EU AI Act (Regulation (EU) 2024/1689) Prohibited practices

The prohibited practices target AI uses that create unacceptable risk to health, safety, or fundamental rights. The core logic is not whether the model is advanced. It is whether the use case distorts autonomy, exploits vulnerability, creates abusive surveillance or categorisation, or applies AI in especially harmful law enforcement or social control settings.

This is why the screening must focus on actual use context, affected persons, and downstream actions rather than only on model type.

The practical screening list should include the categories most likely to surface in design or procurement. These include manipulative or deceptive systems, exploitation of vulnerability, social scoring, certain individual criminal offence risk assessments based only on profiling or personality traits, untargeted scraping of facial images from the internet or CCTV to create facial recognition databases, and biometric categorisation that infers sensitive attributes.

The Act also prohibits certain emotion recognition uses in workplace and education settings and tightly restricts real time remote biometric identification in public spaces for law enforcement, subject to narrow exception pathways.

The gate should run early in product design, at procurement for external systems, and again on material changes. It should ask a short set of hard questions on affected persons, vulnerable groups, biometric features, decision consequences, and deception or manipulation risk. If any answer is high concern, the feature should not progress without formal review.

This works best when product, legal, risk, and security review together. Article 5 issues are usually visible in the intended purpose, the data strategy, the user journey, or the target deployment environment.

Evidence for Article 5 should be simple and clear. Keep the screening result, the facts reviewed, the people who approved the decision, and any design changes made because of the review. If the use case is rejected, keep the rejection record too. That is proof that the control actually works.

Escalation should be mandatory where biometrics, vulnerable groups, law enforcement use, education, workplace monitoring, or synthetic manipulation of public audiences is involved.