The EU AI Act's banned practices are the AI systems listed in Article 5 that may not be placed on the market, put into service or used in the European Union. There are now 10, including two new bans applying from 2 December 2026. This article goes through each one and shows which Thai businesses could be caught and which are not.
- Article 5 has banned 8 AI practices since 2 February 2025; new points (ba) and (bb) apply from 2 December 2026.
- Thai businesses are caught only within Article 2 scope, for example selling into the EU market or where output is used in the EU.
- The closest to Thai business: workplace emotion recognition, biometric categorisation and image-generation apps.
- Breaching Article 5 carries fines up to EUR 35 million or 7% of worldwide annual turnover, whichever is higher.
- Purely domestic use in Thailand is outside the EU AI Act, but biometric data is still sensitive data under PDPA Section 26.
The EU AI Act, Regulation (EU) 2024/1689, sorts AI systems by risk. Most only need documentation, assessments or user notices. Article 5 is different: the systems it lists may not be placed on the market, put into service or used. No amount of paperwork makes them lawful.
This article does not repeat the question of when the Act reaches Thai companies; that is covered in when the EU AI Act applies to a Thai company. It focuses on the ten prohibitions in the version consolidated with Regulation (EU) 2026/1744: what each bans, and which Thai businesses should pay attention.
What does Article 5 ban, and from when?
Article 5(1) opens with one short sentence followed by a list. Points (a) to (h) are from the 2024 text; points (ba) and (bb) were inserted by Regulation (EU) 2026/1744, known as the Digital Omnibus on AI.
1. The following AI practices shall be prohibited:
| Point | What is banned (summary) | Applies from |
|---|---|---|
| (a) | Subliminal, manipulative or deceptive techniques that materially distort decisions and cause significant harm | 2 Feb 2025 |
| (b) | Exploiting vulnerabilities due to age, disability or social or economic situation | 2 Feb 2025 |
| (c) | Social scoring leading to detrimental treatment in unrelated contexts or out of proportion | 2 Feb 2025 |
| (d) | Predicting criminal offending based solely on profiling or personality traits | 2 Feb 2025 |
| (e) | Building facial recognition databases by untargeted scraping of the internet or CCTV | 2 Feb 2025 |
| (f) | Inferring emotions in the workplace and education, except for medical or safety reasons | 2 Feb 2025 |
| (g) | Biometric categorisation to infer race, political opinions, union membership, religion, sex life or sexual orientation | 2 Feb 2025 |
| (h) | Real-time remote biometric identification in public spaces for law enforcement (narrow exceptions) | 2 Feb 2025 |
| (ba) | Generating or manipulating realistic intimate or sexually explicit material of an identifiable person without explicit consent | 2 Dec 2026 |
| (bb) | Generating or manipulating material within Article 2 (c) and (e) of Directive 2011/93/EU (child sexual abuse material) | 2 Dec 2026 |
The dates come from Article 113, as amended by Regulation (EU) 2026/1744 to give the two new bans their own start date.
(a) Chapters I and II shall apply from 2 February 2025, with the exception of Article 5(1), first subparagraph, points (ba) and (bb), and Article 5(1a) and (1b) which shall apply from 2 December 2026;
How could a Thai business fall under these bans?
It must first be within the Act's scope under Article 2. Two routes are common for Thai businesses: being a provider that places an AI system on the market or puts it into service in the EU, or being a provider or deployer outside the EU whose system's output is used in the EU.
A Thai business using AI in Thailand on people in Thailand, with no output used in the EU, is outside the Act. Article 5 does not stretch the scope set by Article 2. For a case-by-case scope check, see the EU AI Act guide for Thai businesses.
A common misreading is that open-source systems are exempt from everything. Article 2(12) does exempt them, but not when they fall under Article 5.
12. This Regulation does not apply to AI systems released under free and open-source licences, unless they are placed on the market or put into service as high-risk AI systems or as an AI system that falls under Article 5 or 50.
Is emotion tracking of call-centre staff banned?
Point (f) bans systems that infer emotions of people in the workplace and in education. This is close to home for Thai firms running customer-service or call-centre work for European clients, and for Thai developers selling voice or face analytics for staff into Europe.
