✓ Low compliance impact for SMEs
WHAT THE ARTICLE IS ABOUT
The absolute limits — eight banned categories
Article 5 defines the absolute limits of the EU AI Act — AI practices so harmful to fundamental rights, safety, and human dignity that they are prohibited outright. These are not high-risk systems requiring extra compliance. They are banned entirely.
WHAT IT SAYS
The eight prohibited practices
- Subliminal manipulation: AI systems that use techniques beyond a person’s awareness to manipulate behaviour in ways that cause harm are prohibited
- Exploitation of vulnerabilities: AI that exploits the vulnerabilities of specific groups — based on age, disability, or social situation — to distort behaviour harmfully is banned
- Social scoring: AI used by public authorities to evaluate or classify people based on social behaviour in ways that lead to detrimental treatment is prohibited
- Real-time remote biometric identification in public spaces: Live facial recognition by law enforcement is banned with narrow exceptions for serious crime investigations
- Biometric categorisation inferring sensitive attributes: AI that categorises people to infer race, political opinion, religion, or sexual orientation is prohibited
- Emotion recognition in workplaces and education: AI that infers emotions of individuals in professional or educational settings is banned
- Predictive policing based on profiling: AI used to assess individual risk of criminal behaviour based solely on profiling is prohibited
- Scraping facial images: Building facial recognition databases by untargeted scraping of images from the internet or CCTV is banned
WHO IS AFFECTED
Primarily large-scale operators — but SMEs must check
- Any provider or deployer attempting to use AI in the above categories within the EU
- Law enforcement agencies (subject to specific narrow exemptions for real-time biometric ID)
- HR technology vendors offering emotion recognition tools
- Public authorities using any form of social scoring
WHAT IT MEANS FOR SMES
Mostly distant — but one area to watch closely
- Most SMEs will never come close to these prohibited categories — they are primarily aimed at large-scale surveillance and government systems
- However: if you are evaluating HR or recruitment AI tools, check carefully whether they include emotion recognition or behavioural inference — some do, and deploying them in the EU is illegal
- If you are building consumer AI, ensure it does not exploit vulnerable users — this is broader than it sounds and catches dark pattern AI design
- The penalties for prohibited practices are the highest in the Act: up to 35 million euros or 7% of global annual turnover
Related Articles
- Article 6 — High-risk classification (the next tier below prohibited)
- Article 3 — Definitions (defines manipulation, biometric data, and other key terms)
- Article 99 — Penalties for prohibited practices
