Already Banned: The AI Practices Europe Prohibited Eighteen Months Ago
Article 5 has been in force since February 2025, with penalties to 35M EUR or 7% of turnover. The working table: banned vs high-risk vs transparency-only.
Article 5's prohibitions have been in force since 2025-02-02, and the penalty regime behind them, up to 35 million euros or 7% of worldwide turnover, has applied since 2025-08-02 (Art 113(3)(b)).
Article 5 of the AI Act names the practices Europe classifies as unacceptable risk. They are worth reading in plain language, because several of them hide inside ordinary vendor features:
- Manipulation. Subliminal or deliberately manipulative techniques that distort behaviour and cause significant harm.
- Exploitation of vulnerabilities. Systems that prey on a specific group's age, disability, or situation to distort their behaviour.
- Social scoring. Evaluating people on social behaviour or personal traits across contexts, leading to detrimental treatment.
- Profiling-based crime prediction. Assessing the risk that a person will commit an offence based on profiling or personality traits.
- Untargeted facial scraping. Building facial-recognition databases by scraping faces from the internet or CCTV without targeting.
- Emotion recognition in the workplace and in schools. Inferring the emotions of employees or students, outside narrow medical or safety exceptions. This one matters: "engagement analytics" and "wellbeing monitoring" features in HR and productivity suites can sit exactly here.
- Sensitive-trait biometric categorization. Inferring race, political opinions, religion, sexual orientation, or similar traits from biometric data.
- Real-time remote biometric identification by law enforcement in public spaces, outside narrow, defined exceptions.
One more obligation shipped on the same date. Article 4 requires providers and deployers to ensure a sufficient level of AI literacy in the staff who operate or oversee these systems. There is no certificate scheme and no defined curriculum; the duty is simply enforceable, which makes evidence of some structured training the practical floor.
The Correction Table: Banned, High-Risk, or Transparency-Only
The distinction between the tiers decides the workload, so this is the working version for common workplace practices:
| Practice | Tier | Status and date |
|---|---|---|
| Emotion recognition on employees (wellbeing or engagement scoring) | Prohibited, Art 5 | Banned since 2025-02-02 |
| Social scoring of customers or citizens | Prohibited, Art 5 | Banned since 2025-02-02 |
| Scraping faces to build a recognition database | Prohibited, Art 5 | Banned since 2025-02-02 |
| AI screening of CVs and job applications | High-risk, Annex III point 4 | Obligations apply from 2027-12-02. GDPR Art 22 already applies today. |
| AI tools for task allocation, promotion, or termination decisions | High-risk, Annex III point 4 | Obligations apply from 2027-12-02 |
| Credit scoring | High-risk, Annex III | Obligations apply from 2027-12-02 |
| Customer-facing chatbot | Transparency, Art 50 | Must present itself as a machine, in force since 2026-08-02 |
| Publishing deepfake or synthetic media | Transparency, Art 50 | Visible label required, in force since 2026-08-02 |
| Meeting summaries, internal drafting assistance | Minimal risk | No specific duty |
The CV row deserves the closest read. AI-assisted recruitment screening sits in Annex III point 4: high-risk, legal with obligations. Risk management, data governance, technical documentation, logging, human oversight, accuracy and robustness controls from the provider, and deployer duties around competent oversight, relevant input data, log retention, and informing workers. Those obligations arrive on 2027-12-02, and GDPR Article 22 on automated decisions already applies to screening stacks today, so the waiting position is smaller than it looks.
What We Would Do This Month
Three moves, in order. First, the vendor sweep: anything that scores mood, engagement, or personality gets checked against Article 5. Second, the employment register: every AI use that touches employment decisions, written down and dated, each with its deadline attached. Third, an AI-literacy pass for the staff who operate these systems, with evidence kept.
On the literacy point, our bias is hands-on. We built and contributed Basileak to OWASP, an intentionally vulnerable model with a six-stage capture-the-flag, precisely so teams can learn prompt injection by doing it against a system that is supposed to fail. Our DojoLM evaluation platform, whose community source is public on GitHub, carries 544 CI-verified attack patterns for the same reason: the aim is literacy that survives contact with a real system.
For completeness: Basileak is a training target rather than a defensive product, DojoLM's source is public while its packages are not yet on npm, and nothing here is legal advice; it is an engineer's reading of the text, with article numbers attached so counsel can check it.
Sources: Regulation (EU) 2024/1689, Arts 4, 5, 26, 99, 113, Annex III; GDPR Art 22; Regulation (EU) 2026/1744. Basileak: owasp.community/projects/basileak, accepted 2026-04-24. DojoLM: github.com/BlackUnicornSecurity/DojoLM, public since 2026-07-31. Legal information, not legal advice.