EU AI Act Art.5: Prohibited AI practices
Article 5 of the EU AI Act binds the operator (see the article). It requires Prohibits a defined set of AI practices, including subliminal/manipulative techniques causing significant harm, exploitation of vulnerabilities, social scoring by public. This page states what it requires, who it binds and the evidence to keep. Browsing is free; the conformance kit is USD 499.
Specifics
| Instrument | Regulation (EU) 2024/1689 (the EU AI Act), as amended by Regulation (EU) 2026/1744 |
|---|---|
| Article | Art.5 |
| Binds | Operator (see the article) |
| Group | General Provisions and Prohibited Practices |
| Evidence items | 6 |
| Linked NIST AI RMF controls | 0 |
| Linked ISO/IEC 42001 controls | 0 |
| Last updated |
Who does Art.5 bind?
The article binds the operator (see the article). The Act places each duty on a named party in the value chain, so a system can carry a provider duty and a deployer duty at once. Confirm your own position against the text; this page names the party, it does not rule on your facts.
Applies from 2 February 2025; the added prohibitions on non-consensual intimate imagery and child sexual abuse material apply from 2 December 2026. See the full timeline.
What does Art.5 require?
Prohibits a defined set of AI practices, including subliminal/manipulative techniques causing significant harm, exploitation of vulnerabilities, social scoring by public authorities, predictive policing based solely on profiling, untargeted scraping of facial images, emotion recognition in workplace/education (except where the AI system is intended for medical or safety reasons, Art. 5(1)(f)), biometric categorisation inferring sensitive attributes, and real-time remote biometric identification (RBI) in publicly accessible spaces by law enforcement (subject to narrow exceptions).
This is our plain-language statement of the article, not the text of the regulation. Read the article: Art.5 (Regulation (EU) 2024/1689 on EUR-Lex).
What evidence should we keep for Art.5?
| Category | Evidence to keep |
|---|---|
| Prohibited practices | A screening record per AI system or use case stating which of the eight Article 5 practices it was checked against and the conclusion reached, dated before deployment |
| Prohibited practices | For a system that evaluates, scores or targets people, a documented analysis of whether the technique is subliminal, manipulative or exploits a vulnerability tied to age, disability or economic situation, and whether significant harm is a reasonably likely outcome |
| Prohibited practices | For a scoring or evaluation system, evidence that only data relevant to the context in which the score is applied is used, and that any unfavourable treatment that follows is proportionate to the conduct scored |
| Prohibited practices | For a system inferring emotion or a sensitive trait such as race, political view, union membership, religious belief or sexual orientation from biometric data, the legal basis or the narrow medical, safety or law-enforcement exception relied on, recorded before use |
| Prohibited practices | For a system doing real-time remote biometric identification in a public space for law enforcement, the prior judicial or independent authorisation, the named serious-crime or imminent-threat ground, and the fundamental rights assessment behind it |
| Prohibited practices | A record of which other Union or national law (data protection, consumer protection, non-discrimination, sector-specific rules) was checked for a borderline use, and the conclusion reached |
What does a linked control mean here?
A linked control is a NIST AI RMF or ISO/IEC 42001 control that the held rule set records as a topical match, with a confidence and a one-line reason. It does not establish that meeting one requirement satisfies the other, it is not legal advice, and it is not certification. Where no control is recorded, the page says so and does not guess. Sources: the NIST AI RMF and ISO/IEC 42001.
Which NIST AI RMF controls line up with Art.5?
No NIST AI RMF control is recorded as a match for this obligation in the held rule set. It is left unlinked and marked, never guessed.
Which ISO/IEC 42001 controls line up with Art.5?
No ISO/IEC 42001 control is recorded as a match for this obligation in the held rule set. It is left unlinked and marked, never guessed.
What does the conformance kit add for Art.5?
The kit renders this obligation into your own role checklist with the evidence register, the linked controls and a CSV export, for USD 499 one off. See what is in the kit or open it.