Prohibited practices and transparency obligations

This page gives Article 5 (prohibited AI practices) and Article 50 (transparency obligations) of the EU AI Act, Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI). Article 5 prohibits specified AI practices. Article 50 gives transparency duties to providers and deployers of specified AI systems. The high-risk classification in Article 6 is a different test, and one AI system can be subject to more than one of these tests.

Scope and dates

Article 2 of the EU AI Act gives the scope for providers, deployers and the other actors, and the exclusions from that scope (see the scope in Article 2).

Article 2(2) of the EU AI Act excludes Articles 5 and 50 for Article 6(1) high-risk systems related to products covered by Annex I Section B legislation (see Article 2 scope).

Article 5 applies from 2 February 2025, its new prohibitions from 2 December 2026, and Article 50 from 2 August 2026 (Article 113 dates).

Article 111(4) gives providers of older synthetic-content systems a transitional rule for Article 50(2). The Article 111(1) and (2) transitions do not change Article 5's application.

Article 5 — prohibited AI practices

Article 5 of the EU AI Act prohibits the AI practices in Article 5(1). Each point of Article 5(1) gives its own acts and its own conditions:

• Points (a), (b), (ba), (bb) and (c) prohibit the placing on the market, the putting into service or the use of the AI system.
• Points (d) to (g) prohibit the placing on the market, the putting into service "for this specific purpose", or the use of the AI system.
• Point (h) prohibits only the use of the AI system. Its exceptions have the conditions in Article 5(2) to (7).

No conformity assessment makes a prohibited practice lawful. Article 5 also does not change the prohibitions that apply when an AI practice infringes other Union law (Article 5(8)).

The Commission guidelines on prohibited AI practices (C(2025) 5052 final, 29 July 2025) give the Commission interpretation of the initial Article 5(1), points (a) to (h). These guidelines are not binding (paragraph (5)). See Commission guidance on prohibited AI practices.

Article 5(1) starts with this text:

The following AI practices shall be prohibited:

Article 5(1)(a) — subliminal, manipulative or deceptive techniques

Point (a) of Article 5(1) of the EU AI Act prohibits this practice:

(a) the placing on the market, the putting into service or the use of an AI system that deploys subliminal techniques beyond a person’s consciousness or purposefully manipulative or deceptive techniques, with the objective, or the effect of materially distorting the behaviour of a person or a group of persons by appreciably impairing their ability to make an informed decision, thereby causing them to take a decision that they would not have otherwise taken in a manner that causes or is reasonably likely to cause that person, another person or group of persons significant harm;

Article 5(1)(b) — exploitation of vulnerabilities

Point (b) of Article 5(1) of the EU AI Act prohibits this practice:

(b) the placing on the market, the putting into service or the use of an AI system that exploits any of the vulnerabilities of a natural person or a specific group of persons due to their age, disability or a specific social or economic situation, with the objective, or the effect, of materially distorting the behaviour of that person or a person belonging to that group in a manner that causes or is reasonably likely to cause that person or another person significant harm;

Article 5(1)(ba) and (bb) — intimate material and child sexual abuse material

Regulation (EU) 2026/1744 added points (ba) and (bb) to Article 5(1) of the EU AI Act. These points, and Article 5(1a) and (1b), apply from 2 December 2026. Points (ba) and (bb) prohibit these practices:

(ba) the placing on the market, the putting into service or the use of an AI system that generates or manipulates realistic images, videos, audio or similar material of an identifiable natural person’s intimate parts, or of an identifiable natural person engaged in sexually explicit activities, without that person’s freely-given, specific, informed, unambiguous and explicit consent for that generation or manipulation;

(bb) the placing on the market, the putting into service or the use of an AI system that generates or manipulates material or performance within the meaning of Article 2, points (c) and (e), of Directive 2011/93/EU, except where a ‘without right’ defence applies under national law;

Article 5(1a) limits the two prohibitions:

1a. For the purposes of paragraph 1, first subparagraph, points (ba) and (bb):

