Regulation Tracker / EU AI Act / Chapter II

Article 5
Prohibited AI practices

Chapter II — Prohibited AI practices. 20 distinct duties, powers or definitions are coded from this article, applying from 2025-02-02 and 2026-12-02. 13 reach legal practice directly.

Amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI), in force 2026-07-27 — about 750 words changed. The text below is the consolidated version of 27 July 2026; the 2024 text and the amending regulation are on EUR-Lex.

official text: EUR-Lex (consolidated 27 Jul 2026) · text © European Union (Decision 2011/833/EU) · coding CC BY 4.0 · data: obligations.json · Hugging Face · GitHub

The text

1. The following AI practices shall be prohibited:

(a)the placing on the market, the putting into service or the use of an AI system that deploys subliminal techniques beyond a person’s consciousness or purposefully manipulative or deceptive techniques, with the objective, or the effect of materially distorting the behaviour of a person or a group of persons by appreciably impairing their ability to make an informed decision, thereby causing them to take a decision that they would not have otherwise taken in a manner that causes or is reasonably likely to cause that person, another person or group of persons significant harm;
(b)the placing on the market, the putting into service or the use of an AI system that exploits any of the vulnerabilities of a natural person or a specific group of persons due to their age, disability or a specific social or economic situation, with the objective, or the effect, of materially distorting the behaviour of that person or a person belonging to that group in a manner that causes or is reasonably likely to cause that person or another person significant harm;
(ba)the placing on the market, the putting into service or the use of an AI system that generates or manipulates realistic images, videos, audio or similar material of an identifiable natural person’s intimate parts, or of an identifiable natural person engaged in sexually explicit activities, without that person’s freely-given, specific, informed, unambiguous and explicit consent for that generation or manipulation;
(bb)the placing on the market, the putting into service or the use of an AI system that generates or manipulates material or performance within the meaning of Article 2, points (c) and (e), of Directive 2011/93/EU, except where a ‘without right’ defence applies under national law;
(c)the placing on the market, the putting into service or the use of AI systems for the evaluation or classification of natural persons or groups of persons over a certain period of time based on their social behaviour or known, inferred or predicted personal or personality characteristics, with the social score leading to either or both of the following: (i) detrimental or unfavourable treatment of certain natural persons or groups of persons in social contexts that are unrelated to the contexts in which the data was originally generated or collected; (ii) detrimental or unfavourable treatment of certain natural persons or groups of persons that is unjustified or disproportionate to their social behaviour or its gravity;
(d)the placing on the market, the putting into service for this specific purpose, or the use of an AI system for making risk assessments of natural persons in order to assess or predict the risk of a natural person committing a criminal offence, based solely on the profiling of a natural person or on assessing their personality traits and characteristics; this prohibition shall not apply to AI systems used to support the human assessment of the involvement of a person in a criminal activity, which is already based on objective and verifiable facts directly linked to a criminal activity;
(e)the placing on the market, the putting into service for this specific purpose, or the use of AI systems that create or expand facial recognition databases through the untargeted scraping of facial images from the internet or CCTV footage;
(f)the placing on the market, the putting into service for this specific purpose, or the use of AI systems to infer emotions of a natural person in the areas of workplace and education institutions, except where the use of the AI system is intended to be put in place or into the market for medical or safety reasons;
(g)the placing on the market, the putting into service for this specific purpose, or the use of biometric categorisation systems that categorise individually natural persons based on their biometric data to deduce or infer their race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation; this prohibition does not cover any labelling or filtering of lawfully acquired biometric datasets, such as images, based on biometric data or categorizing of biometric data in the area of law enforcement;
(h)the use of ‘real-time’ remote biometric identification systems in publicly accessible spaces for the purposes of law enforcement, unless and in so far as such use is strictly necessary for one of the following objectives: (i) the targeted search for specific victims of abduction, trafficking in human beings or sexual exploitation of human beings, as well as the search for missing persons; (ii) the prevention of a specific, substantial and imminent threat to the life or physical safety of natural persons or a genuine and present or genuine and foreseeable threat of a terrorist attack; (iii) the localisation or identification of a person suspected of having committed a criminal offence, for the purpose of conducting a criminal investigation or prosecution or executing a criminal penalty for offences referred to in Annex II and punishable in the Member State concerned by a custodial sentence or a detention order for a maximum period of at least four years.

