Prohibited AI Practices Under Article 5

For the classification specialist, the Article 5 screen is the first gate. If a system falls under a prohibition, no downstream classification work is relevant. If a system is adjacent to a prohibition, the specialist must document the “why not” reasoning with enough rigour to survive a supervisory review.

The eight prohibition categories

Article 5(1) contains eight sub-paragraphs, conventionally referred to as Article 5(1)(a) through 5(1)(h). Each defines a discrete prohibited practice. Treating them as a unified list risks conflating categories with different scope and different exceptions; the specialist treats each independently.

Article 5 screens — a decision method

The specialist runs eight independent screens, one per sub-paragraph, for each system in scope. For each screen the answer is one of three: prohibited, not prohibited, or prohibited unless a specific exception applies. The method avoids the common error of dismissing adjacent practices without documented reasoning.

Screen 1 — subliminal or manipulative techniques (5(1)(a))

The prohibition attaches to AI systems that deploy subliminal techniques beyond a person’s consciousness, or purposefully manipulative or deceptive techniques, with the objective or the effect of materially distorting a person’s behaviour by appreciably impairing the ability to make an informed decision, thereby causing or reasonably likely to cause significant harm. The four conjunctive elements — subliminal-or-manipulative technique, material distortion, appreciable impairment, significant harm — are all required.

Ordinary persuasive advertising does not meet the test. Targeted content recommendations based on personalisation do not, by themselves, meet the test. The February 2025 Commission guidelines on prohibited practices emphasise that 5(1)(a) is concerned with techniques that operate below a user’s conscious awareness or that employ deception the user cannot reasonably detect, combined with a causal path to significant harm.

Screen 2 — exploiting vulnerabilities (5(1)(b))

5(1)(b) prohibits AI systems that exploit the vulnerabilities of a specific group of persons due to their age, disability, or specific social or economic situation, with the object or effect of materially distorting behaviour causing or reasonably likely to cause significant harm. The discriminator from 5(1)(a) is the vulnerability-targeting intent. A chatbot that uses standard persuasion techniques on a general population is assessed under 5(1)(a); the same chatbot deployed with system prompts targeting isolated elderly users or young children is assessed under 5(1)(b).

Screen 3 — social scoring by public authorities (5(1)(c))

Social scoring is defined as the evaluation or classification of natural persons or groups over a certain period of time based on their social behaviour or known, inferred, or predicted personal or personality characteristics, where the social score leads to either detrimental or unfavourable treatment in contexts unrelated to those in which the data were originally generated, or to treatment that is unjustified or disproportionate to the behaviour.

The prohibition is scoped to public authorities or to persons acting on their behalf. A private-sector creditworthiness model is not 5(1)(c) social scoring, even where it produces a composite score — it is assessed under Annex III point 5(b) in the high-risk regime. A public-sector welfare-eligibility model used to channel enforcement resources is assessed under 5(1)(c) when its outputs travel into unrelated contexts.

Screen 4 — predictive policing based solely on profiling (5(1)(d))

5(1)(d) prohibits the use of an AI system to make risk assessments of natural persons to assess or predict the risk of a natural person committing a criminal offence, based solely on profiling or on assessing personality traits. The solely threshold is the discriminator. Risk assessments that combine profiling with objective investigative facts (a specific incident, a specific tip, a specific corroborated source) fall outside the 5(1)(d) prohibition — though they may raise separate issues under other instruments.

The February 2025 Commission guidelines make explicit that 5(1)(d) does not prohibit AI systems that support the investigation of specific persons on the basis of objective facts, nor AI systems used to analyse aggregate crime patterns where no individualised risk assessment is produced.

Screen 5 — untargeted facial-image scraping (5(1)(e))

5(1)(e) prohibits the creation or expansion of facial-recognition databases through the untargeted scraping of facial images from the internet or CCTV footage. Untargeted is the discriminator. Targeted collection based on a specific investigative mandate, or collection with documented consent, is not 5(1)(e). This is the prohibition most cleanly aligned to the Clearview AI enforcement history discussed in Article 1 of this credential.