(a) the placing on the market or putting into service of an AI system that generates or manipulates the material or performance referred to in paragraph 1, first subparagraph, point (ba) or (bb) is only prohibited where:

(i) that generation or manipulation is the intended purpose of the AI system; or

(ii) the system’s design, training, architecture, capabilities or user-facing functionalities make that generation or manipulation a reasonably foreseeable and reproducible outcome, without requiring significant technical modification, and the system does not have reasonable and adequate technical safety measures and other safeguards to reliably prevent that generation or manipulation, taking into account reasonably foreseeable misuse, and to correct observed or reported misuse;

(b) the use of an AI system that generates or manipulates the material or performance referred to in paragraph 1, first subparagraph, points (ba) and (bb) is only prohibited where the deployer uses the system for the purpose of generating or manipulating such material or performance.

Thus, Article 5(1a) prohibits the placing on the market and the putting into service only in the two cases in point (a). It prohibits the use only when the deployer uses the system to generate or manipulate that material or performance.

Article 5(1b) limits the word "manipulation" in point (ba):

1b. For the purposes of paragraph 1, first subparagraph, point (ba), an AI system that manipulates material in a way that does not increase the exposure of any depicted intimate parts or alter the nature of any depicted sexually explicit activities shall not constitute manipulation.

Article 5(1)(c) — social scoring

Point (c) of Article 5(1) of the EU AI Act prohibits this practice:

(c) the placing on the market, the putting into service or the use of AI systems for the evaluation or classification of natural persons or groups of persons over a certain period of time based on their social behaviour or known, inferred or predicted personal or personality characteristics, with the social score leading to either or both of the following:

(i) detrimental or unfavourable treatment of certain natural persons or groups of persons in social contexts that are unrelated to the contexts in which the data was originally generated or collected;

(ii) detrimental or unfavourable treatment of certain natural persons or groups of persons that is unjustified or disproportionate to their social behaviour or its gravity;

Point (c) does not limit the prohibition to public authorities.

Article 5(1)(d) — individual criminal-offense risk prediction

Point (d) of Article 5(1) of the EU AI Act prohibits this practice:

(d) the placing on the market, the putting into service for this specific purpose, or the use of an AI system for making risk assessments of natural persons in order to assess or predict the risk of a natural person committing a criminal offence, based solely on the profiling of a natural person or on assessing their personality traits and characteristics; this prohibition shall not apply to AI systems used to support the human assessment of the involvement of a person in a criminal activity, which is already based on objective and verifiable facts directly linked to a criminal activity;

The exception in point (d) applies only to an AI system that supports a human assessment. That human assessment must be "already based on objective and verifiable facts directly linked to a criminal activity".

Article 5(1)(e) — untargeted facial-image scraping

Point (e) of Article 5(1) of the EU AI Act prohibits this practice:

(e) the placing on the market, the putting into service for this specific purpose, or the use of AI systems that create or expand facial recognition databases through the untargeted scraping of facial images from the internet or CCTV footage;

Article 5(1)(f) — emotion recognition in workplace and education

Point (f) of Article 5(1) of the EU AI Act prohibits this practice:

(f) the placing on the market, the putting into service for this specific purpose, or the use of AI systems to infer emotions of a natural person in the areas of workplace and education institutions, except where the use of the AI system is intended to be put in place or into the market for medical or safety reasons;

Point (f) applies only in the areas of workplace and education institutions. Its only exception is for AI systems that are intended for use "for medical or safety reasons". When point (f) does not prohibit an emotion recognition system, Article 50(3) can apply to its deployer (see Article 50(3)).

Article 5(1)(g) — sensitive biometric categorization

Point (g) of Article 5(1) of the EU AI Act prohibits this practice:

(g) the placing on the market, the putting into service for this specific purpose, or the use of biometric categorisation systems that categorise individually natural persons based on their biometric data to deduce or infer their race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation; this prohibition does not cover any labelling or filtering of lawfully acquired biometric datasets, such as images, based on biometric data or categorizing of biometric data in the area of law enforcement;

Point (g) does not apply to these two activities:

• The labeling or filtering of lawfully acquired biometric datasets, such as images, based on biometric data. This exclusion is not only for law enforcement.
• The categorizing of biometric data in the area of law enforcement.

