EU AI Act prohibited practices after the Digital Omnibus

The EU AI Act prohibited practices are the one part of Regulation (EU) 2024/1689 with no compliance route: no conformity assessment, no documentation file, no transition period that turns a banned system into a lawful one. Article 5 has applied since 2 February 2025, and on 2 December 2026 it grows from eight bans to ten. This guide gives the full list, the fines, who enforces them in each market, and the screening record an authority will expect to see.

Key takeaways

• The EU AI Act prohibited practices in Article 5 cover the placing on the market, the putting into service and the use of certain AI systems, so they bind providers and deployers alike.
• Eight bans have applied since 2 February 2025; the Digital Omnibus adds two more, on non-consensual intimate material and child sexual abuse material, from 2 December 2026.
• A general-purpose image, video or voice generator is caught if that output is reasonably foreseeable and the provider lacks reasonable and adequate safeguards.
• Fines reach EUR 35 million or 7 percent of worldwide turnover, whichever is higher; enforcement is national.
• The defensible answer is a dated screening record per AI system, re-run whenever the system or the list changes.

EU AI Act prohibited practices: what Article 5 bans and who it binds

Article 5 is the legal home of the EU AI Act prohibited practices, and it is short and absolute. Each point prohibits “the placing on the market, the putting into service or the use” of an AI system for a defined practice. That wording matters more than any single ban: a provider breaches Article 5 by selling the system, and a deployer breaches it by using a system it bought from someone else. Buying a tool does not transfer the risk to the vendor.

The territorial reach is wide. Under Article 2(1)(c), providers and deployers established outside the Union are covered when the output produced by the AI system is used in the Union. A recruitment platform hosted in the United States that scores the facial expressions of candidates applying for jobs in Lyon is inside the scope, whatever its terms of service say.

The timing is settled. Chapters I and II, which hold the definitions and Article 5, have applied since 2 February 2025 under Article 113, point (a). Unlike the high-risk regime, which the Digital Omnibus pushed back to 2 December 2027 for Annex III systems, nothing in Article 5 was deferred. And unlike high-risk systems, a prohibited system cannot be documented into compliance. There is no notified body, no technical file, no CE marking. The only outcomes are to stop, to redesign the system so that it falls outside the ban, or to prove that a narrow exception applies.

That makes the EU AI Act prohibited practices a classification question first. Before an organisation asks whether a system is high-risk, a GPAI integration or a transparency case under Article 50, it has to answer a prior question: is this a practice the law does not allow at all? Our EU AI Act overview and the operators’ guide place that step at the top of the classification sequence for this reason.

The Commission Guidelines and their limits

On 4 February 2025 the Commission published its Guidelines on prohibited AI practices, a long document with examples for each point; the page was last updated on 31 July 2025. The Guidelines are “non-binding, with authoritative interpretations reserved for the Court of Justice of the European Union”. In practice they are the text every national authority will start from, and the one your screening record should cite when it reasons through a borderline case.

The eight bans in force since 2 February 2025

The original list of EU AI Act prohibited practices in Article 5(1) runs from point (a) to point (h). The table below gives each ban, the condition that narrows it, and the place where companies usually meet it.

Two definitions do much of the work. Points (a) and (b) only bite when the distortion causes or is reasonably likely to cause significant harm, which is why the Commission spends so many pages on that threshold. Point (f) depends on Article 3(39), which defines an emotion recognition system as one that identifies or infers emotions or intentions “on the basis of their biometric data”. A tool that reads the sentiment of a written support ticket is not an emotion recognition system in that sense, because text is not biometric data; it may still raise questions under the GDPR. A tool that reads the voice of the agent on the call is a different matter.

Two new bans from 2 December 2026

The Digital Omnibus on AI, Regulation (EU) 2026/1744, inserted two new EU AI Act prohibited practices in Article 5(1). Point (ba) prohibits the placing on the market, putting into service or use of an AI system that generates or manipulates realistic images, videos, audio or similar material of an identifiable natural person’s intimate parts, or of an identifiable person engaged in sexually explicit activities, without that person’s freely given, specific, informed, unambiguous and explicit consent. Point (bb) prohibits AI systems that generate or manipulate child sexual abuse material within the meaning of Directive 2011/93/EU, except where a “without right” defence applies under national law.