1a. For the purposes of paragraph 1, first subparagraph, points (ba) and (bb):

(a)the placing on the market or putting into service of an AI system that generates or manipulates the material or performance referred to in paragraph 1, first subparagraph, point (ba) or (bb) is only prohibited where: (i) that generation or manipulation is the intended purpose of the AI system; or (ii) the system’s design, training, architecture, capabilities or user-facing functionalities make that generation or manipulation a reasonably foreseeable and reproducible outcome, without requiring significant technical modification, and the system does not have reasonable and adequate technical safety measures and other safeguards to reliably prevent that generation or manipulation, taking into account reasonably foreseeable misuse, and to correct observed or reported misuse;
(b)the use of an AI system that generates or manipulates the material or performance referred to in paragraph 1, first subparagraph, points (ba) and (bb) is only prohibited where the deployer uses the system for the purpose of generating or manipulating such material or performance.

1b. For the purposes of paragraph 1, first subparagraph, point (ba), an AI system that manipulates material in a way that does not increase the exposure of any depicted intimate parts or alter the nature of any depicted sexually explicit activities shall not constitute manipulation.

2. The use of ‘real-time’ remote biometric identification systems in publicly accessible spaces for the purposes of law enforcement for any of the objectives referred to in paragraph 1, first subparagraph, point (h), shall be deployed for the purposes set out in that point only to confirm the identity of the specifically targeted individual, and it shall take into account the following elements:

(a)the nature of the situation giving rise to the possible use, in particular the seriousness, probability and scale of the harm that would be caused if the system were not used;
(b)the consequences of the use of the system for the rights and freedoms of all persons concerned, in particular the seriousness, probability and scale of those consequences.

3. For the purposes of paragraph 1, first subparagraph, point (h) and paragraph 2, each use for the purposes of law enforcement of a ‘real-time’ remote biometric identification system in publicly accessible spaces shall be subject to a prior authorisation granted by a judicial authority or an independent administrative authority whose decision is binding of the Member State in which the use is to take place, issued upon a reasoned request and in accordance with the detailed rules of national law referred to in paragraph 5. However, in a duly justified situation of urgency, the use of such system may be commenced without an authorisation provided that such authorisation is requested without undue delay, at the latest within 24 hours. If such authorisation is rejected, the use shall be stopped with immediate effect and all the data, as well as the results and outputs of that use shall be immediately discarded and deleted.

4. Without prejudice to paragraph 3, each use of a ‘real-time’ remote biometric identification system in publicly accessible spaces for law enforcement purposes shall be notified to the relevant market surveillance authority and the national data protection authority in accordance with the national rules referred to in paragraph 5. The notification shall, as a minimum, contain the information specified under paragraph 6 and shall not include sensitive operational data.

5. A Member State may decide to provide for the possibility to fully or partially authorise the use of ‘real-time’ remote biometric identification systems in publicly accessible spaces for the purposes of law enforcement within the limits and under the conditions listed in paragraph 1, first subparagraph, point (h), and paragraphs 2 and 3. Member States concerned shall lay down in their national law the necessary detailed rules for the request, issuance and exercise of, as well as supervision and reporting relating to, the authorisations referred to in paragraph 3. Those rules shall also specify in respect of which of the objectives listed in paragraph 1, first subparagraph, point (h), including which of the criminal offences referred to in point (h)(iii) thereof, the competent authorities may be authorised to use those systems for the purposes of law enforcement. Member States shall notify those rules to the Commission at the latest 30 days following the adoption thereof. Member States may introduce, in accordance with Union law, more restrictive laws on the use of remote biometric identification systems.

