EU AI Act Article 5(1)(b) — Prohibition on exploiting vulnerabilities
AI systems that exploit vulnerabilities of specific groups — including children due to their age — to distort behaviour causing harm are prohibited
Where this comes from
Provision: Article 5(1)(b) — Prohibition on exploiting vulnerabilities
Instrument: EU Artificial Intelligence Act (Regulation (EU) 2024/1689)
Citation: Article 5(1)(b), Regulation (EU) 2024/1689
Text version: Regulation (EU) 2024/1689 (AI Act), OJ L, 12.7.2024
Who it applies to
AI system in scope of the Act (Art. 2) — all of these:
- Service deploys AI systems in a professional capacity
…unless:
- AI Act scope exclusion is used exclusively for military, defence or national-security purposes or developed and used solely for scientific research and development
- Art. 2(3): the Regulation 'does not apply to AI systems where and in so far as they are placed on the market, put into service, or used with or without modification exclusively for military, defence or national security purposes'. (AI Act Art. 2(3))
- Art. 2(6): the Regulation 'does not apply to AI systems or AI models, including their output, specifically developed and put into service for the sole purpose of scientific research and development'. (AI Act Art. 2(6))
Scope in the source's own terms
- Art. 2(1): the AI system is placed on the market or put into service in the Union, or the provider/deployer is established in the Union, or the output produced by the system is used in the Union
- Art. 5(1): the prohibition binds ANY actor that places the system on the market, puts it into service or uses it — provider, deployer, importer, distributor or authorised representative alike
- Art. 5(1)(b): the system's users include persons vulnerable 'due to their age' — children and young people are the paradigm case (Recital 29 also names disability and specific social or economic situations)
- Art. 5(1)(b): the system is used in a way capable of materially distorting the behaviour of that person or group in a manner that causes or is reasonably likely to cause significant harm
What engineering work it implies
Sample acceptance criteria Landfall generates for this obligation:
- Every AI system and material feature is checked against this prohibition and the result is recorded per system, with a date and an owner
- A signed attestation states that the practice is not present, naming who is accountable for it
- A design-review gate asks this question before a new AI feature ships, so a future introduction is caught rather than assumed away
- Where the prohibition carries a narrow exception, reliance on it is documented with the specific facts, not asserted generically
- Third-party and vendor AI components are covered by the same check, with the obligation flowed down contractually
Evidence an auditor expects
- Assessment documentDocument reviewReviewed on each material change to the system, its audience or its intended purpose
Prohibited-practice screening attestation for Art. 5(1)(b), covering vulnerability by age, disability and social or economic situation
Signed assessment recording which vulnerable groups the system reaches (age — including children; disability; specific social or economic situation) and whether it exploits that vulnerability so as to materially distort behaviour and cause or be reasonably likely to cause significant harm
- User-interface evidenceUser testing
Evidence of the experience actually presented to users in a vulnerable group
Screenshots or session recordings of the flows a child or other vulnerable user sees, showing the persuasive mechanics present and any age-differentiated treatment
Questions people ask
- Does EU AI Act Article 5(1)(b) — Prohibition on exploiting vulnerabilities apply to my service?
- It applies when Service deploys AI systems in a professional capacity. It does not apply where AI Act scope exclusion is used exclusively for military, defence or national-security purposes or developed and used solely for scientific research and development.
- When does this become enforceable?
- EU AI Act Article 5(1)(b) — Prohibition on exploiting vulnerabilities is enforceable from 2 February 2025. Its current status is: in force.
- What evidence does an auditor expect?
- Prohibited-practice screening attestation for Art. 5(1)(b), covering vulnerability by age, disability and social or economic situation; Evidence of the experience actually presented to users in a vulnerable group.
Find out whether this one lands on you
Landfall's pre-scan answers the applicability question above for your product in minutes, then turns every obligation that applies into traceable engineering tickets with a citation chain your auditors can follow.
Not legal advice. Landfall maps regulatory obligations to engineering work for planning purposes. Its verdicts are not legal advice and create no attorney-client relationship — verify with qualified counsel before relying on them.