What the AI Act prohibits from 2 December 2026 (and what an SME has to check)
28 October 2026 · Sources checked on 28 October 2026.
Article 5 of the EU AI Act (Regulation (EU) 2024/1689) lists the artificial intelligence practices that are prohibited in the Union. Most of them have applied since 2 February 2025. Regulation (EU) 2026/1744 (the "Digital Omnibus on AI"), published in the Official Journal on 24 July 2026, added two new points to paragraph 1 and two paragraphs that narrow them down, and gave all of them a date of their own: 2 December 2026 (Article 113, third paragraph, point (a)).
The prohibitions in Article 5 do not depend on the size of the company: they cover placing an AI system on the market, putting it into service or using it. An SME that only uses third-party tools (a "deployer", Article 3, point (4)) also uses those systems. This article summarises the official text as it applies today, with the point of each practice and the date from which it applies; it does not interpret and it does not constitute legal advice.
The ten points of Article 5(1), with their dates
| Point of Article 5(1) | What is prohibited (summary of the official text) | Applies from |
|---|---|---|
| (a) | AI systems that deploy subliminal techniques or purposefully manipulative or deceptive techniques to materially distort the behaviour of a person or a group, appreciably impairing their ability to make an informed decision, in a manner that causes or is reasonably likely to cause significant harm | 2 February 2025 |
| (b) | AI systems that exploit vulnerabilities due to age, disability or a specific social or economic situation to materially distort behaviour, causing or reasonably likely to cause significant harm | 2 February 2025 |
| (ba) | AI systems that generate or manipulate realistic images, videos, audio or similar material of an identifiable natural person's intimate parts, or of an identifiable natural person engaged in sexually explicit activities, without that person's freely-given, specific, informed, unambiguous and explicit consent for that generation or manipulation (added by Regulation (EU) 2026/1744) | 2 December 2026 |
| (bb) | AI systems that generate or manipulate material or performance within the meaning of Article 2, points (c) and (e), of Directive 2011/93/EU (sexual abuse and sexual exploitation of children and child pornography), except where a "without right" defence applies under national law (added by Regulation (EU) 2026/1744) | 2 December 2026 |
| (c) | AI systems that evaluate or classify persons or groups based on their social behaviour or personal characteristics, with a social score leading to detrimental or unfavourable treatment in unrelated social contexts, or treatment that is unjustified or disproportionate | 2 February 2025 |
| (d) | AI systems that assess or predict the risk of a person committing a criminal offence based solely on profiling or on their personality traits (not AI systems that support a human assessment already based on objective and verifiable facts) | 2 February 2025 |
| (e) | AI systems that create or expand facial recognition databases through the untargeted scraping of facial images from the internet or CCTV footage | 2 February 2025 |
| (f) | AI systems to infer emotions of a natural person in the areas of workplace and education institutions, except for medical or safety reasons | 2 February 2025 |
| (g) | Biometric categorisation systems that categorise individually natural persons based on their biometric data to deduce or infer their race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation (with the exceptions set out in the point itself) | 2 February 2025 |
| (h) | The use of "real-time" remote biometric identification systems in publicly accessible spaces for the purposes of law enforcement, except in the cases listed in the point and subject to the conditions of Article 5(2) to (7) | 2 February 2025 |
The dates come from Article 113: Chapters I and II (Article 5 is in Chapter II) apply from 2 February 2025, "with the exception of Article 5(1), first subparagraph, points (ba) and (bb), and Article 5(1a) and (1b) which shall apply from 2 December 2026". The table is a summary; the official text, linked at the end, is what counts.
What changes on 2 December 2026
On that day points (ba) and (bb) start to apply, together with the two paragraphs that narrow them down:
- Article 5(1a), point (a): placing on the market or putting into service an AI system that generates or manipulates that material is only prohibited where that generation or manipulation is the intended purpose of the system, or where its design, training, architecture, capabilities or user-facing functionalities make it a reasonably foreseeable and reproducible outcome, without requiring significant technical modification, and the system does not have reasonable and adequate technical safety measures and other safeguards to reliably prevent it or to correct observed or reported misuse. It refers to placing on the market and putting into service, not to use.
- Article 5(1a), point (b): for whoever uses the system, the use "is only prohibited where the deployer uses the system for the purpose of generating or manipulating such material or performance".
- Article 5(1b): for the purposes of point (ba), manipulating material in a way that does not increase the exposure of any depicted intimate parts or alter the nature of any depicted sexually explicit activities does not constitute manipulation.
The same date has another effect, this one for providers: systems generating synthetic audio, image, video or text content that were placed on the market before 2 August 2026 have until 2 December 2026 to apply the marking of generated content under Article 50(2) (Article 111(4), added by Regulation (EU) 2026/1744).
What an SME has to check
Article 5 does not set up a procedure or a register: it lists prohibited practices. To check them against what the company does, you need to know which AI systems it uses and what for. One orderly way to do it:
- List the AI systems the company uses, including those built into another product (the assistant in the CRM, the image generator in the design software, the filter in the phone system), with their provider and what each one is used for.
- Compare each use with the ten points, starting with the ones closest to a company's day-to-day work: image, video or audio generators (points (ba) and (bb), from 2 December 2026), tools that analyse employees (point (f), emotions in the workplace; point (g), biometric categorisation) and personalised marketing or sales techniques (points (a) and (b), manipulation and exploitation of vulnerabilities).
- For content generators, review what they are used for in the company (Article 5(1a), point (b), looks at the purpose for which the deployer uses the system) and what the provider's terms of use say about that kind of material.
- Record the review and its date, system by system, and repeat it when the use or the tool changes. If a use falls under one of the points, Article 5 says that practice is prohibited; in a doubtful case, the step to take is to consult a professional.
The AI Inventory template comes with this review preloaded: the "Prohibited practices (Art. 5)" database holds the ten points of Article 5(1) and paragraphs 1a and 1b, each with the summary of the official text, the date from which it applies, the link to EUR-Lex and the date it was checked, with the "Already applicable" and "Upcoming" views; and each system in the "AI systems" database has the "Article 5 review done" and "Prohibited practice found" checkboxes, which feed into its indicative level: AI Inventory.
Sources (opened on 28 October 2026)
- Regulation (EU) 2024/1689, consolidated text of 27 July 2026, the current consolidated version according to EUR-Lex: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02024R1689-20260727 — Articles 3, 5, 111 and 113.
- Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026 (OJ L of 24 July 2026): https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32026R1744
Document organisation tool based on official texts; it does not constitute legal advice.