The CRA's 24-hour reporting duty has applied since 11 September 2026. Check whether it reaches you
Start the system

The AI Act: dates, tool and articles

AI Act prohibited practices: two new bans from 2 December 2026

Article 5 of Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744, read in the Official Journal on 18 October 2026

Article 5 lists the ten practices no plan makes lawful. Two are new from 2 December 2026: intimate images made without consent, and child sexual abuse material. Article 5(1a) narrows both, so a general-purpose model whose safeguards work is outside them.

Who it applies to
Every provider and deployer of an AI system in the Union, whatever its risk class.
The dates
Points (a) to (h) since 2 February 2025. Points (ba) and (bb) from 2 December 2026.
The one thing to do
Answer for each practice. Stop any that is prohibited, and keep the evidence for any that Article 5(1a) excludes.

Ten practices, three possible readings

Answer for what the system does and what it is used for. Not sure keeps a question open. Nothing you pick leaves this page.

Article 5(1)(a)Does it use subliminal, manipulative or deceptive techniques that distort people's decisions in a way likely to cause significant harm?
The Regulation's words

the placing on the market, the putting into service or the use of an AI system that deploys subliminal techniques beyond a person’s consciousness or purposefully manipulative or deceptive techniques, with the objective, or the effect of materially distorting the behaviour of a person or a group of persons by appreciably impairing their ability to make an informed decision, thereby causing them to take a decision that they would not have otherwise taken in a manner that causes or is reasonably likely to cause that person, another person or group of persons significant harm;

Article 5(1)(b)Does it exploit people's age, disability or social or economic situation to distort their behaviour in a way likely to cause significant harm?
The Regulation's words

the placing on the market, the putting into service or the use of an AI system that exploits any of the vulnerabilities of a natural person or a specific group of persons due to their age, disability or a specific social or economic situation, with the objective, or the effect, of materially distorting the behaviour of that person or a person belonging to that group in a manner that causes or is reasonably likely to cause that person or another person significant harm;

Article 5(1)(ba)From 2 December 2026Can it generate or manipulate realistic intimate or sexually explicit images, video or audio of an identifiable person without their explicit consent?
The Regulation's words

the placing on the market, the putting into service or the use of an AI system that generates or manipulates realistic images, videos, audio or similar material of an identifiable natural person’s intimate parts, or of an identifiable natural person engaged in sexually explicit activities, without that person’s freely-given, specific, informed, unambiguous and explicit consent for that generation or manipulation;

Article 5(1)(bb)From 2 December 2026Can it generate or manipulate child sexual abuse material?
The Regulation's words

the placing on the market, the putting into service or the use of an AI system that generates or manipulates material or performance within the meaning of Article 2, points (c) and (e), of Directive 2011/93/EU, except where a “without right” defence applies under national law;

Article 5(1a)Does the ban reach this system?
The Regulation's words

1a. For the purposes of paragraph 1, first subparagraph, points (ba) and (bb): (a) the placing on the market or putting into service of an AI system that generates or manipulates the material or performance referred to in paragraph 1, first subparagraph, point (ba) or (bb) is only prohibited where: (i) that generation or manipulation is the intended purpose of the AI system; or (ii) the system’s design, training, architecture, capabilities or user-facing functionalities make that generation or manipulation a reasonably foreseeable and reproducible outcome, without requiring significant technical modification, and the system does not have reasonable and adequate technical safety measures and other safeguards to reliably prevent that generation or manipulation, taking into account reasonably foreseeable misuse, and to correct observed or reported misuse; (b) the use of an AI system that generates or manipulates the material or performance referred to in paragraph 1, first subparagraph, points (ba) and (bb) is only prohibited where the deployer uses the system for the purpose of generating or manipulating such material or performance.

