Five of those eight are about the screen in your hand: the app that fought you when you tried to leave, the interview that watched your face. Article 5 of Regulation (EU) 2024/1689 — the EU AI Act — names eight prohibited AI practices, lettered (a) through (h), binding law since 2 February 2025. Most tech regulation tells companies what boxes to tick. Article 5 does the opposite: it publishes the catalogue. The other three prohibitions — untargeted scraping of faces off the internet, crime prediction based on profiling alone, and live remote biometric identification in public, each with narrow exceptions — mostly aim at police and governments. The five below are the ones you are most likely to meet on your own device.
The camera that reads your face
Article 5(1)(f) prohibits AI systems that infer a person's emotions — and the scope is exact. It applies in the workplace and in education institutions, with a carve-out for medical and safety uses. It is not a general ban on emotion AI everywhere. The emotion-recognition camera scoring a candidate's enthusiasm in a hiring interview, or a classroom system watching a student for "engagement," is what this targets. The reasoning is structural: work and school are the two places where a person cannot really say no. Refusing the camera and refusing the job, or refusing the camera and failing the course, are not real choices. The prohibition draws the line where consent stops being meaningful.
AI built for the soft target
Article 5(1)(b) prohibits AI that exploits vulnerabilities — not vulnerabilities in general, but specifically those tied to a person's age, a disability, or a particular social or economic situation, and only where the system materially distorts behaviour and causes significant harm. A child, an elderly user, someone with a disability, someone in financial distress: not a market segment to optimise against. Picture an app that detects a user is on a screen reader and then reorders a paid signup so the priciest plan is the default it reads out, while the cheaper option sits where assistive tech reaches it last. A worse deal, charged month after month, built to land on the people who can least afford a confusing screen. That is the shape of the prohibition — discrimination by interface rather than by policy.
The interface that plays you
Article 5(1)(a) prohibits AI systems that use subliminal, purposefully manipulative, or deceptive techniques — but only where they materially distort behaviour and cause, or are likely to cause, significant harm. An ordinary nudge does not cross that line, and a routine countdown timer does not cross it either. Picture instead a game whose AI learns the exact moment a player is most frustrated — a losing streak, a near-miss — and fires a one-tap paid offer to land precisely then. The player never sees the system at work; they just feel the urge to buy, and buy again. That is the line: not the timer shown to everyone, but an AI that learns when a particular user is weakest and meets that moment with something to buy, again and again, until it costs real money. Design, not coincidence.
"Article 5 does not ban AI. It bans five specific things AI is not allowed to do to you."
The score you never applied for
Article 5(1)(c) prohibits social scoring — an AI that evaluates a person's behaviour or personal characteristics over time and produces a reputation score. The prohibition is narrower than the popular shorthand suggests. What it catches is the score leading to detrimental treatment that is either carried into an unrelated context, or unjustified or disproportionate to the behaviour behind it. Just one of those is enough — the rule does not require both. And it binds private companies, not only governments. The loyalty engine that scores customers over months, then quietly routes some of them to slower service in an unrelated corner of the app, is the practice on the list. Recital 31 is what does the heavy lifting here: not every loyalty scheme, but one wired exactly like this. Not a Chinese-government scenario. A customer-tier algorithm in an app a person already has installed.
The software that guesses who you are
Article 5(1)(g) prohibits biometric categorisation that uses biometric data to deduce or infer protected characteristics — race, political opinions, trade-union membership, religious or philosophical beliefs, sex life, or sexual orientation. The user never filled in a form; the system inferred the label from a face and a body. Imagine uploading a selfie to unlock a feature, and the same scan quietly tagging the account with a likely religion and a likely sexual orientation — labels never typed, now sitting in a profile that can sort who sees which price or which job advert. The prohibition does not reach everything: labelling or filtering a dataset of biometric images that was lawfully obtained, and biometric categorisation in the law-enforcement context, sit outside it. What it does reach is the inference itself — the box a person would never tick on a form, assigned by the system anyway.
The other side of the Atlantic
The United States has no federal AI prohibition regime. The sequence is worth tracing exactly. In October 2023, Executive Order 14110 set out an AI safety agenda under the Biden administration. In January 2025, EO 14110 was revoked by EO 14148 — the new administration's order rescinding what it characterised as harmful executive actions. Two days later, EO 14179, "Removing Barriers to American Leadership in Artificial Intelligence," set a deregulation-first policy line in its place and ordered the drafting of an AI Action Plan. EO 14179 contains no revocation clause; the revocation is EO 14148's. In July 2025, "Winning the AI Race: America's AI Action Plan" was released — a policy strategy, not an EO or statute, aimed at removing barriers rather than writing prohibitions.
This is not "America does nothing." Individual states have moved — Colorado passed its own AI statute, and others are drafting. But a state law is a patchwork, not a federal floor. The contrast is not "no rules versus rules." It is one binding list that applies the same way in twenty-seven countries, versus fifty separate experiments and a federal framework that, as of spring 2026, is aimed at removing barriers rather than writing prohibitions. Concretely: the manipulative interface, the emotion-scanning interview, the silent reputation score — at the US federal level, not one of them sits on a prohibited list. Same software, same screen: on one side of the Atlantic a banned practice, on the other a roadmap item.
Already fineable
A common reflex is to ask whether any of this has teeth. Since 2 August 2025, by operation of Article 99 of the Regulation, a breach of one of these Article 5 prohibitions has been fineable: up to EUR 35 million or 7% of a company's worldwide annual turnover, whichever is larger. The day the clock started, every one of these five became a legal risk on a company's balance sheet, long before any regulator has to step in. A binding prohibition changes what companies build before any enforcement action is taken. That is the point of writing the list down.
Why this matters outside Europe
Regulation is boring until it changes the thing in front of you. One internet treats those five practices as product features to be tuned. The other has written them onto a list of things AI is not allowed to do — and started the clock. A reader watching this from the United States is not directly protected by Article 5; it protects an EU resident. What reaches the US reader instead is the product built once, to the strictest market it ships to — increasingly, the European one. Someone, somewhere, designed each of these five practices on purpose. Design is never neutral, and now there is a law that agrees.