The Commission guidelines on prohibited AI practices give this interpretation: the first exclusion also applies in law enforcement (paragraphs (284) and (286)).

Article 5(1)(h) — real-time remote biometric identification in publicly accessible spaces

Point (h) of Article 5(1) of the EU AI Act prohibits this practice:

(h) the use of ‘real-time’ remote biometric identification systems in publicly accessible spaces for the purposes of law enforcement, unless and in so far as such use is strictly necessary for one of the following objectives:

(i) the targeted search for specific victims of abduction, trafficking in human beings or sexual exploitation of human beings, as well as the search for missing persons;

(ii) the prevention of a specific, substantial and imminent threat to the life or physical safety of natural persons or a genuine and present or genuine and foreseeable threat of a terrorist attack;

(iii) the localisation or identification of a person suspected of having committed a criminal offence, for the purpose of conducting a criminal investigation or prosecution or executing a criminal penalty for offences referred to in Annex II and punishable in the Member State concerned by a custodial sentence or a detention order for a maximum period of at least four years.

The second subparagraph of Article 5(1) adds this rule:

Point (h) of the first subparagraph is without prejudice to Article 9 of Regulation (EU) 2016/679 for the processing of biometric data for purposes other than law enforcement.

Point (h) prohibits only the use. The three objectives in point (h) are the only exceptions. Each use for one of these objectives must also comply with the conditions in Article 5(2) to (7).

Post-remote biometric identification is not in Article 5. Article 26(10) gives different conditions to deployers of high-risk AI systems for post-remote biometric identification (see Article 26).

Article 5(2)–(7) — conditions for real-time remote biometric identification

Article 5(2) to (7) of the EU AI Act give the conditions for real-time remote biometric identification in publicly accessible spaces for law enforcement. These conditions apply to each use for one of the objectives in point (h). They are part of Article 5, and they apply from 2 February 2025.

Purpose, elements and prerequisites, Article 5(2):

• The use is permitted only "to confirm the identity of the specifically targeted individual".
• The use must "take into account" these two elements:
  • "the nature of the situation giving rise to the possible use, in particular the seriousness, probability and scale of the harm that would be caused if the system were not used"
  • "the consequences of the use of the system for the rights and freedoms of all persons concerned, in particular the seriousness, probability and scale of those consequences"
• The use must comply with the "necessary and proportionate safeguards and conditions" in the national law that authorizes the use. These include "the temporal, geographic and personal limitations".
• The use can be authorized only after the law enforcement authority completes a fundamental rights impact assessment (Article 27) and registers the system in the EU database (Article 49).
• In "duly justified cases of urgency", the use can start before the registration in the EU database. The registration must then be completed "without undue delay".

For these two provisions, see Article 27 and Article 49.

Authorization of each use, Article 5(3):

• Each use needs a prior authorization from a judicial authority, or from an independent administrative authority that makes binding decisions. The authority is in the Member State where the use is to occur.
• The authority issues the authorization on a reasoned request, in accordance with the detailed rules of national law in Article 5(5).
• In "a duly justified situation of urgency", the use can start without an authorization, "provided that such authorisation is requested without undue delay, at the latest within 24 hours".
• If the authority rejects the authorization, the use must stop immediately. All the data, and the results and outputs of that use, must be "immediately discarded and deleted".
• The authority grants the authorization only on "objective evidence or clear indications presented to it". This evidence must show that the use is necessary for, and proportionate to, one of the point (h) objectives in the reasoned request.
• The use must also stay "limited to what is strictly necessary concerning the period of time as well as the geographic and personal scope".
• When the authority makes a decision on the reasoned request, it must "take into account" the elements in Article 5(2).
• A decision that produces an adverse legal effect on a person must not be based only on the output of the system.

