EU AI Act Prohibited Practices: What Irish Employers Should Know

The EU AI Act's list of prohibited practices is the part of the Regulation that already applies to employers, and the European Commission's AI Act pages say the prohibitions and the AI literacy obligations have applied since 2 February 2025. For employers the most relevant item is the ban on inferring emotions in the workplace, but the list also includes manipulation, social scoring and certain biometric uses. This guide walks through Article 5 as published on the Commission's AI Act Service Desk, what the Commission's guidelines say about it, who enforces it in Ireland, and how an employer might check its tools. Transparency duties for chatbots and generated content are a separate matter, not covered here. For the timeline, see our guide to EU AI Act key dates for employers.

What Article 5 prohibits

The Service Desk text of Article 5(1) (based on the EUR-Lex consolidated version as at 27 July 2026) prohibits the following, in summary:

• Manipulation. AI using subliminal, purposefully manipulative or deceptive techniques that materially distort a person's behaviour, impair informed decisions and cause or are likely to cause significant harm.
• Exploiting vulnerabilities. AI that exploits vulnerabilities linked to age, disability or a specific social or economic situation to distort behaviour in ways likely to cause significant harm.
• Social scoring. Evaluating or classifying people over time based on social behaviour or personal characteristics where the score leads to unfavourable treatment in contexts unrelated to where the data was collected, or treatment that is unjustified or disproportionate.
• Criminal risk prediction based solely on profiling or personality traits.
• Facial recognition databases built through untargeted scraping of images from the internet or CCTV.
• Emotion recognition in workplaces and education, except where the system is intended for medical or safety reasons.
• Biometric categorisation that deduces race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation.
• Real-time remote biometric identification for law enforcement in publicly accessible spaces, subject to narrow exceptions.

The Service Desk page also shows two new points, (ba) and (bb), on AI that generates or manipulates intimate imagery without consent and child sexual abuse material. Its summary says these apply from 2 December 2026. The Commission's AI Act page (last updated 3 August 2026) says an "AI Omnibus" added this prohibition and entered into force on 27 July 2026. The Service Desk marks its summaries as not legally binding, so check the Regulation's text on EUR-Lex for your own purposes.

The workplace emotion recognition ban

For HR and operations teams this is the item to focus on. Article 5(1)(f) bans AI systems that infer emotions of a natural person in the areas of workplace and education institutions, except where the system is intended to be put in place or on the market for medical or safety reasons. The Workplace Relations Commission's AI Act page describes the practical effect in its own words: a market surveillance role over prohibited workplace AI, namely systems that infer the emotions of workers or job applicants, except in limited circumstances the Act permits.

The Commission's guidelines on prohibited practices (document C(2025) 5052, dated 29 July 2025, and non-binding, with authoritative interpretation reserved to the Court of Justice) make several points on this item that we could read:

• An employer using such a system to infer emotions at work is prohibited, except for medical or safety purposes.
• The prohibition applies to deployers even if the provider has excluded that use in its contract terms.
• Exempted medical or safety uses remain subject to data protection law and EU and national law on employment and working conditions.
• Systems that do not meet the prohibition's conditions are generally high-risk under Article 6(2) and Annex III.

The sections of the guidelines on how the ban treats particular technologies (for example call-centre tools, webcams or text analysis) could not be read in the form we accessed, so we do not describe them. If you use any tool that claims to detect mood, stress, engagement or sentiment, read that part of the guidelines directly.

Who enforces the prohibitions in Ireland

According to the guidelines, the prohibitions are enforced by market surveillance authorities designated by Member States, acting on their own initiative or following a complaint. In Ireland, the AI Office of Ireland's page on national competent authorities lists the Data Protection Commission and the Central Bank of Ireland as market surveillance authorities for certain prohibited practices, without saying which specific practices each covers. The WRC says it has been designated as a market surveillance authority for certain purposes by S.I. No. 366 of 2025, as amended, that it is one of 15 national competent authorities, and that further legislation will set out its supervision and enforcement powers. The WRC page says the Regulation of Artificial Intelligence Act 2026 became law on 21 July 2026. It also says market surveillance does not resolve individual disputes, which still go through the WRC's existing jurisdiction.

Penalties

Article 99(3) of the Regulation, as shown on the Service Desk, provides for administrative fines for breaches of the Article 5 prohibitions of up to 35,000,000 euro or, for an undertaking, up to 7% of total worldwide annual turnover for the preceding financial year, whichever is higher. For SMEs, the cap is the lower of the two figures. Member States set the rules on penalties, which must be effective, proportionate and dissuasive. The Department of Enterprise, Tourism and Employment's page (published and last updated 27 May 2026) warns that using a banned system can have serious consequences even if the use was unintentional.

A practical approach for employers

These steps are our suggestion, not a legal requirement.

• Inventory your AI tools. Include HR, recruitment, monitoring, call-handling and productivity software, and features that a vendor has switched on by default.
• Ask what each tool infers. If a feature infers emotions from voice, facial expressions or other biometric data of workers or candidates, flag it for review against Article 5(1)(f) and the guidelines.
• Do not rely on vendor terms alone. The guidelines say the prohibition applies to deployers even where the provider excludes the use in its terms.
• Check scoring and nudging features. Look at whether any tool scores people across contexts or is designed to influence behaviour without their awareness.
• Look beyond Article 5. A tool that is not prohibited may still be high-risk. Our guide to AI in recruitment and HR under the EU AI Act covers the high-risk side for employers.
• Keep records and train staff. The Commission's AI Act page says AI literacy obligations have applied since 2 February 2025, and the Irish government's page says staff who develop, deploy or manage AI should receive appropriate training.

Learnsignal's offices are off Baggot Street in Dublin, and we offer in-person training from there. For current details, see our CPD pages.

Frequently asked questions

When did the EU AI Act prohibitions start to apply?

The Commission's AI Act page states that prohibited AI practices and AI literacy obligations entered into application from 2 February 2025. The additional prohibitions on intimate imagery and child sexual abuse material are shown as applying from 2 December 2026.

Is emotion recognition always banned at work?

Article 5(1)(f) bans inferring emotions in the workplace except where the system is intended for medical or safety reasons. The Commission's guidelines add that those exempt uses remain subject to data protection and employment law.

Does it matter that my supplier says the tool is compliant?

The guidelines say the prohibition applies to deployers even if the provider has excluded the use in its terms, so an employer should assess how it uses the tool.

Who regulates this in Ireland?

Several market surveillance authorities share the work. The AI Office of Ireland lists the DPC and the Central Bank for certain prohibited practices, and the WRC says it has a role over prohibited workplace AI. Check the AI Office of Ireland for current contact points.

The legal position is developing, so confirm dates and enforcement arrangements on the official pages before acting.