What are prohibited AI practices?
Prohibited AI practices are the uses banned outright by Article 5 of the EU AI Act — the top of the risk pyramid, above high-risk. The bans have applied since 2 February 2025 and were not postponed by the Digital Omnibus; they carry the Act’s highest fine ceiling (up to €35 million or 7% of worldwide turnover).
The eight bans
In compressed form: subliminal or purposefully manipulative techniques that materially distort behaviour and cause significant harm; exploiting vulnerabilities of age, disability or social situation; social scoring by or for public and private actors with unjustified detrimental treatment; predictive policing based solely on profiling or personality traits; untargeted scraping of facial images to build recognition databases; emotion recognition in workplaces and schools (health and safety excepted); biometric categorisation inferring sensitive attributes; and real-time remote biometric identification in public spaces for law enforcement, save narrow exceptions.
The grey zones founders actually hit
Marketing personalisation vs. “manipulative technique” turns on material distortion and significant harm — dark patterns aimed at vulnerable users are the danger zone. Employee-monitoring products that infer stress or mood cross into the workplace emotion-recognition ban. And “trust scores” combining unrelated data sources to gate services can qualify as social scoring even in a purely private product.
Do the prohibitions apply to companies outside the EU?
Yes — placing the system on the EU market or using its output in the EU suffices; establishment is irrelevant.
Who enforces them?
Member-state market-surveillance authorities, with the penalties framework applying from 2 August 2026 — though the bans themselves have been binding since February 2025.
Related: high-risk AI system, Article 50 transparency.