6. National market surveillance authorities and the national data protection authorities of Member States that have been notified of the use of ‘real-time’ remote biometric identification systems in publicly accessible spaces for law enforcement purposes pursuant to paragraph 4 shall submit to the Commission annual reports on such use. For that purpose, the Commission shall provide Member States and national market surveillance and data protection authorities with a template, including information on the number of the decisions taken by competent judicial authorities or an independent administrative authority whose decision is binding upon requests for authorisations in accordance with paragraph 3 and their result.

7. The Commission shall publish annual reports on the use of real-time remote biometric identification systems in publicly accessible spaces for law enforcement purposes, based on aggregated data in Member States on the basis of the annual reports referred to in paragraph 6. Those annual reports shall not include sensitive operational data of the related law enforcement activities.

8. This Article shall not affect the prohibitions that apply where an AI practice infringes other Union law.

What it requires, coded

SafeLegalAI's reading of each duty in this article: who, what, from when, under which fine tier, and whether it reaches a firm, chambers, court or legal-AI vendor. Descriptive, not advice; the quoted words are the Regulation's.

Art. 5(1) (1a(a))Scope or definitionProhibited practicelegal practice
For the new intimate-material and child-sexual-abuse-material prohibitions, placing on the market or putting into service is prohibited only where generation or manipulation is intended or reasonably foreseeable and safeguards are inadequate.
"the placing on the market or putting into service of an AI system that generates or manipulates the material or performance referred to in paragraph 1, first subparagraph, point (ba) or (bb) is only prohibited where: (i) that generation or manipulation is the intended purpose of the AI system; or (ii) the system’s design, training, architecture, capabilities or user-facing functionalities"
Who
Provider, Any operator
From
2026-12-02 (Art. 113(a) as amended by Reg. (EU) 2026/1744)Inserted by Regulation (EU) 2026/1744, in force 2026-07-27.
Fine tier
Art. 99(3)
Legal practice
Reaches legal practice directly — Defines when legal-AI providers and vendors face the new Article 5(1)(ba) and (bb) market-placement prohibition.
See
Art. 5(1)(ba) · Art. 5(1)(bb) · Art. 99(3)
Art. 5(1) (1a(b))Scope or definitionProhibited practicelegal practice
For the new intimate-material and child-sexual-abuse-material prohibitions, use is prohibited only where the deployer uses the system for the purpose of generating or manipulating that material or performance.
"the use of an AI system that generates or manipulates the material or performance referred to in paragraph 1, first subparagraph, points (ba) and (bb) is only prohibited where the deployer uses the system for the purpose of generating or manipulating such material or performance."
Who
Deployer
From
2026-12-02 (Art. 113(a) as amended by Reg. (EU) 2026/1744)Inserted by Regulation (EU) 2026/1744, in force 2026-07-27.
Fine tier
Art. 99(3)
Legal practice
Reaches legal practice directly — Defines when law firms, courts, investigators or other legal deployers fall within the new use prohibition.
See
Art. 5(1)(ba) · Art. 5(1)(bb) · Art. 99(3)
Art. 5(1) (1b)Scope or definitionProhibited practice
For Article 5(1)(ba), manipulation does not include changes that do not increase exposure of depicted intimate parts or alter the nature of depicted sexually explicit activities.
"For the purposes of paragraph 1, first subparagraph, point (ba), an AI system that manipulates material in a way that does not increase the exposure of any depicted intimate parts or alter the nature of any depicted sexually explicit activities shall not constitute manipulation."
Who
Any operator
From
2026-12-02 (Art. 113(a) as amended by Reg. (EU) 2026/1744)Inserted by Regulation (EU) 2026/1744, in force 2026-07-27.
Fine tier
Art. 99(3)
Legal practice
Reaches legal-AI vendors or public bodies — Relevant to evidence handling, redaction or forensic image work where changes do not increase exposure or alter the sexual nature of depicted activity.
See
Art. 5(1)(ba) · Art. 99(3)
