The prohibitions in the original text

Since 2 February 2025 (Article 113, point (a)) it has been prohibited to place on the market, put into service or use systems that manipulate through subliminal or deceptive techniques, that exploit vulnerabilities due to age, disability or social or economic situation, or that score people socially with detrimental or disproportionate effects.

Also banned are predicting the risk of committing a crime based solely on profiling or personality traits, building facial recognition databases through untargeted scraping of images from the internet or CCTV, biometric categorisation to infer race, political opinions, trade union membership, beliefs or sexual orientation, and real-time remote biometric identification in publicly accessible spaces for law enforcement, save for narrowly defined exceptions.

The one that affects companies most

Point (f) prohibits inferring a person's emotions in the workplace and in educational institutions, except for medical or safety reasons. A system that analyses call-centre agents' tone of voice to gauge their mood, or a camera that measures a team's engagement, falls squarely within it.

Outside work, emotion recognition is not prohibited, but it is classed as high-risk (Annex III, point 1) and requires the people exposed to it to be informed (Article 50(3)).

What the Digital Omnibus adds

Regulation (EU) 2026/1744 inserts two new points: point (ba), which prohibits systems that generate or manipulate realistic images, video or audio of the intimate parts of an identifiable person, or of that person engaged in sexually explicit activities, without their explicit consent; and point (bb), on child sexual abuse material.

For whoever places the system on the market, the prohibition applies where that output is its intended purpose or is reasonably foreseeable and there are no reliable safeguards to prevent it (Article 5(1a)). Both points apply from 2 December 2026.

Consequences

Breaching Article 5 is punishable by fines of up to EUR 35 million or, if the offender is a company, up to 7% of its total worldwide annual turnover for the preceding financial year, whichever is higher (Article 99(3)). For SMEs, the lower of the two applies (Article 99(6)).

What an auditor usually asks for

Inventory checked against each point of Article 5
No system infers employees' emotions, unless for a documented medical or safety reason
Image or video generation tools with verified safeguards
Check repeated whenever a tool is procured or extended

How to tackle it in practice

1Go through the inventory of systems and note, point by point, why none of them engages in a prohibited practice.
2Ask providers of voice, video or productivity analytics explicitly whether their features infer emotions.
3Include the Article 5 check in the onboarding procedure for any new tool.

Many of these practices also process biometric or special category data, which the GDPR already restricts in its own right.

See the GDPR learning path

Where each figure comes from

References to the official text in force. If a standard is revised, this page is updated and the review date says so.

Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) EUR-Lex · OJ L 2024/1689 · 12 July 2024
Regulation (EU) 2026/1744 (Digital Omnibus on AI), amending Regulation (EU) 2024/1689 EUR-Lex · OJ L 2026/1744 · 24 July 2026
Regulation (EU) 2024/1689, consolidated text EUR-Lex · CELEX 02024R1689-20260727 · Version of 27 July 2026

Prohibited AI practices