EU AI Act Prohibited AI Practices Explained

The European Union AI Act strictly bans specific AI technologies deemed an unacceptable risk to fundamental rights, human safety, and ethical standards. Under Article 5 of the EU AI Act, banned AI practices include cognitive behavioral manipulation, social scoring, predictive policing based solely on profiling, untargeted biometric scraping, and emotion recognition in workplaces and schools. Violating these prohibitions can trigger severe financial penalties of up to €35 million or 7% of global annual turnover. Implementing an AI Management System aligned with ISO/IEC 42001 helps organizations systematically understand their context, run impact assessments, and ensure non-compliant, prohibited AI applications are never developed or deployed.

What is the Unacceptable Risk Tier in the EU AI Act?

The EU AI Act uses a risk-based framework to regulate artificial intelligence. At the top of this regulatory pyramid sits the unacceptable risk category. Systems falling into this classification pose clear threats to core democratic values, dignity, and fundamental human rights protected under EU law.

Unlike high-risk AI systems—which are permitted provided they pass strict conformity assessments—prohibited AI practices are banned outright across all EU member states, with only narrow, tightly regulated law enforcement exceptions.

Breakdown of Banned AI Practices Under Article 5

Article 5 of the EU AI Act details eight distinct categories of banned AI practices that organizations must avoid:

• Subliminal and Deceptive Manipulation: AI systems that deploy subliminal, manipulative, or deceptive techniques designed to distort human behavior and impair informed decision-making, resulting in significant harm.
• Exploitation of Vulnerabilities: AI tools engineered to exploit specific vulnerabilities related to age, disability, or socio-economic circumstances to materially distort behavior and cause harm.
• Social Scoring Systems: Public or private AI applications that evaluate or classify individuals based on social behavior or predicted personality traits, leading to detrimental or disproportionate treatment.
• Predictive Policing Profiling: Risk-assessment systems that evaluate an individual's likelihood of committing criminal offenses based solely on profiling or personality traits without objective, verifiable facts.
• Untargeted Facial Image Scraping: Creating or expanding facial recognition databases through the untargeted scraping of facial images from the internet or CCTV footage.
• Workplace and Educational Emotion Recognition: Deploying AI to infer human emotions in workplace or educational settings, except when used for specific medical or safety reasons.
• Biometric Categorization of Sensitive Attributes: Biometric systems that categorize individuals to deduce sensitive traits, such as political opinions, trade union membership, religious beliefs, race, or sexual orientation.
• Real-Time Remote Biometric Identification (RBI): The use of real-time RBI in publicly accessible spaces for law enforcement, except under specific, judicial-approved exemptions (e.g., targeted searches for missing persons or preventing immediate terrorist threats).

Fines and Penalties for Deploying Prohibited AI

The European Union has established steep consequences for organizations that ignore these boundaries. Violating Article 5 prohibitions carries the maximum penalty under the AI Act:

• Fines up to €35 million or 7% of total worldwide annual turnover for the preceding financial year, whichever is higher.

Because upstream vendors or third-party components can introduce prohibited functionality, organizations must establish end-to-end operational transparency.

Preventing Banned AI Deployments with ISO/IEC 42001

Ensuring your enterprise never develops, purchases, or deploys prohibited AI requires structured corporate governance. Adopting the ISO/IEC 42001 standard for AI Management Systems (AIMS) provides a clear governance structure to catch compliance issues early:

• Clause 4 (Context of the Organization): Helps organizations define their specific role (provider, deployer, or importer) and map regulatory boundaries directly into internal policies.
• Clause 6 (Planning) & Annex A.5 (Impact Assessment): Mandates rigorous impact assessments evaluating potential consequences for individuals, groups, and society before building or buying AI.
• Annex A.6 (AI Life Cycle) & A.9 (Use of AI Systems): Establishes baseline guardrails across the entire development and deployment pipeline to prevent unintended manipulative behaviors or unauthorized biometric data processing.
• Annex A.10 (Third-Party and Customer Relationships): Guarantees proper due diligence so third-party AI models do not introduce unacceptable risk features into your tech stack.

To ensure your organization stays clear of unacceptable risk tiers and builds certification-ready AI processes, evaluate your system with DoAIRight’s free readiness assessment. While accredited certification bodies grant formal ISO/IEC 42001 certification following independent audits, DoAIRight gives you the tools and insights needed to achieve compliance confidence.