The scope test sits in a new Article 5(1a), and it is the part every provider of generative AI should read twice. A provider is caught in two cases only: when generating that material is the intended purpose of the system, or when the system’s design, training, architecture, capabilities or user-facing functionalities make it “a reasonably foreseeable and reproducible outcome” without significant technical modification, and the system lacks “reasonable and adequate technical safety measures and other safeguards” to reliably prevent it and to correct observed or reported misuse. A deployer is caught only when it uses a system for that purpose. Article 5(1b) adds that editing which does not increase the exposure of intimate parts, or change the nature of a depicted sexual act, is not manipulation.

Recital 12 lists what reasonable safeguards can look like: data cleaning, refusal training, safe prompt design and output controls, runtime prompt guardrails, content classification and filtering, usage restrictions, abuse detection, and notice and action mechanisms. For systems intended to produce intimate content with consent, the provider needs a reliable way to collect and demonstrate the consent of the depicted person. Realism means a credible real-life depiction of a person’s face, voice or body; cartoonish or physically impossible depictions are outside the ban.

The consequence is practical. For a provider of a general-purpose AI image, video or voice product, compliance with point (ba) is proven by its safeguards, so the safeguards need a file: red-team results, refusal and filter metrics, abuse reports and the fixes that followed.

How the ban came about

The trigger was the wave of sexualised images of women and minors produced with Grok, the assistant integrated in X, in January 2026. The Commission opened Digital Services Act proceedings against X that month, and Spain proposed an explicit ban as an amendment to the AI Act, as the Spanish government recalled when the co-legislators reached a political agreement on 7 May 2026. The Regulation was signed on 8 July 2026, published in the Official Journal on 24 July and entered into force on 27 July 2026. Article 113, point (a), as amended, sets the start date: points (ba) and (bb) and paragraphs 1a and 1b apply from 2 December 2026.

What the first Article 112 review found

Article 112(1) obliges the Commission to assess every year whether the list in Article 5 and the high-risk list in Annex III need amending. The first report, <code>COM(2026) 234</code>, is dated 20 May 2026 and published on the Commission’s review page. It is the most useful document on the EU AI Act prohibited practices that almost nobody cites.

The method had three strands: consultation of the Member States through subgroups of the AI Board, a multi-stakeholder consultation, and an analysis of AI incident databases. On the politics, the result was conservative. The majority of the Member States present saw no need to amend the list at this stage, and nine sent written statements to the same effect. Their main argument was time: the prohibitions had applied only since February 2025 and enforcement mechanisms were not yet operational, so there was little practical experience to evaluate.

On substance, the report did two things. First, it identified the gap later closed by the Omnibus. The Commission examined whether points (a) or (b) could reach systems generating child sexual abuse material or non-consensual sexually explicit images and concluded they could not, “since they do not manipulate children and victims to engage them in harmful behaviour”. Second, it pointed in the other direction for fraud: AI systems that facilitate scams may already fall under points (a) and (b) when the conditions are met, including significant financial harm and a plausible causal link, with a deepfake impersonating a family member as the example. The Commission said it would watch how Member States interpret that threshold.

The report closes by noting that the next assessment is due in 2026. Our reading is that the EU AI Act prohibited practices should be treated as a versioned list. A screening done in early 2025 against eight points is already incomplete, and the next annual review can move the line again.

Fines for EU AI Act prohibited practices and who enforces them

Article 99(3) sets the highest ceiling in the Regulation for the EU AI Act prohibited practices: administrative fines of up to EUR 35,000,000 or, for an undertaking, up to 7 percent of total worldwide annual turnover for the preceding financial year, whichever is higher. For comparison, breaches of operator obligations and of Article 50 carry EUR 15,000,000 or 3 percent, and incorrect information to authorities EUR 7,500,000 or 1 percent. Under Article 99(6), SMEs and start-ups face whichever of the two amounts is lower.

The Omnibus created a category in between, the small mid-cap. New Article 99(6a) extends the lower-of rule to SMCs, but only for fines under paragraphs 4 and 5. On our reading of the text, an SMC exposed under Article 5 still faces the higher-of ceiling in paragraph 3. That is a detail a mid-sized group should put in front of its board before it ships a generative feature in December.

