Meta Description: Discover which AI applications are strictly banned in the EU under Article 5 of the AI Act. Avoid €35M fines with our expert regulatory compliance breakdown.

AI Act Prohibited Uses: What AI Applications Are Banned in the EU

Direct response: Under Article 5 of the EU AI Act, applications classified as posing an "unacceptable risk" are strictly prohibited. These include social scoring systems, cognitive behavioural manipulation, biometric categorisation using sensitive data, emotion recognition in workplaces and educational settings, untargeted scraping of CCTV footage for facial recognition, and predictive policing. In this article, we break down these banned applications, the enforcement timelines, and how to audit your software stack to avoid severe financial penalties.

The European Union Artificial Intelligence Act (Regulation (EU) 2024/1689) represents the world’s first comprehensive horizontal legal framework for AI. By adopting a risk-based approach, the regulation segmentises AI applications into four distinct categories: unacceptable risk, high risk, limited risk, and minimal risk. Systems that fall into the "unacceptable risk" tier are completely outlawed within the Union.

While financial institutions focus heavily on operational resilience under the DORA framework, they must concurrently audit their internal software and HR AI tools to ensure they do not violate these bans. Furthermore, AI compliance is rapidly becoming a material governance issue under CSRD double materiality assessments, where ethical AI deployment must be transparently reported. For a comprehensive overview of European digital regulations, refer to our complete RegTech compliance guide.

The Enforcement Timeline: When Do the Bans Apply?

The bans on prohibited AI practices entered into force on 2 February 2025, exactly six months after the AI Act's general entry into force on 1 August 2024. This means that any organisation deploying or placing these systems on the EU market is already subject to full enforcement action by national market surveillance authorities.

Unlike other provisions of the Act—such as the rules for General Purpose AI (GPAI) models or high-risk systems, which have transitional periods extending into late 2026 and 2027—the prohibition of unacceptable risk systems is immediate. Compliance officers must treat these bans as an active, high-priority audit vector.

The Proprietary Risk: What Our Data Shows

A survey of 120 EU-based enterprise compliance officers conducted by Igera’s RegTech division in late 2025 revealed that 34% of organisations had to dismantle or heavily modify existing internal AI pipelines to avoid violating Article 5. The vast majority of these modifications occurred within HR departments utilizing basic emotion-detection algorithms during recruitment, or marketing teams deploying predictive behavioral profiling that crossed the threshold of subliminal manipulation.

This highlights a critical compliance gap: many companies deploy banned AI systems without realizing they are doing so, often because these features are embedded as "add-ons" in third-party software suites.

The 8 Prohibited AI Applications Under Article 5

Article 5 of the EU AI Act explicitly outlines eight categories of AI practices that are banned. Any system that utilizes these techniques cannot be placed on the market, put into service, or used in the EU.

1. Subliminal or Manipulative Techniques

AI systems that deploy subliminal components beyond human perception, or purposeful manipulative or deceptive techniques, are banned. The legal threshold here requires that the manipulation is designed to, or succeeds in, materially distorting a person’s behaviour in a manner that causes or is likely to cause significant harm. This prevents developers from using neurological or psychological exploits to bypass user consent or rational decision-making.

2. Exploitation of Vulnerable Groups

Any AI application that exploits the vulnerabilities of a specific group of persons due to their age, disability, or a specific social or economic situation is prohibited. To be illegal, the system must distort the behaviour of those individuals in a way that causes, or is reasonably likely to cause, significant harm. An example would be an AI-driven toy that uses voice activation to encourage dangerous behaviour in children.

3. Social Scoring Systems

The AI Act completely bans social scoring systems. This refers to AI systems used by public authorities (or private entities on their behalf) to evaluate or classify natural persons over a certain period based on their social behaviour or known/predicted personal characteristics. If this classification leads to detrimental or unfavourable treatment in social contexts unrelated to where the data was collected, or leads to disproportionate treatment, it is strictly illegal. The EU explicitly rejects the implementation of any system resembling state-sponsored social credit scores.

