU market, which for a core product feature costs more than the fine.
How Prismor helps with the EU AI Act
Most of the Act's operational load comes down to two questions: which AI systems do you run, and can you show what they did. Prismor answers both for the AI inside your codebase.
Find every AI system you run
Phasing out Article 5 practices and classifying under Annex III both start from an inventory. Prismor finds the SDKs, models, agent configs, and MCP servers in your repos, including the ones nobody wrote down.
Records that hold up in an audit
Article 12 requires high-risk systems to log their operation automatically. Prismor captures every tool call and file touch with the session context an auditor asks about.
Human oversight you can enforce
Article 14 expects a person who can step in. Prismor holds risky agent actions for approval and blocks the ones that break your policy.
The AI Posture Analyzer is free. Public repos scan instantly with no signup. Private repos sign in with GitHub and run on your own access.
Frequently Asked Questions
The Article 5 prohibitions applied from 2 February 2025, six months after the Act entered into force. They were the first obligations to bite, well ahead of the high-risk requirements that followed on 2 August 2026.