The ceilings are European; the procedure is national. Article 99(1) leaves it to Member States to lay down penalty rules and enforcement measures, and the pace differs:

• <b>Germany</b>: the KI-Marktüberwachungs- und Innovationsförderungsgesetz (KI-MIG) entered into force on 29 July 2026. The Bundesnetzagentur is market surveillance authority, single point of contact and complaints office, and supervises prohibited practices in its areas; BaFin keeps the financial sector.
• <b>Italy</b>: legge 132/2025 names AgID as notifying authority and ACN as market surveillance authority, while the Garante remains the data-protection authority.
• <b>Spain</b>: AESIA is the supervisory agency, and the draft organic law sent to the Congress on 26 May 2026 gives it the power to sanction most prohibited practices, with the AEPD competent for some.
• <b>France and Portugal</b>: France has not yet formalised the designation by law, and Portugal announced ANACOM in September 2025.

At the time of writing we found no published fine for an Article 5 breach. Data-protection authorities have not waited: on 3 October 2025 the Italian Garante ordered an urgent limitation of the processing of Italian users’ data by the Clothoff nudification service, under the GDPR. Exposure under the AI Act also adds to civil exposure, which our AI liability guide covers.

Where companies trip over Article 5

Few organisations set out to build social scoring. Most exposure to the EU AI Act prohibited practices comes from features bought, inherited or added without a second look:

• <b>Emotion analytics at work.</b> Call-centre software that scores the stress or frustration of agents from their voice, or interview tools that read candidates’ faces, fall under point (f) unless a medical or safety reason applies. Our article on automated employment decision tools covers the wider HR picture.
• <b>”Sentiment” that is really biometric.</b> A vendor calling a feature sentiment analysis does not settle the question. If it relies on voice or facial data, it is emotion recognition: banned at work and in education, high-risk under Annex III point 1(c) elsewhere.
• <b>Sensitive inferences in marketing.</b> Audience tools that sort shoppers by inferred religion, orientation or political view from images fall under point (g).
• <b>Persuasive design.</b> Interfaces that exploit cognitive biases to push purchases or subscriptions meet point (a) once the harm becomes significant.
• <b>Vulnerable customers.</b> Collection or credit tools that time offers to moments of financial distress raise point (b).
• <b>Scores that travel.</b> A risk score built for one purpose and reused to restrict access to an unrelated service drifts towards point (c).
• <b>Inherited datasets.</b> A face-search or identity product whose database was built by scraping brings point (e) into your organisation through procurement, which is why vendor due diligence belongs in the screening.
• <b>Generative features after 2 December 2026.</b> Any image, video or voice feature that can produce realistic intimate material of identifiable people needs documented safeguards, and AI voice cloning used for fraud can already meet points (a) and (b).

EU AI Act prohibited practices screening: the record an authority will ask for

Article 5 does not prescribe a document. But an authority investigating a complaint will ask how you concluded that a system was not prohibited, and “we did not think about it” is a poor answer. We recommend a screening record per AI system, built from the inventory and kept current. The table maps each step to its legal hook.

The record fits naturally into an AI management system. ISO/IEC 42001 requires an AI system impact assessment under clause 6.1.4, and Annex A control objective A.5, assessing impacts of AI systems, covers the process, its documentation and the effects on individuals and society. Article 5 does not require a management system, but an auditor or an authority will look for exactly this file, and an AI impact assessment that already exists is the cheapest place to add the ten questions. Our note on the ISO 42001 and AI Act standards stack shows where it sits. In AI Sigil, Prohibited AI Practices Screening is a control attached to each system in the AI registry, so the answer and its date travel with the record.

How Article 5 meets Article 50, the GDPR and criminal law

The EU AI Act prohibited practices do not replace the deepfake rules; they sit above them. Under Article 50(4), which applies since 2 August 2026, deployers must disclose deepfakes. Disclosure never legalises a prohibited system: a labelled nudification output is still banned from 2 December 2026.

The GDPR keeps running in parallel. Biometric data used to identify a person is special category data under Article 9 GDPR, whatever the AI Act says about the system, and the Clothoff order shows that data-protection authorities can act on that basis alone. Our guide to GDPR-compliant AI covers the overlap.