Art. 5(1) (a)ProhibitionProhibited practicelegal practice
Providers, deployers and other operators are prohibited from placing on the market, putting into service or using AI systems deploying subliminal, manipulative or deceptive techniques that materially distort decisions and cause or are likely to cause significant harm.
"the placing on the market, the putting into service or the use of an AI system that deploys subliminal techniques beyond a person’s consciousness or purposefully manipulative or deceptive techniques, with the objective, or the effect of materially distorting the behaviour of a person or a group of persons by appreciably impairing their ability to make an informed decision, thereby"
Who
Provider, Deployer, Any operator
From
2025-02-02 (Art. 113(a) as amended by Reg. (EU) 2026/1744)Art. 111(1)-(2) is without prejudice to Article 5 applying under Art. 113(a).
Fine tier
Art. 99(3)
Legal practice
Reaches legal practice directly — Client-facing or internal legal AI must not manipulate users, witnesses, consumers or staff into harmful decisions.
See
Art. 99(3)
Art. 5(1) (b)ProhibitionProhibited practicelegal practice
Providers, deployers and other operators are prohibited from AI systems that exploit vulnerabilities linked to age, disability or social or economic situation and materially distort behaviour causing or likely causing significant harm.
"the placing on the market, the putting into service or the use of an AI system that exploits any of the vulnerabilities of a natural person or a specific group of persons due to their age, disability or a specific social or economic situation, with the objective, or the effect, of materially distorting the behaviour of that person or a"
Who
Provider, Deployer, Any operator
From
2025-02-02 (Art. 113(a) as amended by Reg. (EU) 2026/1744)Art. 111(1)-(2) is without prejudice to Article 5 applying under Art. 113(a).
Fine tier
Art. 99(3)
Legal practice
Reaches legal practice directly — Legal services, courts and vendors must avoid AI that exploits vulnerable clients, litigants, witnesses, employees or consumers.
See
Art. 99(3)
Art. 5(1) (ba)ProhibitionProhibited practicelegal practice
Providers, deployers and other operators are prohibited from AI systems that generate or manipulate realistic intimate or sexually explicit material of identifiable natural persons without freely given, specific, informed, unambiguous and explicit consent.
"the placing on the market, the putting into service or the use of an AI system that generates or manipulates realistic images, videos, audio or similar material of an identifiable natural person’s intimate parts, or of an identifiable natural person engaged in sexually explicit activities, without that person’s freely-given, specific, informed, unambiguous and explicit consent for that generation or manipulation;"
Who
Provider, Deployer, Any operator
From
2026-12-02 (Art. 113(a) as amended by Reg. (EU) 2026/1744)Inserted by Regulation (EU) 2026/1744, in force 2026-07-27.
Fine tier
Art. 99(3)
Legal practice
Reaches legal practice directly — Legal practices and vendors must avoid tools that create non-consensual intimate material, including in evidence, investigations, employment or client-facing contexts.
See
Art. 99(3)
Art. 5(1) (bb)ProhibitionProhibited practicelegal practice
Providers, deployers and other operators are prohibited from AI systems that generate or manipulate child sexual abuse material or performances within Directive 2011/93/EU, except where a national-law without-right defence applies.
"the placing on the market, the putting into service or the use of an AI system that generates or manipulates material or performance within the meaning of Article 2, points (c) and (e), of Directive 2011/93/EU, except where a ‘without right’ defence applies under national law;"
Who
Provider, Deployer, Any operator
From
2026-12-02 (Art. 113(a) as amended by Reg. (EU) 2026/1744)Inserted by Regulation (EU) 2026/1744, in force 2026-07-27.
Fine tier
Art. 99(3)
Legal practice
Reaches legal practice directly — High relevance for legal, investigative and platform-advice contexts involving synthetic or manipulated child sexual abuse material.
See
Art. 99(3) · Directive 2011/93/EU
Art. 5(1) (c)ProhibitionProhibited practicelegal practice