Notification of each use, Article 5(4): without prejudice to Article 5(3), each use must be notified to two authorities. These are the "relevant market surveillance authority" and the national data protection authority. The notification follows the national rules in Article 5(5). The minimum content of the notification is the information in Article 5(6). The notification must not include sensitive operational data.

National law, Article 5(5):

• A Member State can make it possible in its national law "to fully or partially authorise" this use. The limits and conditions of point (h) and Article 5(2) and (3) apply.
• That Member State must then give, in its national law, the "necessary detailed rules for the request, issuance and exercise of, as well as supervision and reporting relating to, the authorisations".
• These rules must also specify the objectives in point (h) for which the competent authorities can be authorized to use these systems. They must also specify the criminal offenses in point (h)(iii) for which this use is possible.
• The Member State must notify these rules to the Commission "at the latest 30 days following the adoption thereof".
• Member States can introduce, in accordance with Union law, "more restrictive laws on the use of remote biometric identification systems".

National annual reports, Article 5(6). The national authorities that received notifications of use in Article 5(4) must send annual reports on that use to the Commission. These are the national market surveillance authorities and the national data protection authorities. The Commission gives them a template. The template includes the number of decisions on authorizations in Article 5(3) and their result.

Commission annual reports, Article 5(7): the Commission must publish annual reports on this use. These reports use aggregated data in Member States, from the Article 5(6) reports. They must not include sensitive operational data of the related law enforcement activities.

Article 50 — transparency obligations

Article 50 of the EU AI Act gives transparency duties to providers and deployers of specified AI systems. Each paragraph has its own actor, conditions and exceptions:

Provision	Actor	AI system	Duty
Article 50(1)	Provider	AI system intended to interact directly with natural persons	Make sure that the system is "designed and developed in such a way" that the persons are informed that they interact with an AI system
Article 50(2)	Provider	AI system that generates synthetic audio, image, video or text content, general-purpose AI systems included	Mark the outputs in a machine-readable format, and make them detectable as artificially generated or manipulated
Article 50(3)	Deployer	Emotion recognition system or biometric categorization system	Inform the exposed natural persons of the operation of the system, and process the personal data as Article 50(3) requires
Article 50(4), first subparagraph	Deployer	AI system that generates or manipulates image, audio or video content that is a deep fake	Disclose that the content is artificially generated or manipulated
Article 50(4), second subparagraph	Deployer	AI system that generates or manipulates text published to inform the public on matters of public interest	Disclose that the text is artificially generated or manipulated

Article 50(5) gives the rules on when and how to give the information in all four paragraphs. Article 50(1) to (4) do not change the requirements and obligations in Chapter III. They are also "without prejudice to other transparency obligations laid down in Union or national law for deployers of AI systems" (Article 50(6)).

Thus, a high-risk AI system can also have Article 50 duties, and an AI system can have Article 50 duties when it is not high-risk. Article 2(2) excludes Article 50 for the Section B systems in Scope and dates. The EU AI Act has no category with the name "limited risk": Article 50 applies its own tests.

Compliance with Article 50 does not show that the EU AI Act permits the use. An AI system in scope of Article 50 can also be prohibited by Article 5. An example is emotion recognition in the workplace (Article 5(1)(f)).

The 20 July 2026 Communication (C(2026) 5054 final) approves the content of draft Article 50 guidelines, applicable only after formal adoption when all language versions are available.

Article 50(1) — provider disclosure of AI interaction

Article 50(1) of the EU AI Act gives this duty to providers:

Providers shall ensure that AI systems intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI system, unless this is obvious from the point of view of a natural person who is reasonably well-informed, observant and circumspect, taking into account the circumstances and the context of use. This obligation shall not apply to AI systems authorised by law to detect, prevent, investigate or prosecute criminal offences, subject to appropriate safeguards for the rights and freedoms of third parties, unless those systems are available for the public to report a criminal offence.