(f) the placing on the market, the putting into service for this specific purpose, or the use of AI systems to infer emotions of a natural person in the areas of workplace and education institutions, except where the use of the AI system is intended to be put in place or into the market for medical or safety reasons;
The Act's definition of an emotion recognition system is narrower than many assume: it must infer from biometric data, such as face or voice. Sentiment analysis of text a customer types is a different question.
(39) ‘emotion recognition system’ means an AI system for the purpose of identifying or inferring emotions or intentions of natural persons on the basis of their biometric data;
Recital (18) adds that physical states such as a driver's fatigue are not emotions in this sense, while voice characteristics such as a raised voice or whispering matter when used to infer emotions. A fatigue detector for truck drivers is therefore different from a system that scores call agents' moods.
Any collection of Personal Data pertaining to racial, ethnic origin, political opinions, cult, religious or philosophical beliefs, sexual behavior, criminal records, health data, disability, trade union information, genetic data, biometric data, or of any data which may affect the data subject in the same manner, as prescribed by the Committee, is prohibited, without the explicit consent from the data subject
Is in-store customer analytics banned?
Point (g) bans biometric categorisation that sorts individuals to infer race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation.
(g) the placing on the market, the putting into service for this specific purpose, or the use of biometric categorisation systems that categorise individually natural persons based on their biometric data to deduce or infer their race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation;
A Thai developer selling shopper analytics to European retailers must check whether the system infers anything on that list. Counting people or estimating a rough age band is not on the point (g) list, but it may meet other parts of the Act; read the whole regulation, not only Article 5.
Point (e) is the other one facial recognition vendors should check: no building or expanding face databases by untargeted scraping of the internet or CCTV footage. European buyers will ask where the training data came from, and Thai vendors should have the answer.
What must image-generation apps prepare before 2 December 2026?
The new point (ba) targets systems that generate or manipulate realistic intimate or sexually explicit images, video or audio of real, identifiable people without their consent. This matters to Thai start-ups whose photo-editing or image-generation apps are open to users in Europe.
(ba) the placing on the market, the putting into service or the use of an AI system that generates or manipulates realistic images, videos, audio or similar material of an identifiable natural person’s intimate parts, or of an identifiable natural person engaged in sexually explicit activities, without that person’s freely-given, specific, informed, unambiguous and explicit consent for that generation or manipulation;
The accompanying Article 5(1a) splits responsibility. A provider is caught where such generation is the system's intended purpose, or where the system makes it a foreseeable, reproducible outcome without adequate safeguards. A deployer is caught only where it uses the system for that purpose.
(b) the use of an AI system that generates or manipulates the material or performance referred to in paragraph 1, first subparagraph, points (ba) and (bb) is only prohibited where the deployer uses the system for the purpose of generating or manipulating such material or performance.
For providers, the key question is safeguards. The AIPDPA team notes (not law) suggest documenting prompt filtering, output filtering, usage restrictions, a misuse reporting channel and a correction process, testing them against foreseeable workarounds, and keeping the test results.
How relevant are the remaining bans to Thai business?
Points (a) and (b) cover manipulation that causes harm. Games, finance apps and e-commerce that use AI to personalise offers for European users should read them. The text needs both material distortion of behaviour and significant harm, actual or likely, so ordinary assertive marketing is not caught automatically.
(a) the placing on the market, the putting into service or the use of an AI system that deploys subliminal techniques beyond a person’s consciousness or purposefully manipulative or deceptive techniques, with the objective, or the effect of materially distorting the behaviour of a person or a group of persons by appreciably impairing their ability to make an informed decision, thereby causing them to take a decision that they would not have otherwise taken in a manner that causes or is reasonably likely to cause that person, another person or group of persons significant harm;
Point (c) on social scoring does not ban ordinary customer scoring. It bans scores built from behaviour in one context being used against people in unrelated contexts, or treatment out of proportion. Businesses that combine behaviour data across several services to rank customers should read the full wording.