Article 5(1)(c)Does it score people on their social behaviour or personal traits, leading to unjustified or unrelated detrimental treatment?
The Regulation's words

the placing on the market, the putting into service or the use of AI systems for the evaluation or classification of natural persons or groups of persons over a certain period of time based on their social behaviour or known, inferred or predicted personal or personality characteristics, with the social score leading to either or both of the following: (i) detrimental or unfavourable treatment of certain natural persons or groups of persons in social contexts that are unrelated to the contexts in which the data was originally generated or collected; (ii) detrimental or unfavourable treatment of certain natural persons or groups of persons that is unjustified or disproportionate to their social behaviour or its gravity;

Article 5(1)(d)Does it predict whether a person will commit a crime from profiling or personality traits alone?
The Regulation's words

the placing on the market, the putting into service for this specific purpose, or the use of an AI system for making risk assessments of natural persons in order to assess or predict the risk of a natural person committing a criminal offence, based solely on the profiling of a natural person or on assessing their personality traits and characteristics; this prohibition shall not apply to AI systems used to support the human assessment of the involvement of a person in a criminal activity, which is already based on objective and verifiable facts directly linked to a criminal activity;

Article 5(1)(e)Does it build or expand a facial recognition database by untargeted scraping of images from the internet or CCTV?
The Regulation's words

the placing on the market, the putting into service for this specific purpose, or the use of AI systems that create or expand facial recognition databases through the untargeted scraping of facial images from the internet or CCTV footage;

Article 5(1)(f)Does it infer the emotions of people at work or in education, for a reason other than medical or safety?
The Regulation's words

the placing on the market, the putting into service for this specific purpose, or the use of AI systems to infer emotions of a natural person in the areas of workplace and education institutions, except where the use of the AI system is intended to be put in place or into the market for medical or safety reasons;

Article 5(1)(g)Does it categorise people from biometric data to infer their race, politics, union membership, beliefs, sex life or sexual orientation?
The Regulation's words

the placing on the market, the putting into service for this specific purpose, or the use of biometric categorisation systems that categorise individually natural persons based on their biometric data to deduce or infer their race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation; this prohibition does not cover any labelling or filtering of lawfully acquired biometric datasets, such as images, based on biometric data or categorizing of biometric data in the area of law enforcement;

Article 5(1)(h)Is it used for real-time remote biometric identification in public spaces for law enforcement, outside the three objectives point (h) allows?
The Regulation's words

the use of ‘real-time’ remote biometric identification systems in publicly accessible spaces for the purposes of law enforcement, unless and in so far as such use is strictly necessary for one of the following objectives: (i) the targeted search for specific victims of abduction, trafficking in human beings or sexual exploitation of human beings, as well as the search for missing persons; (ii) the prevention of a specific, substantial and imminent threat to the life or physical safety of natural persons or a genuine and present or genuine and foreseeable threat of a terrorist attack; (iii) the localisation or identification of a person suspected of having committed a criminal offence, for the purpose of conducting a criminal investigation or prosecution or executing a criminal penalty for offences referred to in Annex II and punishable in the Member State concerned by a custodial sentence or a detention order for a maximum period of at least four years.

The reading

Answer the questions

The reading appears here, with a line for each practice you answer yes.

Prohibited: stop the practice

A prohibited practice is not a gap with a deadline. No plan, standard or assessment makes it lawful. Stop it, and take the system off the market or out of service if it is there.

Unsettled: Article 5(1a) decides it

Being able to produce the material is not prohibited by itself. The ban bites if producing it is the system's purpose, or a reproducible outcome it has no adequate safeguards against. Answer that before relying on either reading.

Excluded by Article 5(1a)

The system can produce the material, but that is neither its purpose nor an outcome it fails to prevent, so the ban does not reach it. Keep the safeguards working, and keep the evidence that they work.

Nothing prohibited so far

Some questions are still open, and a Not sure counts as open. Answer them before you rely on the reading.

None of the ten

None of the practices Article 5 prohibits is in your answers. Record the reading with its date, because a new feature or a new use can change it.

  • Article 5(1)(a) Never deploy subliminal or manipulative techniquesProhibited
  • Article 5(1)(b) Never exploit age, disability or social needProhibited
  • Article 5(1)(ba) Never generate intimate images without consentProhibitedUnsettledExcluded
  • Article 5(1)(bb) Never generate child sexual abuse materialProhibitedUnsettledExcluded
  • Article 5(1)(c) Never score people sociallyProhibited
  • Article 5(1)(d) Never predict crime from personality aloneProhibited
  • Article 5(1)(e) Never scrape faces to build a recognition databaseProhibited
  • Article 5(1)(f) Never infer emotions at work or schoolProhibited
  • Article 5(1)(g) Never infer race, beliefs or sex life from biometricsProhibited
  • Article 5(1)(h) Never run real-time face recognition in publicProhibited
Keep the AI Act record

No card to start · cancel in-app anytime

The screening, the high-risk check and the obligations that follow, in one workspace, with the dates they come back.

