Article 5 is the shortest route to the largest fine in the AI Act, and it was the first part of the Regulation to apply. It lists eight practices that may not be placed on the market, put into service or used, whatever the risk classification and whoever the deployer is. This article sets out the eight, the date, the exceptions that matter for a public body, and a point about tooling: why the right verdict from a screening on Art. 5 is "review", and never "pass".
The date
Under Art. 113(a), Chapters I and II of the Regulation applied from 2 February 2025. Chapter II is Art. 5. Chapter I includes Art. 4, the AI literacy duty. Everything in this article has therefore been live for well over a year at the time of writing, and there is no transitional period for a system already in use. The European Commission published guidelines on the prohibited practices in February 2025; they are non-binding but set out how the Commission reads each limb.
Penalties under Art. 99(3) for non-compliance with Art. 5 go up to EUR 35 million or 7 percent of total worldwide annual turnover, whichever is higher. Member States decide how fines apply to public authorities under Art. 99(8).
The eight practices
Art. 5(1)(a), subliminal and manipulative techniques. Systems that deploy subliminal techniques beyond a person's consciousness, or purposefully manipulative or deceptive techniques, that materially distort behaviour and cause or are reasonably likely to cause significant harm.
Art. 5(1)(b), exploiting vulnerabilities. Systems that exploit vulnerabilities due to age, disability or a specific social or economic situation to distort behaviour in a way that causes or is likely to cause significant harm.
Art. 5(1)(c), social scoring. Evaluating or classifying people over time based on their social behaviour or known, inferred or predicted personal characteristics, where the score leads to either or both of: detrimental treatment in social contexts unrelated to where the data was collected; or detrimental treatment that is unjustified or disproportionate to the behaviour. The ban applies to public and private actors alike.
Art. 5(1)(d), predicting criminal offending. Risk assessments of a person's likelihood of committing a criminal offence based solely on profiling or on personality traits. It does not cover systems that support a human assessment based on objective, verifiable facts directly linked to a criminal activity.
Art. 5(1)(e), facial recognition databases from scraping. Creating or expanding facial recognition databases through untargeted scraping of facial images from the internet or CCTV footage.
Art. 5(1)(f), emotion inference at work and in education. Inferring the emotions of a natural person in the workplace or in education institutions, except where the system is intended for medical or safety reasons.
Art. 5(1)(g), biometric categorisation by protected attributes. Categorising people on the basis of their biometric data to deduce race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation. Labelling or filtering of lawfully acquired biometric datasets, and categorisation in law enforcement, are carved out.
Art. 5(1)(h), real-time remote biometric identification for law enforcement. Use in publicly accessible spaces for law enforcement, with narrow exceptions for specific searches and threats, subject to prior authorisation and the conditions in Art. 5(2) to (7).
The two that public bodies most need to read carefully
Social scoring is the one most often misapplied in both directions. A benefits agency that scores applications from data relevant to the benefit, and uses the score only for that decision, is running an Annex III point 5(a) high-risk system. That is heavily regulated but not prohibited. The prohibition needs the score to travel: data collected in one context feeding treatment in an unrelated one, or treatment out of proportion to the behaviour scored. The two limbs are alternatives, so either one is enough to bring Art. 5(1)(c) into play.
Emotion inference is the one most likely to arrive unnoticed, inside a bought-in product. A call-centre tool that reports "caller frustration" to supervisors is inferring the emotions of the caller, not of staff, so Art. 5(1)(f) does not bite on the caller side; but a feature that scores staff on their tone in the same product is squarely inside the workplace prohibition. Read the feature list of anything that processes voice or faces.
A worked example
The fictional municipality of Larenmond procures a workforce-planning product for its contact centre. The vendor's brochure lists "agent wellbeing analytics: sentiment and stress detection from call audio". The codebase the vendor supplies for integration imports a facial-expression recognition library, apparently unused.
The screening should not say "prohibited practice". It should say: Art. 5(1)(f) is corroborated by two signals, a workplace deployment and an emotion-inference feature, plus a code hint pointing at the library, and a person must resolve it before go-live. The resolution is a factual question. If the stress detection is applied to staff, the feature must be switched off or the product not used, and the vendor asked to confirm in writing. If it is applied only to callers, Art. 5(1)(f) does not apply, but Art. 50(3) disclosure to callers does, and the GDPR has a great deal to say about processing voice for inferred emotional state. Either way the decision is recorded with a name on it.
Why "review" is the right verdict from a tool
Every Art. 5 prohibition applies to every deployer of an AI system. That is what a prohibition is. A tool that marked all eight as "applicable" findings for every project would be right and useless: the label would carry no information, and readers would learn to ignore it. A tool that marked them "pass" would be claiming something it cannot know, because whether a practice occurs is a fact about how the system is used, not about the answers to a questionnaire.
The defensible middle is a separation. A prohibition with nothing pointing at it is listed for written attestation: confirm that you do not do this, and sign. A prohibition with corroboration, from code that looks like the practice, from answers that name it, or from a reviewer who stopped to ask, is escalated to a review that must be resolved before use. Whether that separation is the right one for a regulator-facing report is a policy choice, and a tool should state it rather than bury it.
How Landfall helps
Landfall lists all eight Art. 5 prohibitions on every AI-Act project and separates the ones with corroboration from the ones that are attestation items. Corroboration comes from the codebase scan, which flags face-recognition and emotion-detection code with file and line, from answers that name the practice, such as emotion recognition in an employment or education deployment or either limb of social scoring, and from a reviewer marking a mapping as requiring review or rejecting it. Only a corroborated row moves the risk tier to "prohibited practice, review required", and the CI decision check fails on that tier until a person resolves it. The rule is stated in the report so a reader can disagree with it knowingly.