Screen 6 — emotion recognition at work and in education (5(1)(f))

5(1)(f) prohibits the use of AI systems to infer emotions of natural persons in the areas of workplace and education institutions, except where the use of the AI system is intended to be put in place or placed on the market for medical or safety reasons. The carve-outs are narrow. A “wellness check-in” app that infers workplace stress from vocal tone is not a medical device and does not meet the safety carve-out; it is prohibited. A seizure-detection system worn by a diabetic patient that incidentally infers affect states while monitoring physiological parameters is deployed for medical reasons and falls outside 5(1)(f).

The Italian Garante has been the most active EU supervisor in this territory, with guidance materials published through 2023 and 2024 restricting employer use of affective-computing tools in recruitment, performance management, and workplace monitoring. The Garante’s position — that affective-computing in employment carries a near-insurmountable proportionality problem — informs how 5(1)(f) is likely to be interpreted in early enforcement. Source: Italian Garante, “Intelligenza artificiale,” https://www.garanteprivacy.it/temi/intelligenza-artificiale .

Screen 7 — biometric categorisation to infer sensitive attributes (5(1)(g))

5(1)(g) prohibits biometric categorisation systems that categorise individually natural persons based on their biometric data to deduce or infer their race, political opinions, trade-union membership, religious or philosophical beliefs, sex life, or sexual orientation. Lawful labelling or filtering of biometric datasets in accordance with Union or national law, and biometric categorisation in the area of law enforcement, are excepted.

The prohibition is narrow in scope but strict in application. A retail analytics system that uses facial analysis to categorise shoppers by gender and age for aggregate demographic reporting would not, by itself, hit 5(1)(g); a system that attempts to categorise those same shoppers by inferred religion would.

Screen 8 — real-time remote biometric identification by law enforcement (5(1)(h))

5(1)(h) prohibits the use of real-time remote biometric identification systems in publicly accessible spaces for the purpose of law enforcement, unless and insofar as such use is strictly necessary for one of three exhaustively enumerated objectives: the targeted search for specific victims of specific crimes (including missing persons); the prevention of a specific, substantial, and imminent threat to the life or physical safety of natural persons or a genuine and present or foreseeable threat of a terrorist attack; or the localisation or identification of a person suspected of having committed a specific serious criminal offence listed in Annex II.

Each exception requires prior authorisation by a judicial or independent administrative authority, subject to strict necessity and proportionality, and is subject to post-use reporting. The narrowness of the carve-out is the design intent — 5(1)(h) is not a general licence for law-enforcement facial recognition, it is a tightly bounded exception.

The “general-purpose capability” trap

A recurring scoping error is to treat a general-purpose model’s capability to perform a prohibited practice as a prohibited practice itself. Article 5 attaches to AI systems that are placed on the market, put into service, or used for a prohibited purpose. A general-purpose model is an [[ai-system]] only in combination with a specific intended purpose; the capability to perform emotion recognition, for example, is not a prohibited practice until the capability is configured, tested, documented, marketed, or otherwise put into service for emotion recognition in workplaces or education. The specialist documents the system-level intended purpose that the scoping memo relies on — not the capability envelope of the underlying model.

The EDPB Opinion 28/2024 on certain data-protection aspects of AI models (December 2024) makes a parallel point from the data-protection side: the model may not embed personal data in any legally meaningful sense even where the training data contained personal data, and the data-protection analysis must attach to the system that deploys the model for a specific purpose. The specialist can borrow this system-over-model discipline for Article 5 screens.

Dutch SyRI — a prohibition precursor

The Dutch Syri case (NJCM v. State of the Netherlands, The Hague District Court, 5 February 2020) pre-dates the EU AI Act but is the most frequently cited European court precedent for what Article 5(1)(c) social scoring looks like in the public sector. Syri — Systeem Risico Indicatie — combined welfare, tax, housing, employment, and education data in a risk-scoring system deployed by Dutch ministries to identify fraud risk in specific neighbourhoods. The court struck the system down for breaching Article 8 ECHR on proportionality and transparency grounds.