Regulation (EU) 2024/1689, Article 5(1), (1a) and (1b), and Article 113, point (a), as amended by Regulation (EU) 2026/1744. Read on 18 October 2026.

Article 5 at a glance

The prohibited practices, the two new points, who they reach and the fine, with the source of each line
QuestionAnswerSource
Points (a) to (h)Prohibited since 2 February 2025.Article 113, point (a)
Points (ba) and (bb)Prohibited from 2 December 2026, together with Article 5(1a) and (1b).Article 113, point (a), as amended
A provider of a generatorWithin the ban only if producing the material is the system's intended purpose, or a reproducible outcome it lacks reasonable and adequate safeguards to prevent and correct.Article 5(1a), point (a)
A deployerWithin the ban only where it uses the system for the purpose of producing the material.Article 5(1a), point (b)
What counts as safeguardsMeasures such as refusal training, output controls, prompt guardrails, content filtering, abuse detection and notice and action, if they match the state of the art and demonstrably work.Recital 12 of Regulation (EU) 2026/1744
Editing existing intimate materialNot manipulation if it does not increase exposure or change the activity shown, such as changing a background or the brightness.Article 5(1b)
The fineUp to €35,000,000 or 7% of worldwide annual turnover, whichever is higher. For an SME, whichever is lower.Article 99(3) and (6)

StandardOS reads Article 5 in the Official Journal's words, as amended by Regulation (EU) 2026/1744. A screen is a reading of your answers, and it is not legal advice.

Questions about the prohibitions

Does the ban on intimate images cover every image generator?

No. Article 5(1a) limits points (ba) and (bb). A provider is within them only if producing the material is the system's purpose, or a reproducible outcome it has no reasonable and adequate safeguards against. A general-purpose model whose safeguards work is outside. Recital 12 of Regulation (EU) 2026/1744 says the ban should not stop providers developing the capability itself.

When do the new prohibitions apply?

From 2 December 2026, together with Article 5(1a) and (1b). Regulation (EU) 2026/1744 inserted them and amended Article 113 to give them that date. The other eight points have applied since 2 February 2025.

What counts as reasonable and adequate safeguards?

Recital 12 of Regulation (EU) 2026/1744 names data cleaning, refusal training, prompt and output controls, runtime guardrails, content filtering, usage restrictions, abuse detection, and notice and action. They count as adequate if they match the state of the art and demonstrably prevent the material, or sufficiently reduce its likelihood, allowing for foreseeable misuse.

We only use an image generator. Can the ban reach us?

Only if you use it to produce such material. Article 5(1a), point (b), limits the ban on use to that purpose. Recital 12 of Regulation (EU) 2026/1744 adds that accidental generation is outside it, and so is lawful use of a system whose provider left out the safeguards.

What is the fine for a prohibited practice?

Up to €35,000,000 or 7% of total worldwide annual turnover for the preceding financial year, whichever is higher (Article 99(3)). For an SME or a start-up it is whichever is lower (Article 99(6)). Member States lay down the rest of the penalties.

Does excluded mean nothing applies to a generator?

No. Article 5 is out of the way, and Article 50 still applies: a provider marks generated content in a machine-readable way, and a deployer discloses deep fakes. Other law applies as well, criminal law included (recital 15 of Regulation (EU) 2026/1744).

Why three readings

Points (ba) and (bb) are the only prohibitions that turn on the system's safeguards as well as on what it does. A yes to the capability is where the reading of them starts.

If nothing here is prohibited, the next question is whether the system is high-risk. Is your system high-risk?

Article 50: the transparency dutiesEN 18286, the AI Act's first harmonised standardThe AI Act: dates, tool and articlesEvery free tool and template

Sources, read on 18 October 2026: Regulation (EU) 2024/1689 on EUR-Lex, Regulation (EU) 2026/1744 on EUR-Lex. This page reads the Regulation and the act that amends it. It is not legal advice.

This page in:DeutschFrançaisNederlandsEspañolDansk