Prohibited AI Practices Under the EU AI Act: When AI Exploits Vulnerability

The EU AI Act is a risk-based regulatory framework, but some practices are considered unacceptable and are prohibited outright.

This article examines the prohibition on exploitation of vulnerabilities, drawing on the Commission’s final July 29, 2025 Guidelines on prohibited artificial intelligence practices. These guidelines superseded the February 2025 draft and provide the detailed examples discussed below.

For an overview of all prohibited practices, see Prohibited AI Practices Under the EU AI Act: Where Europe Draws the Line.

Exploitation of Vulnerabilities

Article 5(1)(b) addresses exploiting vulnerabilities, a risk that is related to, but distinct from, harmful manipulation and deception (see, Prohibited AI Practices under the EU AI Act: When AI Persuasion Becomes Prohibited Manipulation.)

It prohibits the placing on the market, putting into service or use of an AI system that exploits vulnerabilities associated with:

• age;
• disability; or
• a specific social or economic situation,

where that exploitation has the objective or effect of materially distorting behavior in a manner that causes, or is reasonably likely to cause, significant harm.

Several additional cumulative conditions must be satisfied:

• The practice must involve the "placing on the market", "putting into service" or "use" of an AI system (see, Prohibited AI Practices Under the EU AI Act: Where Europe Draws the Line sub-title "What Conduct Does Article 5 Regulate?").
• The AI system must exploit a vulnerability arising from age, disability or a specific social or economic situation.
• The exploitation must have the objective or effect of materially distorting the behavior of a person or group.
• The distorted behavior must cause, or be reasonably likely to cause, significant harm to that person or another person.

There must also be a plausible causal link connecting the exploitation of the vulnerability, the material distortion of behavior and the resulting or reasonably foreseeable significant harm.

Commission Guidelines, § 3.3, paras. 98–100.

Article 5(1)(b) does not prohibit AI systems merely because they are designed for, marketed to or used by vulnerable populations. Properly designed AI systems can provide substantial benefits, including:

• toys, games and learning applications that support children;
• personal assistants, health applications and assistive robots for older persons;
• tools supporting the education, skills development or social integration of disadvantaged groups;
• personalized learning and accessibility tools for people with visual, hearing or other impairments;
• systems that remove barriers to products and services; and
• AI-enabled prosthetics and other assistive technologies.

Commission Guidelines, § 3.3.3, para. 121.

Practice Takeaway: Article 5(1)(b) does not prohibit serving vulnerable populations. It prohibits using AI to make harmful use of vulnerabilities arising from age, disability or a specific social or economic situation. The analysis should therefore identify the precise vulnerability, determine how the system uses it, assess whether behavior is materially distorted and evaluate the resulting or reasonably foreseeable significant harm.

The two prohibitions in Article 5(1)(a) and Article 5(1)(b) may overlap, but Article 5(1)(a) focuses on the manipulative technique, while Article 5(1)(b) focuses on exploiting vulnerabilities arising from age, disability or a specific social or economic situation.

Example—Article 5(1)(a): An AI system uses rapid image flashes to influence purchasing decisions. The defining feature is the subliminal technique, which can manipulate people regardless of whether they belong to a protected vulnerable group.

Example—Article 5(1)(b): An AI system targets older persons with insurance offers by exploiting their reduced cognitive capacity. The defining feature is the exploitation of an age-related vulnerability.

Commission Guidelines, § 3.4, paras. 122–125.

1. What counts as exploitation of a vulnerability?

The AI Act does not define “vulnerability.” The Commission interprets the concept broadly enough to encompass cognitive, emotional, physical and other forms of susceptibility that may affect a person’s ability to make informed decisions or otherwise influence that person’s behavior. The relevant susceptibility must arise from:

• age;
• disability; or
• a specific social or economic situation.

The Commission Guidelines interpret “exploitation” to mean objectively making use of that vulnerability in a manner that is harmful to the affected person or others. The analysis turns on what the system actually does and how it uses the person’s susceptibility.

Multiple vulnerabilities may also overlap. A person may be vulnerable because of age and disability, or because disability intersects with economic disadvantage. The cumulative exploitation of several vulnerabilities may increase both the likelihood and severity of harm.