Providers, deployers and other operators are prohibited from AI social-scoring systems that evaluate or classify people over time and lead to unrelated, unjustified or disproportionate detrimental treatment.
"the placing on the market, the putting into service or the use of AI systems for the evaluation or classification of natural persons or groups of persons over a certain period of time based on their social behaviour or known, inferred or predicted personal or personality characteristics, with the social score leading to either or both of the following: (i)"
Who
Provider, Deployer, Any operator
From
2025-02-02 (Art. 113(a) as amended by Reg. (EU) 2026/1744)Art. 111(1)-(2) is without prejudice to Article 5 applying under Art. 113(a).
Fine tier
Art. 99(3)
Legal practice
Reaches legal practice directly — Relevant to public bodies, courts or legal organisations considering reputation, risk or eligibility scoring of natural persons.
See
Art. 99(3)
Art. 5(1) (d)ProhibitionProhibited practicelegal practice
Providers, deployers and other operators are prohibited from AI systems making criminal-offence risk assessments based solely on profiling or personality traits, subject to the objective-facts support exception.
"the placing on the market, the putting into service for this specific purpose, or the use of an AI system for making risk assessments of natural persons in order to assess or predict the risk of a natural person committing a criminal offence, based solely on the profiling of a natural person or on assessing their personality traits and characteristics;"
Who
Provider, Deployer, Any operator
From
2025-02-02 (Art. 113(a) as amended by Reg. (EU) 2026/1744)Art. 111(1)-(2) is without prejudice to Article 5 applying under Art. 113(a).
Fine tier
Art. 99(3)
Legal practice
Reaches legal practice directly — Highly relevant to criminal-justice, court and law-enforcement legal contexts using risk assessment or decision-support tools.
See
Art. 99(3)
Art. 5(1) (e)ProhibitionProhibited practice
Providers, deployers and other operators are prohibited from AI systems that create or expand facial-recognition databases through untargeted scraping from the internet or CCTV footage.
"the placing on the market, the putting into service for this specific purpose, or the use of AI systems that create or expand facial recognition databases through the untargeted scraping of facial images from the internet or CCTV footage;"
Who
Provider, Deployer, Any operator
From
2025-02-02 (Art. 113(a) as amended by Reg. (EU) 2026/1744)Art. 111(1)-(2) is without prejudice to Article 5 applying under Art. 113(a).
Fine tier
Art. 99(3)
Legal practice
Reaches legal-AI vendors or public bodies — Relevant where legal teams, investigators or vendors might source biometric datasets for identification or evidence-related tools.
See
Art. 99(3)
Art. 5(1) (f)ProhibitionProhibited practicelegal practice
Providers, deployers and other operators are prohibited from AI systems to infer emotions in workplaces or educational institutions, except where the system is for medical or safety reasons.
"the placing on the market, the putting into service for this specific purpose, or the use of AI systems to infer emotions of a natural person in the areas of workplace and education institutions, except where the use of the AI system is intended to be put in place or into the market for medical or safety reasons;"
Who
Provider, Deployer, Any operator
From
2025-02-02 (Art. 113(a) as amended by Reg. (EU) 2026/1744)Art. 111(1)-(2) is without prejudice to Article 5 applying under Art. 113(a).
Fine tier
Art. 99(3)
Legal practice
Reaches legal practice directly — Direct for law firms, courts and legal departments as employers considering emotion-recognition tools for staff or training settings.
See
Art. 99(3)
Art. 5(1) (g)ProhibitionProhibited practicelegal practice
Providers, deployers and other operators are prohibited from biometric categorisation systems that infer sensitive traits such as race, political opinions, religion, sex life or sexual orientation.
"the placing on the market, the putting into service for this specific purpose, or the use of biometric categorisation systems that categorise individually natural persons based on their biometric data to deduce or infer their race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation; this prohibition does not cover any labelling or filtering of"
Who
Provider, Deployer, Any operator
From
