The AI Act conversation is dominated by future dates. August 2026, December 2027. But one tier has been fully applicable since 2 February 2025, carries the Act’s highest fines (up to EUR 35 million or 7% of global turnover), and was not touched by the omnibus postponements: the prohibited practices of Article 5. If any of these patterns exists in your product, the compliance question is not “when”; it is “now”.
The eight prohibitions, translated to product language
- Subliminal or manipulative techniques that materially distort behaviour and cause significant harm. Dark-pattern design amplified by AI personalisation sits uncomfortably close to this line.
- Exploiting vulnerabilities of age, disability or economic situation. An engagement engine tuned to maximise spending by minors or financially distressed users is the textbook case.
- Social scoring by public or private actors leading to detrimental treatment in unrelated contexts.
- Predictive policing based solely on profiling or personality traits.
- Untargeted scraping of facial images from the internet or CCTV to build recognition databases; relevant to anyone assembling training sets.
- Emotion recognition in workplaces and schools (safety and medical uses excepted). HR monitoring tools and proctoring software live here.
- Biometric categorisation inferring race, political opinion, union membership, beliefs, sex life or orientation.
- Real-time remote biometric identification in public spaces for law enforcement, with narrow exceptions.
Three traps for Turkish companies
Trap one: “we only deploy, we didn’t build it.” Article 5 binds placing on the market, putting into service and use. Deploying a third-party proctoring tool with emotion inference on EU users is your violation, not just the vendor’s.
Trap two: the feature nobody calls by its legal name. No product manager writes “social scoring” in a spec. It ships as “trust score”, “user quality index”, “risk tier”. The test is functional: does an aggregated behavioural score cause detrimental treatment in contexts unrelated to where the data came from?
Trap three: training-set provenance. If a dataset you bought was built by scraping faces at scale, the prohibition reaches the practice; provenance duty is yours when you commission or use it knowingly.
What to do this quarter
- Run an Article 5 screen over your feature list and your vendors’ features; it is a one-day exercise with the eight patterns above.
- Rename nothing, redesign instead: if a feature fails the functional test, cosmetic relabelling will not survive a regulator reading your codebase or your marketing.
- Document the screen. If a question ever comes, the difference between “we assessed and designed around it” and silence is the difference between an argument and an admission.
The rest of the AI Act arrives on a schedule you can plan for; see our pieces on the August 2 transparency duties and AI in hiring. Article 5 is the part that already arrived.
This article is for general information only and does not constitute legal advice. It reflects the position as of July 2026.
Author
If this is on your desk
Templates and checklists are free in the Founder Academy; for a specific situation, book a 30-minute intro call.
Founder AcademyBook an intro call