Article 5 — Prohibited AI practices

Official title, Regulation (EU) 2024/1689 · cited here as Art.5(1)(bb), Art.5(1a)

Prohibited: AI producing child sexual abuse material (from 2 Dec 2026). A deployer is caught only where they use the system for that purpose — Art.5(1a)(b)

Who it binds: Every operator — provider, deployer, importer and distributor alike.
Evidence that discharges it: a written policy
Usually owned by: CISO
Severity: Critical — a gap here is the kind regulators act on first, and in the prohibitions it is not curable by documentation.

Does it apply to you?

Applicability under the Act is risk tier × operator role, not tier alone. This grid is computed by running the same function the assessment uses, so it cannot drift from what the product would tell you.

limited riskprovider, deployer, importer, distributor
high riskprovider, deployer, importer, distributor

Read against Regulation (EU) 2024/1689 as amended, consolidated text 02024R1689-20260727 (consolidation 001.001, incorporating Regulation (EU) 2026/1744). What we work from

Check which duties apply to you All obligations →