Chapter 2 of 7 · 4 checks · 3 min
Prohibited practices
Article 5 bans a short list of practices outright. These apply already, and carry the highest fines, so screen every use case against them first.
Screen every AI use case against the Article 5 list and record the resultMust
Why it matters and how to check
Article 5(1) bans, among others: subliminal, manipulative or deceptive techniques that materially distort behaviour and cause or are likely to cause significant harm; exploiting vulnerabilities due to age, disability or social or economic situation; social scoring leading to unjustified or unrelated detrimental treatment; predicting criminal offence risk based solely on profiling or personality traits; untargeted scraping of facial images from the internet or CCTV to build facial recognition databases; emotion recognition in workplaces and education institutions except for medical or safety reasons; biometric categorisation to infer sensitive traits such as race, political opinions or sexual orientation; and real-time remote biometric identification in public spaces for law enforcement, with narrow exceptions.
To verify, each inventory row should carry a dated Article 5 screening signed off by its owner, with a short reason for each item that could plausibly apply.
Remove emotion inference from workplace and education featuresMust
Why it matters and how to check
Teams sometimes add sentiment or engagement scoring to employee monitoring, call-centre coaching or online proctoring without thinking of it as emotion recognition. Inferring the emotions of people in the workplace or in education institutions is prohibited, except where the system is intended for medical or safety reasons.
To verify, search your feature list and model prompts for words such as emotion, mood, engagement, stress, frustration or sentiment, and check whether any of them are applied to employees, candidates or students. Each match should either be removed, be clearly outside the ban, or have a documented medical or safety basis reviewed by counsel.
If you generate images, video or audio, block non-consensual intimate content and CSAMMust
Why it matters and how to check
The AI Omnibus added two prohibitions, points (ba) and (bb) of Article 5(1): generating or manipulating realistic images, video or audio of an identifiable person's intimate parts or sexually explicit activity without their explicit, informed consent, and generating or manipulating child sexual abuse material. Article 113 applies them from 2 December 2026. Under the new Article 5(1a), providers are covered where such generation is the intended purpose or a foreseeable, reproducible outcome without adequate safeguards.
To verify, run a red-team suite of requests for sexualised content of real or identifiable people against your generator and confirm every one is refused. Keep the suite as a regression test and document the safeguards in your technical file.
Review persuasion and personalisation features for manipulation riskShould
Why it matters and how to check
The manipulation ban targets techniques that materially distort a person's behaviour by impairing their ability to make an informed decision, causing significant harm. Dark-pattern style nudges driven by AI, especially toward children or financially vulnerable users, deserve a closer look. The Commission's guidelines on prohibited practices give worked examples of what falls inside and outside the ban.
To verify, list every feature where AI chooses what to show or say to persuade a user to buy, subscribe, stay or share. For each, record the target audience, the harm it could cause, and the reviewer's conclusion with reference to the guidelines.