RFC-028: EU AI Act Alignment — Regulatory Governance Framework — 3. Prohibited Practices (Art. 5) — Non-Derogable Rules

AIGP Specification › RFC-028: EU AI Act Alignment — Regulatory Governance Framework › 3. Prohibited Practices (Art. 5) — Non-Derogable Rules

← 2. Regulatory Context Declaration · Section index · 4. High-Risk AI Systems — Mandatory Governance (Art. 6-49) →

3. Prohibited Practices (Art. 5) — Non-Derogable Rules

3.1 Overview

These are absolute prohibitions. No governance configuration may permit them. They map to AIGP as hardcoded DENY rules when regulatory_context.framework == "EU_AI_ACT".

3.2 Rule Definitions

{
  "rules": [
    {
      "id": "EUAI-001",
      "name": "SUBLIMINAL_MANIPULATION",
      "article": "Art. 5(1)(a)",
      "description": "AI systems that deploy subliminal techniques beyond a person's consciousness, or purposefully manipulative or deceptive techniques, to materially distort behavior causing significant harm.",
      "detection": "intent_classification == 'MANIPULATE' OR technique == 'SUBLIMINAL'",
      "action": "DENY",
      "penalty": "€35M or 7% global turnover"
    },
    {
      "id": "EUAI-002",
      "name": "EXPLOITATION_OF_VULNERABILITIES",
      "article": "Art. 5(1)(b)",
      "description": "AI systems that exploit vulnerabilities due to age, disability, or social/economic situation to materially distort behavior causing significant harm.",
      "detection": "target_group IN ('MINOR', 'ELDERLY', 'DISABLED', 'SOCIOECONOMICALLY_VULNERABLE') AND intent == 'BEHAVIORAL_DISTORTION'",
      "action": "DENY"
    },
    {
      "id": "EUAI-003",
      "name": "SOCIAL_SCORING",
      "article": "Art. 5(1)(c)",
      "description": "AI systems for evaluating/classifying persons based on social behavior or personal characteristics, where the resulting score leads to detrimental treatment unrelated to the context.",
      "detection": "use_case == 'SOCIAL_SCORING' OR (output_type == 'PERSON_SCORE' AND basis == 'SOCIAL_BEHAVIOR')",
      "action": "DENY"
    },
    {
      "id": "EUAI-004",
      "name": "CRIMINAL_PREDICTION",
      "article": "Art. 5(1)(d)",
      "description": "AI systems for making risk assessments of natural persons for predicting criminal offending based solely on profiling or personality traits.",
      "detection": "use_case IN ('CRIMINAL_PREDICTION', 'RECIDIVISM_SCORING') AND basis == 'PROFILING_ONLY'",
      "action": "DENY"
    },
    {
      "id": "EUAI-005",
      "name": "UNTARGETED_FACIAL_SCRAPING",
      "article": "Art. 5(1)(e)",
      "description": "AI systems that create or expand facial recognition databases through untargeted scraping of facial images from the internet or CCTV footage.",
      "detection": "data_source IN ('INTERNET_SCRAPE', 'CCTV_UNTARGETED') AND data_type == 'FACIAL_IMAGE'",
      "action": "DENY"
    },
    {
      "id": "EUAI-006",
      "name": "EMOTION_RECOGNITION_WORKPLACE_EDUCATION",
      "article": "Art. 5(1)(f)",
      "description": "AI systems to infer emotions of natural persons in workplace and educational institutions, except for medical or safety reasons.",
      "detection": "use_case == 'EMOTION_RECOGNITION' AND context IN ('WORKPLACE', 'EDUCATION') AND NOT exception IN ('MEDICAL', 'SAFETY')",
      "action": "DENY"
    },
    {
      "id": "EUAI-007",
      "name": "BIOMETRIC_CATEGORIZATION_SENSITIVE",
      "article": "Art. 5(1)(g)",
      "description": "AI systems that categorize natural persons based on biometric data to deduce race, political opinions, trade union membership, religious/philosophical beliefs, sex life, or sexual orientation.",
      "detection": "technique == 'BIOMETRIC_CATEGORIZATION' AND inferred_attribute IN ('RACE', 'POLITICS', 'RELIGION', 'SEXUAL_ORIENTATION', 'TRADE_UNION')",
      "action": "DENY"
    },
    {
      "id": "EUAI-008",
      "name": "REAL_TIME_REMOTE_BIOMETRIC_PUBLIC",
      "article": "Art. 5(1)(h)",
      "description": "Real-time remote biometric identification systems in publicly accessible spaces for law enforcement, except for narrowly defined exceptions (missing children, imminent terrorist threat, serious criminal offence).",
      "detection": "technique == 'REAL_TIME_BIOMETRIC_ID' AND location == 'PUBLIC_SPACE' AND purpose == 'LAW_ENFORCEMENT' AND NOT exception_granted",
      "action": "DENY"
    }
  ]
}

---

---

← 2. Regulatory Context Declaration · Section index · 4. High-Risk AI Systems — Mandatory Governance (Art. 6-49) →