2025-02-02 (Art. 113(a) as amended by Reg. (EU) 2026/1744)Art. 111(1)-(2) is without prejudice to Article 5 applying under Art. 113(a).
Fine tier
Art. 99(3)
Legal practice
Reaches legal practice directly — Relevant to legal AI, e-discovery or court/security tools that process biometric data about clients, staff, litigants or the public.
See
Art. 99(3)
Art. 5(1) (h)ProhibitionProhibited practicelegal practice
Law-enforcement use of real-time remote biometric identification in publicly accessible spaces is prohibited except where strictly necessary for the listed serious objectives.
"the use of ‘real-time’ remote biometric identification systems in publicly accessible spaces for the purposes of law enforcement, unless and in so far as such use is strictly necessary for one of the following objectives: (i) the targeted search for specific victims of abduction, trafficking in human beings or sexual exploitation of human beings, as well as the search for"
Who
Public-authority deployer
From
2025-02-02 (Art. 113(a) as amended by Reg. (EU) 2026/1744)Art. 111(1)-(2) is without prejudice to Article 5 applying under Art. 113(a).
Fine tier
Art. 99(3)
Legal practice
Reaches legal practice directly — Relevant to courts and legal oversight because use requires strict necessity and judicial or independent authorisation safeguards.
See
Art. 99(3)
Art. 5(2)RequirementProhibited practicelegal practice
Permitted law-enforcement use of real-time remote biometric identification must only confirm the specifically targeted individual and must account for the situation and rights-and-freedoms consequences.
"The use of ‘real-time’ remote biometric identification systems in publicly accessible spaces for the purposes of law enforcement for any of the objectives referred to in paragraph 1, first subparagraph, point (h), shall be deployed for the purposes set out in that point only to confirm the identity of the specifically targeted individual, and it shall take into account the"
Who
Public-authority deployer
From
2025-02-02 (Art. 113(a) as amended by Reg. (EU) 2026/1744)Art. 111(1)-(2) is without prejudice to Article 5 applying under Art. 113(a).
Fine tier
Art. 99(3)
Legal practice
Reaches legal practice directly — Courts and public bodies may be involved because this use requires strict safeguards and can affect fundamental rights.
See
Art. 5(1)(h) · Art. 99(3)
Art. 5(3)RequirementProhibited practicelegal practice
Each law-enforcement use of real-time remote biometric identification in publicly accessible spaces must receive prior judicial or independent administrative authorisation, with urgent-use limits and deletion if refused.
"For the purposes of paragraph 1, first subparagraph, point (h) and paragraph 2, each use for the purposes of law enforcement of a ‘real-time’ remote biometric identification system in publicly accessible spaces shall be subject to a prior authorisation granted by a judicial authority or an independent administrative authority whose decision is binding of the Member State in which the"
Who
Public-authority deployer, Other
From
2025-02-02 (Art. 113(a) as amended by Reg. (EU) 2026/1744)Art. 111(1)-(2) is without prejudice to Article 5 applying under Art. 113(a).
Fine tier
Art. 99(3)
Legal practice
Reaches legal practice directly — Directly relevant to judicial authorities or independent bodies that authorise biometric identification and to legal challenges to such use.
See
Art. 5(1)(h) · Art. 5(2) · Art. 99(3)
Art. 5(4)Cooperation with authoritiesProhibited practice
Each law-enforcement use of real-time remote biometric identification must be notified to the relevant market surveillance authority and national data protection authority under national rules, without sensitive operational data.
"Without prejudice to paragraph 3, each use of a ‘real-time’ remote biometric identification system in publicly accessible spaces for law enforcement purposes shall be notified to the relevant market surveillance authority and the national data protection authority in accordance with the national rules referred to in paragraph 5. The notification shall, as a minimum, contain the information specified under paragraph"
Who
Public-authority deployer, Market surveillance authority, National competent authority
From
2025-02-02 (Art. 113(a) as amended by Reg. (EU) 2026/1744)Art. 111(1)-(2) is without prejudice to Article 5 applying under Art. 113(a).
