Article 5: the AI practices banned outright in the EU, one page per prohibition, with the conditions, exceptions, related high-risk categories, application dates and maximum fines.
The ban on AI systems that use subliminal, purposefully manipulative or deceptive techniques to materially distort behavior and cause significant harm, and how it differs from the vulnerability ban in point (b).
The ban on AI systems that exploit vulnerabilities due to age, disability or a specific social or economic situation to materially distort behavior, causing significant harm, without needing manipulative techniques.
The prohibition added by the 2026 Digital Omnibus on AI that generates intimate imagery of identifiable people without consent or child sexual abuse material: when providers and deployers are caught, and the 2 December 2026 start date.
The ban on scoring people over time on their social behavior or personal characteristics where the score leads to unrelated or disproportionate detrimental treatment, and where credit scoring sits instead.
The ban on predicting whether an individual will commit a crime based solely on profiling or personality traits, the exception for tools that support human assessment based on objective facts, and the related high-risk category.
The ban on building or expanding facial recognition databases by untargeted scraping of facial images from the internet or CCTV footage, and how it relates to the high-risk classification of remote biometric identification.
The ban on inferring emotions of people at work or in education institutions, the medical and safety exception, and the high-risk and disclosure rules that apply to emotion recognition elsewhere.
The ban on categorizing individuals from biometric data to infer race, political opinions, union membership, beliefs, sex life or sexual orientation, its dataset and law enforcement carve-outs, and the related high-risk category.
The ban on live facial recognition in publicly accessible spaces for law enforcement, the three narrow exceptions, and the authorization, impact assessment, registration and notification conditions attached to them.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.