Article 5: the practices the Act bans outright.

Ten practices with no risk tier and no compliance path: eight in force since 2 February 2025, and two more — on non-consensual intimate imagery and child sexual abuse material — from 2 December 2026. Clause50 screens every one from the intake. A system recorded as a prohibited practice is refused an evidence pack — at every plan level — because there is nothing to evidence.

The ten practices

Article 5(1)(a)–(h), (ba) and (bb), in the words the intake screen itself asks. A “yes” here is not Clause50 concluding your system is illegal — it is what you told the product your system does; several paragraphs carry express derogations the product does not assess.

Art. 5(1)(a)

Does the system use subliminal, purposefully manipulative, or deceptive techniques that change how people behave?

Art. 5(1)(b)

Does the system target people's age, disability, or social or economic situation in order to change their behaviour?

Art. 5(1)(ba) — from 2 December 2026

Is the system intended — or do you use it — to generate or alter realistic images, video or audio of an identifiable person's intimate parts, or of that person in sexually explicit activity, without their explicit consent?

Art. 5(1)(bb) — from 2 December 2026

Is the system intended — or do you use it — to generate or alter child sexual abuse material?

Art. 5(1)(c)

Does the system score or rank people based on their social behaviour or personal characteristics?

Art. 5(1)(d)

Does the system predict how likely a person is to commit a criminal offence?

Art. 5(1)(e)

Does the system build or expand a facial-recognition database by untargeted scraping of images?

Art. 5(1)(f)

Does the system infer people's emotions in a workplace or an education setting?

Art. 5(1)(g)

Does the system use biometric data to deduce race, political opinions, trade-union membership, religious or philosophical beliefs, sex life, or sexual orientation?

Art. 5(1)(h)

Is the system used for law enforcement — by the police or another authority, or on their behalf — to identify people in real time, at a distance, in publicly accessible spaces?

Points (ba) and (bb): being able to is not the ban. For these two points the Act draws the line precisely (Article 5(1a)). A provider is prohibited only where producing the material is what the system is for, or where the system can readily produce it and lacks reasonable and adequate safeguards to reliably prevent that and to correct reported misuse. A deployer is prohibited only where it uses a system for that purpose. So the intake asks in two steps: whether the system could produce such material, and — if it could — which safeguards prevent it. A provider with adequate safeguards records them as evidence; it is not refused.

Read the paragraphs themselves at Article 5, Regulation (EU) 2024/1689, with points (ba) and (bb) and paragraphs (1a) and (1b) as inserted by Regulation (EU) 2026/1744.

What Clause50 does

This system is recorded as a prohibited practice under Article 5 of the EU AI Act. Article 5 is a prohibition rather than a risk tier, so no transparency evidence pack can be generated for it at any plan level — there is no compliance path for a prohibited practice. The Risk Classification Memo is still available, and changing the system's classification on the intake page restores the other templates immediately.

Refused, not upsold: the API answers 409, never 402. There is no tier at which a prohibited practice becomes purchasable — a paywall exists to withhold a seal on real evidence, and there is no evidence to withhold a seal from here.