The EU AI Act newsroom has published a summary of the Commission's guidance on prohibited AI practices, plus an explanation of two bans added in 2026. The guidance is not legally binding, and the Court of Justice of the EU has the final word on interpretation. It is still the clearest signal of how the Commission reads Article 5.
Who is covered
The bans reach both providers and deployers. Providers answer for what they put on the market; deployers answer for how they use it. General-purpose AI systems are included, not just tools built for a prohibited purpose. The guidance says deployers can be caught even where the provider's terms of use forbid the practice, and that misuse counts as use. A system that escapes a ban may still be high-risk or fall under data protection and consumer law.
The points that touch day-to-day operations
- Emotion recognition at work. Inferring employees' emotions is banned in workplaces, which includes recruitment and probation, unless the purpose is medical or safety-related. General monitoring of wellbeing, stress or burnout does not qualify. A call centre inferring its agents' emotions may be caught; applying the same kind of system to customers falls outside this ban but is still high-risk and could trigger the manipulation or vulnerability bans. Sentiment analysis of written text is outside the ban.
- Social scoring. This is not a general ban on scoring people, and it applies to private bodies as well as public ones. Scoring for a defined purpose can stay lawful if the data is relevant and the treatment proportionate. The score need not be the only basis for a decision; playing a sufficiently important role is enough.
- Manipulation and vulnerability. Intent is not required, and the guidance separates manipulation from lawful persuasion. Transparent personalised recommendations and ordinary advertising are not banned simply because they influence choices. A model that merely hallucinates is not automatically deceptive, particularly where users are warned and safeguards exist.
Two new bans from 2 December 2026
The Digital Omnibus on AI, Regulation (EU) 2026/1744, was published on 24 July 2026. It adds a ban on systems that generate or manipulate realistic content showing an identifiable person's intimate parts or sexually explicit activity without explicit consent. It also adds a ban on systems producing child sexual abuse material. Providers can be caught where such output is a reasonably foreseeable and reproducible result and adequate safeguards are missing. Terms of use alone will not suffice. The Commission's guidelines do not yet cover these two bans.
Enforcement
National market surveillance authorities enforce the bans, and anyone with grounds to suspect an infringement can complain. The harshest penalties apply: a ceiling of €35 million, or 7% of total global yearly revenue, with the greater of the two figures taking effect. For SMEs, the lesser of the two figures applies instead. The guidance also states that the bans have direct effect, so affected people can rely on them in national courts and seek interim injunctions without waiting for a regulator.