The eight prohibited AI practices under Article 5, and the exceptions written into them

Article 5 of the EU AI Act, Regulation (EU) 2024/1689, prohibits eight AI practices outright. If your system falls within one of them, it cannot lawfully be placed on the EU market, put into service, or used, regardless of any risk controls you attach to it. But 4 of the 8 prohibitions contain a limit or exception written directly into the text, and the eighth carries a detailed authorization regime in Articles 5(2) and 5(3), so read the full wording before you conclude a system is banned or safe.

How the prohibitions are worded

Watch the framing of each point. Points (a) to (c) prohibit "the placing on the market, the putting into service or the use" of the system. Points (d) to (g) prohibit placing on the market, "the putting into service for this specific purpose," or the use. Point (h) prohibits only "the use." That difference matters when you are deciding whether you are the party the prohibition reaches.

Here is the map before the detail.

Point	Practice	Exception in the text?
(a)	Subliminal, manipulative or deceptive techniques causing significant harm	No
(b)	Exploiting vulnerabilities due to age, disability, or social or economic situation	No
(c)	Social scoring leading to specified detrimental treatment	No, but conditional on outcomes
(d)	Predicting criminal offense risk based solely on profiling or personality traits	Yes
(e)	Untargeted scraping of facial images to build facial recognition databases	No
(f)	Emotion inference in workplaces and education institutions	Yes
(g)	Biometric categorization inferring protected characteristics	Yes
(h)	Real-time remote biometric identification in public spaces for law enforcement	Yes, with conditions

(a) Subliminal, manipulative or deceptive techniques

The threshold here is cumulative, so quote it rather than summarize it:

"an AI system that deploys subliminal techniques beyond a person's consciousness or purposefully manipulative or deceptive techniques, with the objective, or the effect of materially distorting the behaviour of a person or a group of persons by appreciably impairing their ability to make an informed decision, thereby causing them to take a decision that they would not have otherwise taken in a manner that causes or is reasonably likely to cause that person, another person or group of persons significant harm"

Note that the distortion can be the system's objective or merely its effect, and that the harm can fall on the manipulated person, another person, or a group. The text writes in no exception.

(b) Exploiting vulnerabilities

Point (b) prohibits a system that exploits the vulnerabilities of a natural person or a specific group due to their age, disability, or a specific social or economic situation. As with point (a), the exploitation must have the objective or the effect of materially distorting that person's behavior in a manner that causes or is reasonably likely to cause significant harm to that person or another person. No exception is written in.

(c) Social scoring

Point (c) prohibits systems that evaluate or classify natural persons or groups over a certain period of time based on their social behavior or their known, inferred, or predicted personal or personality characteristics. The prohibition only bites where the social score leads to either or both of two outcomes:

1. Detrimental or unfavorable treatment in social contexts unrelated to the contexts in which the data was originally generated or collected.
2. Detrimental or unfavorable treatment that is unjustified or disproportionate to the social behavior or its gravity.

There is no separate exception. The condition is the outcome: a score that produces neither of those treatments is not caught by this point.

(d) Predicting criminal offenses from profiling

Point (d) prohibits systems that make risk assessments of natural persons in order to assess or predict the risk of a person committing a criminal offense, where the assessment is based solely on profiling or on assessing personality traits and characteristics.

The carve-out is in the same sentence. The prohibition does not apply to AI systems used to support the human assessment of a person's involvement in criminal activity, where that human assessment is already based on objective and verifiable facts directly linked to a criminal activity. Two words carry the weight: "solely" in the prohibition, and "support" in the carve-out.

(e) Untargeted scraping for facial recognition databases

Point (e) prohibits systems that create or expand facial recognition databases through the untargeted scraping of facial images from the internet or from CCTV footage. No exception is written in.

(f) Emotion inference at work and in education

Point (f) prohibits systems that infer the emotions of a natural person in the areas of the workplace and education institutions. The exception is narrow: the prohibition does not apply where the use of the system is intended to be put in place or into the market for medical or safety reasons.