(c) the placing on the market, the putting into service or the use of AI systems for the evaluation or classification of natural persons or groups of persons over a certain period of time based on their social behaviour or known, inferred or predicted personal or personality characteristics, with the social score leading to either or both of the following: (i) detrimental or unfavourable treatment of certain natural persons or groups of persons in social contexts that are unrelated to the contexts in which the data was originally generated or collected; (ii) detrimental or unfavourable treatment of certain natural persons or groups of persons that is unjustified or disproportionate to their social behaviour or its gravity;
The system is placed on the EU market and infers emotions from biometric data at work.
If the system's output is used in the EU, Article 2 may apply; if used only in Thailand, it may not. PDPA Section 26 still matters.
If it can easily produce intimate images of real people without safeguards, point (ba) may apply through Article 5(1a).
Used in Thailand on people in Thailand and not inferring point (g) traits, but Thai CCTV rules under the PDPA apply.
Points (d) and (h) are further from Thai private business. Point (h) concerns real-time identification by law enforcement. Point (d) has one trap for HR screening vendors: systems that assess the risk of a person committing fraud or crimes based solely on personality. For AI in HR, see AI in hiring and staff evaluation.
How heavy are the penalties for breaching Article 5?
Article 5 sits in the highest penalty tier of the Act under Article 99(3). Member States set the detailed enforcement rules, but the ceiling is in the regulation itself.
3. Non-compliance with the prohibition of the AI practices referred to in Article 5 shall be subject to administrative fines of up to EUR 35 000 000 or, if the offender is an undertaking, up to 7 % of its total worldwide annual turnover for the preceding financial year, whichever is higher.
How far fines can be enforced against companies outside the EU is a separate question. The faster consequence is commercial: European customers will not buy systems that risk Article 5, and will ask for contractual warranties on it.
What should a Thai business check this month?
- List the AI systems you sell or provide to customers in the EU, and systems whose output is used there.
- Check each against points (a) to (h), (ba) and (bb), and record why it is not caught.
- For systems using faces or voices, check whether they infer emotions at work or in education, or infer point (g) traits.
- If you offer image generation or editing of people, finish your safeguards document and test results before 2 December 2026.
- For systems used only in Thailand, check the PDPA, especially biometric data under Section 26.
AIPDPA's AI Risk Radar maps each system in the registry against Thai law, NIST AI RMF, ISO 42001 and the EU AI Act on one page, so you can see which systems need a prohibition check first. If you are choosing a main framework, see ISO 42001 or NIST AI RMF.
Frequently asked questions
We have no EU branch. Does Article 5 matter to us?
Yes, if you place an AI system on the EU market or its output is used in the EU, under Article 2. Having no branch does not take you out of scope. Purely domestic use in Thailand on Thai people is outside the Act.
Is a chatbot that analyses sentiment in customer messages caught by point (f)?
Point (f) concerns inferring emotions at work and in education, and the Article 3(39) definition requires biometric data, so text sentiment analysis does not match it. Systems that interact directly with people still have transparency duties under Article 50.
Do the new points (ba) and (bb) apply to ordinary photo apps?
Article 5(1a) limits provider liability to systems whose intended purpose is such generation, or that make it easy without adequate safeguards, and Article 5(1b) excludes edits that do not increase exposure. An ordinary app with real safeguards differs from one built for this.
Are open-source systems exempt?
Article 2(12) exempts systems released under free and open-source licences, but not if they fall under Article 5 or Article 50.
Does Thailand have an Article 5-style list of banned AI practices?
Our corpus contains no enacted Thai law listing banned AI practices. Thailand's AI bill is not yet law; see upcoming Thai AI law and PDPA changes.
Law and sources
- Regulation (EU) 2024/1689 (EU AI Act), consolidated with Regulation (EU) 2026/1744 — EU law, not binding in Thailand as such — Article 2(12) · Article 3(39) · Article 5 · Article 99(3) · Article 113
- EU AI Act guide for Thai organisations — AIPDPA team notes, not law
- Personal Data Protection Act B.E. 2562 (2019) — Section 26
Text in the "The text" boxes is copied word for word from AIPDPA's legal knowledge base, transcribed from the Royal Gazette and official documents; every edit is checked by the system against that base, character by character. English wording is an unofficial translation; the Thai text prevails. This article is general information, not legal advice for a particular case.
Do it in the system
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)