Article 50(1) applies to how the AI system is "designed and developed". It has two exceptions:

• The interaction is obvious to a natural person who is "reasonably well-informed, observant and circumspect", in the circumstances and the context of use.
• The AI system is authorized by law to detect, prevent, investigate or prosecute criminal offenses, subject to "appropriate safeguards for the rights and freedoms of third parties". This exception does not apply when the system is available for the public to report a criminal offense.

Article 50(2) — provider marking of synthetic content

Article 50(2) of the EU AI Act gives this duty to providers:

Providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content, shall ensure that the outputs of the AI system are marked in a machine-readable format and detectable as artificially generated or manipulated. Providers shall ensure their technical solutions are effective, interoperable, robust and reliable as far as this is technically feasible, taking into account the specificities and limitations of various types of content, the costs of implementation and the generally acknowledged state of the art, as may be reflected in relevant technical standards. This obligation shall not apply to the extent the AI systems perform an assistive function for standard editing or do not substantially alter the input data provided by the deployer or the semantics thereof, or where authorised by law to detect, prevent, investigate or prosecute criminal offences.

Article 50(2) also applies to text content, and its last sentence gives three exceptions. For AI systems placed on the market before 2 August 2026, Article 111(4) gives the provider until 2 December 2026 (see Scope and dates).

Article 50(3) — deployer disclosure of emotion recognition and biometric categorization

Article 50(3) of the EU AI Act gives this duty to deployers:

Deployers of an emotion recognition system or a biometric categorisation system shall inform the natural persons exposed thereto of the operation of the system, and shall process the personal data in accordance with Regulations (EU) 2016/679 and (EU) 2018/1725 and Directive (EU) 2016/680, as applicable. This obligation shall not apply to AI systems used for biometric categorisation and emotion recognition, which are permitted by law to detect, prevent or investigate criminal offences, subject to appropriate safeguards for the rights and freedoms of third parties, and in accordance with Union law.

The duty in Article 50(3) has two parts. The deployer must inform the exposed persons. The deployer must also process the personal data in accordance with the data protection law that Article 50(3) names, as applicable. The exception names the detection, prevention and investigation of criminal offenses. It does not name their prosecution.

Article 50(3) does not make a prohibited use lawful. Article 5(1)(f) prohibits emotion recognition in the areas of workplace and education institutions, with an exception for medical or safety reasons. Article 5(1)(g) prohibits biometric categorization that infers the sensitive attributes in that point.

Article 50(4) — deployer disclosure of deep fakes and AI-generated text

Article 50(4) of the EU AI Act gives these duties to deployers:

Deployers of an AI system that generates or manipulates image, audio or video content constituting a deep fake, shall disclose that the content has been artificially generated or manipulated. This obligation shall not apply where the use is authorised by law to detect, prevent, investigate or prosecute criminal offence. Where the content forms part of an evidently artistic, creative, satirical, fictional or analogous work or programme, the transparency obligations set out in this paragraph are limited to disclosure of the existence of such generated or manipulated content in an appropriate manner that does not hamper the display or enjoyment of the work.

Deployers of an AI system that generates or manipulates text which is published with the purpose of informing the public on matters of public interest shall disclose that the text has been artificially generated or manipulated. This obligation shall not apply where the use is authorised by law to detect, prevent, investigate or prosecute criminal offences or where the AI-generated content has undergone a process of human review or editorial control and where a natural or legal person holds editorial responsibility for the publication of the content.

Article 3(60) gives this definition:

‘deep fake’ means AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful;

Article 50(4) has two duties:

• Deep fakes — the first subparagraph. The duty does not apply when the use is authorized by law to detect, prevent, investigate or prosecute a criminal offense. Content can be part of an "evidently artistic, creative, satirical, fictional or analogous work or programme". For that content, the duty is "limited to disclosure of the existence of such generated or manipulated content". The deployer gives this disclosure "in an appropriate manner that does not hamper the display or enjoyment of the work".
• Text on matters of public interest — the second subparagraph. The duty does not apply when the use is authorized by law to detect, prevent, investigate or prosecute criminal offenses. The duty also does not apply when the two conditions that follow are satisfied. First, the AI-generated content has undergone "a process of human review or editorial control". Second, a natural or legal person holds editorial responsibility for the publication of the content.

