When could a digital health feature accidentally trigger a prohibited practice?

A wellness or education-adjacent product that infers emotional state to personalise engagement, rather than for a genuine medical purpose, can fall into the Article 5 prohibition on emotion inference in workplace or educational settings. The medical-purposes exception is narrow and must reflect the device's actual intended purpose in its technical documentation, not a marketing justification added after the fact.

Is real-time biometric identification ever permitted for MedTech applications?

Article 5 prohibits real-time remote biometric identification in publicly accessible spaces for law enforcement purposes, subject to narrow exceptions unrelated to healthcare delivery. Biometric identification used for patient matching or access control within a clinical system is a different, non-prohibited use case, but developers should document why their use case does not fall under the listed prohibitions.

How does Article 5 differ from the Annex III high-risk classification?

Article 5 practices are banned outright regardless of risk classification or safeguards, while Annex III high-risk systems, including many AI-enabled medical devices, are permitted but subject to conformity assessment, technical documentation, and human-oversight obligations. A system cannot cure an Article 5 violation through risk management; it must not perform the prohibited practice at all.

All terms

RegulatoryRegulated Pathways AI / ML in Devices Global Markets

AI Act Prohibited Practices

Article 5 practices banned outright in the EU, including subliminal manipulation and untargeted facial-recognition scraping.

Reviewed by Christian Espinosa, Founder, Blue Goat CyberLast reviewed July 25, 2026

Definition

Article 5 lists AI practices that are prohibited in the Union, including subliminal or manipulative techniques causing significant harm, exploitation of vulnerabilities, social scoring by public authorities, real-time remote biometric identification in public spaces for law enforcement (with narrow exceptions), untargeted scraping of facial images to build databases, emotion inference at work or school (with medical and safety exceptions), and biometric categorisation inferring sensitive attributes.

What the regulation says

Regulation (EU) 2024/1689 (AI Act), adopted on 13 June 2024, entered into force on 1 August 2024. Under Article 113, Article 5 prohibitions have applied since 2 February 2025. Article 5 bans specified subliminal, manipulative or deceptive techniques, and exploitation of vulnerabilities linked to age, disability or social or economic circumstances, where the statutory conditions concerning behavioural distortion and significant harm are met. It also prohibits social scoring that produces detrimental or unfavourable treatment in unrelated contexts or treatment that is unjustified or disproportionate. This prohibition is not limited to public authorities. Other prohibitions cover untargeted scraping of facial images from the internet or CCTV to create or expand facial recognition databases; biometric categorisation inferring specified sensitive attributes, subject to limited exclusions; and criminal-offence risk assessments based solely on profiling or personality traits. Real-time remote biometric identification in publicly accessible spaces for law enforcement is prohibited except in narrowly defined circumstances with safeguards. For MedTech, Article 5 permits workplace or educational emotion inference for medical or safety reasons, not simply because a product is labelled a medical device. Medical-device status does not provide a general exemption from Article 5.

What this means in practice

Most MedTech products sit well outside these categories, but emotion-inference features in workplace-wellness or education-adjacent digital health products can trigger the prohibition. The medical-purposes exception is narrow: it applies when emotion inference is genuinely part of a medical device's intended purpose, not a marketing add-on.

Examples

A digital wellness application that uses AI to subtly nudge users into purchasing premium features by exploiting perceived emotional vulnerabilities could be prohibited under manipulative techniques.
An educational software for children with learning difficulties that incorporates AI for emotion inference to tailor content, but is not classified as a medical device, would likely fall under the prohibition for emotion inference in educational settings.
A MedTech platform designed for workplace health screening that includes an AI-powered module for emotion detection to assess employee stress levels, without being a medical device, would contravene the ban on emotion inference at work.

Common pitfalls

•Assuming that because a MedTech product has a medical purpose, any use of emotion inference within it automatically qualifies for the medical exception. The exception is narrow and requires emotion inference to be genuinely integral to the medical device's intended purpose, not just a supplemental feature.
•Believing that if a MedTech product does not involve 'social scoring' or 'facial recognition,' it is entirely exempt from Article 5 prohibitions. Other categories like subliminal manipulation or exploitation of vulnerabilities can still apply, even if less common in MedTech.
•Failing to consider the downstream implications of a feature, such as a biometric categorisation system, that might inadvertently infer sensitive attributes, even if the primary design intent was different. The prohibition targets the outcome, not just the explicit design goal.

Frequently asked questions

Most regulated medical devices and IVDs fall outside Article 5 because their intended purposes (diagnosis, monitoring, treatment) do not match the listed practices such as subliminal manipulation, social scoring, or untargeted facial-image scraping. The exception to watch is emotion inference: it is generally prohibited in workplace or education settings, but Article 5 carves out a medical or safety-related purpose exception.

Grouped by theme

Editor's picks

· Hand-selected related concepts

Regulatory

High-Risk AI System (EU AI Act)

AI systems captured by Article 6 of the EU AI Act because they are safety components of regulated products or listed in Annex III.

Software & AI

EU AI Act

EU regulation establishing risk-based requirements for AI systems, including most medical AI.

More in Regulatory

· Same category

Regulatory

510(k) Premarket Notification(510(k))

FDA submission demonstrating a device is substantially equivalent to a legally marketed predicate.

Regulatory

510(k) Summary vs 510(k) Statement

Two alternative disclosure mechanisms in a 510(k) submission, a Summary is public on FDA's website; a Statement promises to share Safety & Effectiveness info on request.

Regulatory

513(g) Request for Information(513(g))

Formal mechanism to ask FDA whether a product is a device and, if so, its likely classification.

Regulatory

Abbreviated 510(k)

510(k) variant that relies on FDA guidance, special controls, or recognized consensus standards.

Cited by

Where this term appears across MedTech Terms.

Ecosystems (3)

Latest in MedTech

Sources

3 sources

Every citation below opens the original document. Each is graded against our source-tier hierarchy so you can see what rests on binding law versus commentary.

Tier 1Binding law and standards· 1Tier 2Regulator guidance and consensus· 2

Link health: 3 verified· last checked 2026-06-20

EUR-Lex·1European Commission·1IMDRF·1

Inline markers like [1] jump to the matching reference above.

My progress

All terms0 / 513

Regulatory0 / 101

Saved on this device, and to your account when signed in. View studied terms

Full glossary

Browse all terms A to Z, each with a short definition.

On this term

Category: Regulatory
Sources: 3
Updated: 7/25/2026

Compare with another term

Learn in 60 seconds

Article 5 practices banned outright in the EU, including subliminal manipulation and untargeted facial-recognition scraping.

·Most MedTech products sit well outside these categories, but emotion-inference features in workplace-wellness or education-adjacent digital health products can trigger the prohibition.
·The medical-purposes exception is narrow: it applies when emotion inference is genuinely part of a medical device's intended purpose, not a marketing add-on.

Remember this

Watch out: Assuming that because a MedTech product has a medical purpose, any use of emotion inference within it automatically qualifies for the medical exception. The exception is narrow and requires emotion inference to be genuinely integral to the medical device's intended purpose, not just a supplemental feature.

Related terms

You may also need

Auto-suggested from Regulatory and shared keywords.

All Regulatory terms

From the Blue Goat network

Related resources and services on this topic.