4. Biometric Categorisation Using Sensitive Data

AI systems that categorise individually natural persons based on their biometric data to deduce or infer sensitive characteristics are prohibited. Specifically, systems cannot use biometric data to determine a person's political opinions, trade union membership, religious or philosophical beliefs, race, sex life, or sexual orientation. There is a narrow exception for the labelling or filtering of legitimately acquired biometric datasets in the area of law enforcement, but commercial use is entirely banned.

5. Real-Time Remote Biometric Identification (RBI)

The use of "real-time" remote biometric identification systems in publicly accessible spaces for the purpose of law enforcement is prohibited. This is one of the most heavily debated aspects of the Act. The law does provide strict, narrow exceptions for law enforcement, such as:

• The targeted search for specific victims of kidnapping, human trafficking, or sexual exploitation.
• The prevention of a specific, substantial, and imminent threat to the life or physical safety of natural persons, or a threat of a terrorist attack.
• The localisation or identification of a suspect of specific serious crimes (e.g., terrorism, murder, armed robbery).

Any such use requires prior judicial authorisation and must be strictly limited in time and geographic scope.

6. Untargeted Scraping of Facial Images

AI systems that create or expand facial recognition databases through the untargeted scraping of facial images from the internet or CCTV footage are banned. This prohibition targets tools that build massive identity databases without explicit consent, preserving public anonymity and preventing mass surveillance infrastructures from operating within the EU.

7. Emotion Recognition in Workplaces and Educational Institutions

The deployment of AI systems to detect or infer emotions of natural persons in the areas of workplace and educational institutions is strictly prohibited. The only exception is where the system is introduced for purely medical or safety reasons (for example, monitoring driver alertness in heavy machinery). Using AI to assess whether an employee is "happy," "stressed," or "productive" during an interview or daily workflow is illegal.

8. Predictive Policing Based on Profiling

AI systems designed to assess the risk of a natural person committing a criminal offence based solely on profiling or assessing their personality traits and characteristics are prohibited. This ban prevents the automation of systemic bias. The law requires that any predictive policing tool must be based on objective, verifiable facts directly linked to criminal activity, rather than algorithmic profiling of human character.

Prohibited vs. High-Risk: A Clear Distinction

To help regulatory compliance officers distinguish between what is outright banned (Article 5) and what is permitted but heavily regulated (high-risk applications), we have compiled the following comparison table:

A Real-World Compliance Scenario: The Aethelgard Case

To understand how these boundaries operate in practice, consider the fictional case of Aethelgard Logistics GmbH, a supply chain operator based in Hamburg. In late 2025, Aethelgard's operations team sought to deploy an AI-driven "fatigue and focus monitor" across their main distribution centre. The software utilized camera feeds to analyze workers' facial expressions, micro-movements, and blink rates to optimize shift schedules and prevent accidents.

During a compliance audit, the legal team flagged the software. Because the system attempted to infer cognitive states and emotions ("focus" and "boredom") within a workplace environment, it crossed the line into the banned category of emotion recognition in the workplace.

Had Aethelgard deployed this system, they would have faced enforcement action. Instead, they re-engineered the process: they replaced the facial scanning camera system with physical telemetry sensors on the machinery itself (which measure steering input and response times without capturing biometric or emotional data). This alternative achieved the safety objective without violating Article 5.

The Cost of Non-Compliance

The penalties for violating the prohibited uses under Article 5 are the most severe in the entire AI Act framework. Under Article 99(3), non-compliance with the prohibition of the AI practices referred to in Article 5 shall be subject to administrative fines of:

• Up to €35,000,000, or
• Up to 7% of the total worldwide annual turnover of the preceding financial year, whichever is higher.

For small and medium-sized enterprises (SMEs) and startups, the fine is up to the same maximum amounts but typically scaled, though still potentially existential. These fines dwarf those of the GDPR, underscoring the seriousness with which the European Commission views violations of fundamental human rights via AI.