Fine tier
Art. 99(3)
Legal practice
Reaches legal-AI vendors or public bodies — Relevant to public-sector legal compliance and oversight of law-enforcement biometric deployments.
See
Art. 5(5) · Art. 5(6) · Art. 99(3)
Art. 5(5)Governance institutionalProhibited practice
Member States may authorise real-time remote biometric identification for law enforcement only within Article 5 limits, must set detailed national rules, notify the Commission and may impose stricter laws.
"A Member State may decide to provide for the possibility to fully or partially authorise the use of ‘real-time’ remote biometric identification systems in publicly accessible spaces for the purposes of law enforcement within the limits and under the conditions listed in paragraph 1, first subparagraph, point (h), and paragraphs 2 and 3. Member States concerned shall lay down in"
Who
Member State
From
2025-02-02 (Art. 113(a) as amended by Reg. (EU) 2026/1744)Art. 111(1)-(2) is without prejudice to Article 5 applying under Art. 113(a).
Legal practice
Reaches legal-AI vendors or public bodies — Relevant to national courts and lawyers because Member State authorising laws shape when biometric evidence or policing tools may be lawful.
See
Art. 5(1)(h) · Art. 5(2) · Art. 5(3)
Art. 5(6)MonitoringProhibited practice
Market surveillance and data protection authorities notified of law-enforcement real-time remote biometric identification use must submit annual reports to the Commission using its template.
"National market surveillance authorities and the national data protection authorities of Member States that have been notified of the use of ‘real-time’ remote biometric identification systems in publicly accessible spaces for law enforcement purposes pursuant to paragraph 4 shall submit to the Commission annual reports on such use. For that purpose, the Commission shall provide Member States and national market"
Who
Market surveillance authority, National competent authority, Commission
From
2025-02-02 (Art. 113(a) as amended by Reg. (EU) 2026/1744)Art. 111(1)-(2) is without prejudice to Article 5 applying under Art. 113(a).
Legal practice
Institutional — Institutional reporting can inform litigation, policy and public-sector oversight, but it is not a direct law-firm deployer duty.
See
Art. 5(4)
Art. 5(7)Governance institutionalProhibited practice
The Commission must publish annual aggregated reports on real-time remote biometric identification in publicly accessible spaces for law-enforcement purposes, excluding sensitive operational data.
"The Commission shall publish annual reports on the use of real-time remote biometric identification systems in publicly accessible spaces for law enforcement purposes, based on aggregated data in Member States on the basis of the annual reports referred to in paragraph 6. Those annual reports shall not include sensitive operational data of the related law enforcement activities."
Who
Commission
From
2025-02-02 (Art. 113(a) as amended by Reg. (EU) 2026/1744)Art. 111(1)-(2) is without prejudice to Article 5 applying under Art. 113(a).
Legal practice
Institutional — Public reporting may support legal analysis and accountability but does not directly regulate legal practices.
See
Art. 5(6)
Art. 5(8)Scope or definitionProhibited practice
Article 5 does not affect prohibitions that apply where an AI practice infringes other Union law.
"This Article shall not affect the prohibitions that apply where an AI practice infringes other Union law."
Who
Any operator
From
2025-02-02 (Art. 113(a) as amended by Reg. (EU) 2026/1744)Art. 111(1)-(2) is without prejudice to Article 5 applying under Art. 113(a).
Legal practice
Reaches legal-AI vendors or public bodies — Legal practices and vendors may face other Union-law prohibitions even where Article 5 is not the only applicable rule.

Cite

Regulation (EU) 2024/1689, Article 5 (Prohibited AI practices), as amended by Regulation (EU) 2026/1744, consolidated text of 27 July 2026, https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_5 — text © European Union; only the Official Journal is authentic. Coding: SafeLegalAI (published by Cognesio LLP), "EU AI Act, structured", safelegalai.com/regulation/eu-ai-act/article-5, accessed 2026-09-08, CC BY 4.0.

Article 5Prohibited AI practices

The text

What it requires, coded

Cite

Article 5
Prohibited AI practices