Criminal law reaches the individual. Directive (EU) 2024/1385 on combating violence against women and domestic violence requires Member States, under its Article 5, to criminalise producing or manipulating intimate material without consent and making it accessible to the public, deepfakes included, by 14 June 2027. Some Member States already have such offences, such as France’s article 226-8-1 of the Code pénal and Italy’s article 612-quater of the Criminal Code. The AI Act bans the tool, criminal law punishes the person who uses it, and the Digital Services Act reaches the platform that spreads the result.

Finally, the boundary with the high-risk regime is precise. Emotion recognition outside work and education, biometric categorisation on sensitive attributes by inference outside point (g), and remote biometric identification are listed in Annex III point 1, now due from 2 December 2027. A system can therefore move from banned to high-risk, or the reverse, with a change of context alone. Where a system stays high-risk, human oversight duties follow.

FAQ

<b>Which AI practices are prohibited under the EU AI Act?</b>

Article 5 lists eight practices in force since 2 February 2025: manipulative or deceptive techniques, exploitation of vulnerabilities, social scoring, crime prediction based solely on profiling, untargeted scraping for facial recognition databases, emotion recognition at work and in education, biometric categorisation on sensitive traits, and real-time remote biometric identification for law enforcement outside narrow exceptions. From 2 December 2026, two more EU AI Act prohibited practices apply: AI systems that generate non-consensual intimate material of identifiable people, and AI systems that generate child sexual abuse material.

<b>Since when do the prohibitions apply?</b>

The eight original bans have applied since 2 February 2025, together with the definitions in Chapter I, under Article 113, point (a). The penalty provisions became applicable on 2 August 2025, and Member States are still putting their national procedures in place. The two bans added by the Digital Omnibus, points (ba) and (bb), and the scope rules in Article 5(1a) and (1b), apply from 2 December 2026. Nothing in Article 5 was postponed by the Omnibus.

<b>Do the EU AI Act prohibited practices apply to companies outside the EU?</b>

Yes. Article 2(1)(a) covers providers placing AI systems on the EU market wherever they are established, and Article 2(1)(c) covers providers and deployers located outside the Union when the output of the system is used in the Union. A non-EU company that offers an emotion-scoring interview tool to employers in Europe, or a nudification app reachable by European users, is within the reach of Article 5 and of national market surveillance authorities.

<b>Is emotion recognition always prohibited?</b>

No. Point (f) bans inferring emotions of natural persons in the workplace and in education institutions, except for medical or safety reasons. Outside those two settings, emotion recognition is not banned but is a high-risk use under Annex III point 1(c), with obligations due from 2 December 2027, plus the transparency duty of Article 50(3). The definition in Article 3(39) requires biometric data, so analysis of written text is not emotion recognition in this sense.

<b>What is the fine for a prohibited AI practice?</b>

Up to EUR 35,000,000 or 7 percent of total worldwide annual turnover for the preceding financial year, whichever is higher, under Article 99(3). For SMEs and start-ups the lower of the two applies. The lower-of rule that the Digital Omnibus created for small mid-caps covers only paragraphs 4 and 5, not Article 5 breaches. National authorities set the procedure and decide the amount, taking into account gravity, duration and the number of people affected.

<b>Are general-purpose image generators caught by the new deepfake ban?</b>

They can be. A provider is caught when producing realistic intimate material of an identifiable person without consent is the intended purpose, or when it is a reasonably foreseeable and reproducible outcome and the system lacks reasonable and adequate safeguards to prevent it and to correct misuse. A general-purpose image, video or voice generator with documented filters, refusal training, abuse detection and notice-and-action handling sits outside the ban; one without them may not.

Conclusion

The EU AI Act prohibited practices were long treated as a list to read once and forget, because few companies set out to build social scoring. That reading no longer holds. On 2 December 2026 the list grows to ten, and the new bans reach ordinary generative products through a safeguards test. The Commission reviews the list every year, and national authorities such as the Bundesnetzagentur now have the powers to act. The defensible position is simple to describe and tedious to maintain: an inventory of every AI system, a dated screening against the ten points, the evidence behind each exception and each safeguard, and a trigger to screen again when the system or the law changes. If you want that record to live with each system rather than in a spreadsheet, AI Sigil’s framework activation runs it as part of EU AI Act classification.