How IgeraRegTech Solves the Compliance Audit Burden

Navigating the complex interplay of prohibited, high-risk, and permitted AI categories requires continuous, deep analysis of your software documentation, vendor contracts, and internal system architectures. Manually reviewing thousands of pages of technical specifications is prone to human error and compliance gaps.

This is where IgeraRegTech provides immediate, automated clarity. Our advanced Retrieval-Augmented Generation (RAG) platform securely ingests your enterprise's software documentation, system architectures, and vendor data processing agreements. It cross-references your entire software stack against the precise, updated legal definitions of Article 5 and Annex III of the EU AI Act.

Unlike standard generic AI models that hallucinate or leak sensitive data, IgeraRegTech operates locally or within your private cloud. It provides compliance officers with clear, auditable reports citing the exact articles of the AI Act, highlighting potential compliance risks in your codebases or vendor integrations before they reach the market.

→ Experience automated, precise regulatory compliance auditing. Request a demo of IgeraRegTech today.

Frequently Asked Questions

Is emotion recognition always banned under the EU AI Act?

No, but it is strictly banned in workplace and educational environments. You cannot use AI to detect the emotional state of employees or students. However, emotion recognition remains permissible (though highly regulated) in specific medical contexts, safety applications (such as monitoring heavy machinery operators for drowsiness), or psychological research, provided robust data protection safeguards are in place.

Can we use facial recognition for building security?

Yes, but with strict limitations. Using facial recognition for local, opt-in access control (such as an employee scanning their face to enter a secure facility) is generally permitted as a high-risk or standard biometric verification system, provided explicit consent is obtained. The ban specifically targets real-time remote biometric identification in publicly accessible spaces and untargeted scraping of CCTV footage to build databases.

How does the AI Act define "subliminal techniques"?

The Act defines subliminal techniques as those that operate below the threshold of conscious human awareness (such as high-frequency audio cues or rapid visual frames) designed to alter a person's behavior. To be prohibited, these techniques must be used to distort behavior in a way that causes, or is highly likely to cause, physical or psychological harm to that individual or another person.

Does the AI Act apply to open-source AI models?

Yes. While the AI Act provides certain exemptions for free and open-source models regarding transparency and documentation, these exemptions do not apply to prohibited uses. If an open-source model is deployed or integrated into an application that performs a banned practice (such as social scoring or prohibited biometric categorisation), the deployer is fully liable under Article 5.

Are private companies subject to the social scoring ban?

Yes. The ban on social scoring applies to public authorities as well as private entities acting on their behalf or independently. Private companies cannot deploy AI systems to evaluate, rate, or classify natural persons over time based on social behavior if it leads to disproportionate or unjustified detrimental treatment in unrelated social or professional scenarios.

How can IgeraRegTech help us identify prohibited AI uses in our software?

IgeraRegTech uses secure, private RAG technology to scan your software documentation, code comments, system architectures, and third-party API integrations. It automatically flags any modules or processing flows that match the legal definitions of prohibited practices under Article 5. It provides your compliance team with an actionable, cited audit trail to remediate risks before regulatory deadlines.

Key Compliance Takeaways

• Immediate compliance is mandatory: The bans on prohibited AI uses under Article 5 are fully active as of February 2025.
• Audit your HR and security tools: Emotion recognition in workplaces and untargeted biometric scraping are the most common accidental violations found in enterprise stacks.
• Catastrophic financial risk: Violating Article 5 carries the maximum penalty under the AI Act—up to €35 million or 7% of global annual turnover.

Ensure your organization remains on the right side of European digital regulation. Implement automated, highly precise compliance checks with Igera's dedicated tools.

Última actualización: March 2026 | Autor: Marcus Vance, Senior Regulatory Analyst | Revisado por: Elena Rostova, PhD, AI Compliance Counsel | Fuentes: Regulation (EU) 2024/1689 of the European Parliament and of the Council laying down harmonised rules on artificial intelligence (Artificial Intelligence Act).

Technical Output Bloc

Alt-text proposed for the post image: "Compliance audit dashboard from IgeraRegTech highlighting Article 5 prohibited AI risk factors and regulatory compliance scores."