(g) Biometric categorization of protected characteristics

Point (g) prohibits biometric categorization systems that categorize individual natural persons based on their biometric data to deduce or infer their race, political opinions, trade union membership, religious or philosophical beliefs, sex life, or sexual orientation.

The text carves out two things: labeling or filtering of lawfully acquired biometric datasets, such as images, based on biometric data; and categorizing of biometric data in the area of law enforcement.

(h) Real-time remote biometric identification for law enforcement

Point (h) prohibits the use of real-time remote biometric identification systems in publicly accessible spaces for the purposes of law enforcement, unless and in so far as the use is strictly necessary for one of three objectives:

1. The targeted search for specific victims of abduction, trafficking in human beings, or sexual exploitation of human beings, and the search for missing persons.
2. The prevention of a specific, substantial and imminent threat to the life or physical safety of natural persons, or a genuine and present or genuine and foreseeable threat of a terrorist attack.
3. Locating or identifying a person suspected of a criminal offense, for the purpose of a criminal investigation, prosecution, or executing a criminal penalty, for offenses listed in Annex II and punishable in the Member State concerned by a custodial sentence or detention order with a maximum period of at least 4 years.

The Article adds that point (h) is without prejudice to Article 9 of Regulation (EU) 2016/679 for processing biometric data for purposes other than law enforcement.

The Article 5(2) safeguards

Falling within one of the three objectives is not enough. Under Article 5(2), the system may be deployed only to confirm the identity of the specifically targeted individual, and the use must take into account two elements: the nature of the situation, in particular the seriousness, probability, and scale of the harm if the system were not used; and the consequences of the use for the rights and freedoms of all persons concerned, again by seriousness, probability, and scale.

The use must also comply with necessary and proportionate safeguards under the national law authorizing it, in particular temporal, geographic, and personal limitations. The law enforcement authority must have completed a fundamental rights impact assessment under Article 27 and registered the system in the EU database under Article 49. In duly justified cases of urgency, use may begin before registration, provided registration is completed without undue delay.

The Article 5(3) authorization

Each use requires prior authorization from a judicial authority or an independent administrative authority whose decision is binding, in the Member State where the use takes place, issued on a reasoned request under national law. In a duly justified situation of urgency, use may begin without authorization, provided the authorization is requested without undue delay and at the latest within 24 hours. If the authorization is rejected, the use stops with immediate effect and all data, results, and outputs are immediately discarded and deleted.

The authority may grant authorization only where it is satisfied, on objective evidence or clear indications, that the use is necessary for and proportionate to one of the point (h) objectives, and remains limited to what is strictly necessary in time, geographic scope, and personal scope. One final rule sits at the end of paragraph 3: no decision that produces an adverse legal effect on a person may be taken based solely on the output of the system.

The rest of the Article, briefly

Paragraph 4 requires each use to be notified to the relevant market surveillance authority and the national data protection authority, without sensitive operational data. Paragraph 5 makes the whole regime an opt-in: a Member State may decide to authorize real-time biometric identification within these limits, must lay down detailed national rules, must notify them to the Commission within 30 days of adoption, and may adopt more restrictive laws. Paragraphs 6 and 7 create an annual reporting chain from national authorities to the Commission and from the Commission to the public. Paragraph 8 states that the Article does not affect prohibitions that apply where an AI practice infringes other Union law.

For the AIGP, this material sits in Domain II, and competency II.C, understanding the main elements of AI-specific laws, carries 6 to 8 of the 100 items on the exam. You need to be able to say which of the 8 practices carry a written exception and which do not, state the three objectives that can justify real-time biometric identification, and recall the conditions that Articles 5(2) and 5(3) attach to that use, including the 24-hour urgency window. Learn the exceptions as carefully as the prohibitions, because the Article gives equal weight to both.