Article 50(1) and (2) give duties to providers, and Article 50(3) and (4) give duties to deployers. Thus, for one AI system that generates deep fakes, the provider can have the Article 50(2) duty. The deployer can have the Article 50(4) duty. Each duty has its exceptions.

Article 50(5) — disclosure time and accessibility

Article 50(5) of the EU AI Act applies to the information in Article 50(1) to (4):

The information referred to in paragraphs 1 to 4 shall be provided to the natural persons concerned in a clear and distinguishable manner at the latest at the time of the first interaction or exposure. The information shall conform to the applicable accessibility requirements.

Article 50(5) does not name the applicable accessibility requirements.

Article 50(7) — codes of practice

Article 50(7) of the EU AI Act tells the Commission to encourage codes of practice at Union level. These codes are for the detection, marking and labeling of artificially generated or manipulated content. The Commission assesses if adherence to a code is "adequate" for compliance with Article 50(2) and (4), with the procedure in Article 56(6). It takes "utmost account" of the opinion of the Board. If the Commission deems a code inadequate, it can adopt an implementing act that specifies "common rules" for these obligations.

The Code of Practice on Transparency of AI-Generated Content was published on 10 June 2026 (Commission Opinion C(2026) 4839 final, paragraph (1)). In that Opinion of 8 July 2026, the Commission found that the Code "adequately covers the obligations provided for in Articles 50(2), (4) and (5) AI Act". The Opinion also gives this limit: "adherence to the Code does not constitute conclusive evidence of compliance with these obligations" (paragraph (52)). The AI Board found the same for Sections 1 and 2 of the Code.

Codes of practice are voluntary (Opinion, paragraph (8)). The Code is not a part of the EU AI Act, and it is a different document from the draft Commission guidelines on Article 50. For the Code and the guidelines, see Commission guidance on Article 50 transparency obligations.

High-risk classification

Providers use Article 6 of the EU AI Act to assess if an AI system is high-risk.

Modulos

For EU AI Act work in Modulos, see the setup decisions and the Requirement table.

Related information

• EU AI Act overview: the scope, dates, penalties and the status of Commission guidance.
• Roles and responsibilities: Article 2 scope, the Article 3 actors, and deployer obligations in Article 26.
• High-risk AI systems: Article 6 classification, the requirements for high-risk AI systems, and Article 27.
• General-purpose AI models: Chapter V obligations of providers of general-purpose AI models.
• Commission guidance on prohibited AI practices: the Commission interpretation of the initial Article 5(1), points (a) to (h).
• Commission guidance on Article 50 transparency obligations: the draft Commission guidelines on Article 50 and the Code of Practice.
• Operationalizing in Modulos: the Frameworks, the setup decisions, and the Requirement table.
• EU AI Act and GDPR: how the EU AI Act and the GDPR compare.
• Frequently asked questions: short answers about the EU AI Act, with links to the full rules.

Sources

• Regulation (EU) 2024/1689 (EU AI Act), consolidated version of 27 July 2026: Articles 2(2), 3(60), 5, 6, 26(10), 27, 49, 50, 111 and 113. EUR-Lex.
• Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal of 24 July 2026: the amendments to Articles 5, 50(7) and 111. EUR-Lex.
• Commission guidelines on prohibited AI practices, C(2025) 5052 final, 29 July 2025: paragraphs (5), (284) and (286). Commission.
• Communication to the Commission C(2026) 5054 final, 20 July 2026: approval of the content of the draft guidelines on Article 50. Commission.
• Code of Practice on Transparency of AI-Generated Content, 10 June 2026. Commission.
• Commission Opinion C(2026) 4839 final, 8 July 2026, on the assessment of the Code: paragraphs (1), (8) and (52). Commission.
• AI Board assessment of the Code, published on 9 July 2026. Commission.

Disclaimer

This page gives general information. It is not legal advice.