For the specialist, Syri is instructive less for its legal outcome than for its factual pattern: public-authority deployment, composite risk score, detrimental treatment (enhanced enforcement attention) in a context distinct from any single source of data, and opacity to the affected population. Each factor maps to an Article 5(1)(c) element. Source: ECLI:NL:RBDHA:2020:1878, https://uitspraken.rechtspraak.nl/details?id=ECLI:NL:RBDHA:2020:1878 .

Italian Garante on workplace emotion recognition — a 5(1)(f) precursor

The Italian Garante’s consistent position through 2023–2024 — that emotion-recognition technologies in employment face a near-insurmountable proportionality test — is the most developed European supervisory position on what 5(1)(f) will look like in practice. The Garante has drawn a clear line between medical-device uses (assessed under the Medical Devices Regulation’s safety framework, including the CE-marking pathway covered in Article 3 of this credential) and workplace affective-computing uses (assessed under GDPR proportionality and, going forward, Article 5(1)(f)). The Garante’s guidance gives the specialist a usable frame for drafting the “why this is not 5(1)(f)” memo when a workplace system’s scope is ambiguous.

The one-paragraph prohibition memo

For every system that runs any screen yielding prohibited unless exception, the specialist drafts a one-paragraph memo defending the “not prohibited” classification. The memo follows a fixed structure:

1. System identifier and intended purpose.
2. Article 5 sub-paragraph considered.
3. The specific element of the prohibition the system does not meet (e.g., “not a public authority” for 5(1)(c); “not solely profiling” for 5(1)(d)).
4. The factual basis for that element (who operates the system, what inputs it uses, what other factors inform the output).
5. Reassessment trigger (the change that would require reopening the memo).

The memo is short by design. Long memos that attempt to defend a borderline use case with elaborate legal argument are a warning sign; if the defence requires more than one paragraph, the specialist should escalate to legal counsel rather than try to resolve the question in the classification workflow.

Diagram — StageGateFlow

This article uses a StageGateFlow figure that opens the prohibition screen as the first stage before any classification activity begins. Stages: intake → Article 5 screen (eight parallel checks) → prohibited? If yes, decommission / do not deploy; if no, advance to Article 6 classification (see Article 3 of this credential). The figure is continued in Article 3 of this credential — the two articles share a single decision-tree image so the specialist has one integrated reference.

Cross-references

• EATF-Level-1/M1.5-Art14-EU-AI-Act-Risk-Categories-and-Your-Organization.md — risk-category framework foundation that places the prohibition tier in the four-tier architecture.
• EATF-Level-1/M1.5-Art06-AI-Ethics-Operationalized.md — ethics operationalisation precedes the legal-prohibition screen and gives the specialist the vocabulary to discuss borderline cases with non-legal stakeholders.
• EATF-Level-1/M1.5-Art04-AI-Risk-Identification-and-Classification.md — risk-identification foundation that situates prohibition screening within the broader risk workflow.
• Article ID 253 “EU AI Act Risk Classification: A Practitioner’s Guide” in regulatory-compliance-articles.ts — practitioner-level summary of the four-tier framework including the prohibition tier.

Learning outcomes — confirm

A specialist who completes this article should be able to:

• Explain each of the eight Article 5 prohibition categories in plain language with the sub-paragraph citation.
• Classify at least twelve described systems against the eight-category screen, defending each outcome with an Article 5 sub-paragraph anchor.
• Evaluate three borderline cases using the February 2025 Commission guidelines on prohibited practices as the interpretive anchor.
• Design a one-paragraph prohibition memo for a given system’s “not prohibited” classification.

Quality rubric — self-assessment

Publish threshold per design doc §16.5 is 85. This article meets the threshold.