Commission Guidelines, § 3.3.1, paras. 101–103.

Practice Tip: Identify the vulnerability the system is allegedly exploiting. It is not enough to conclude that the affected person is “vulnerable” in a general sense. Ask whether the susceptibility arises from age, disability or a specific social or economic situation—and whether the AI system is actually making use of that particular susceptibility.

1(a). Vulnerabilities due to age

The prohibition seeks to prevent AI systems from exploiting cognitive, emotional or other limitations that may make children and older persons more susceptible to undue influence, manipulation or harmful exploitation.

Children (under 18): Children may be particularly susceptible to manipulation because their developmental stage can limit their ability to assess critically what is real, understand the intentions behind AI-driven interactions, resist immediate rewards or appreciate long-term consequences. Their cognitive and socio-emotional development may also make them more likely to form emotional attachments to AI agents, respond to praise, rewards or social pressure, engage in compulsive or addictive behavior, prioritize immediate gratification over long-term consequences, or misunderstand the nature of an apparently human-like interaction.

Examples: An AI-enabled toy rewards children for completing increasingly dangerous challenges (e.g. such as climbing furniture, exploring high shelves, or handling sharp objects), while a game designed for addiction uses personalized, unpredictable rewards to encourage compulsive play by exploiting children’s limited self-control and preference for immediate gratification.

Commission Guidelines, § 3.3.1(a), paras. 104–105.

Practice Tip: Personalized engagement features require particular scrutiny when directed toward children. Rewards, streaks, simulated affection, anthropomorphic design and reinforcement schedules are not automatically prohibited. The Article 5 concern arises when the system uses childhood vulnerabilities to materially distort behavior in a manner that causes or is reasonably likely to cause significant harm. The potential harms could extend beyond excessive screen time to include sleep deprivation, reduced physical activity, deteriorating eyesight, impaired concentration and cognitive development, poor academic performance, reduced social skills, anxiety, depression and other mental-health effects, as well as long-term interference with the child’s development and well-being.

Older persons: Older persons may also experience age-related vulnerabilities. These can include reduced cognitive capacity, lower digital literacy or difficulty understanding increasingly complex AI-enabled products and interactions. Those circumstances may make some older people particularly susceptible to impersonation and other scams, coercive tactics, deceptive personalized offers, unnecessary financial or medical products, or pressure from AI-enabled assistants or robots.

Examples: AI systems target older people with deceptive personalized offers or scams, exploiting their reduced cognitive capacity to influence decisions they otherwise would not have made and that are likely to cause significant financial harm. A robot aimed to assist older persons may exploit their vulnerable situation and force them to do certain activities against their free choice, which can significantly worsen their mental health and cause them serious psychological harms.

Commission Guidelines, § 3.3.1(a), para. 106.

Practice Tip: An AI-enabled personal assistant, health application or assistive robot is not prohibited merely because older persons use it. Article 5(1)(b) applies only when the system exploits an age-related vulnerability, materially distorts behavior and causes or is reasonably likely to cause significant harm.

1(b). Vulnerabilities due to disability

Disability encompasses long-term physical, mental, intellectual or sensory impairments that, in interaction with other barriers, may hinder a person’s full and effective participation in society on an equal basis with others. (See, Recital 29)

• The relevant vulnerability might arise from cognitive limitations, emotional dependency, difficulty recognizing manipulation, physical or sensory impairment, or another disability-related condition that makes a person more susceptible to influence or exploitation.

Examples: A therapeutic chatbot aimed to provide mental health support and coping strategies to persons with mental disabilities exploits the limited intellectual capacity of users with mental disabilities by pressuring them to purchase expensive medical products or engage in harmful behavior. An AI system identifies women and girls with disabilities online and exploits their impairments to target them with sexually abusive content and more effective grooming practices.

Commission Guidelines, § 3.3.1(b), paras. 107–108.

Practice Tip: Distinguish exploitation from inaccessibility or disparate impact. A system does not exploit a disability merely because it performs poorly for, excludes or creates barriers for persons with disabilities. Article 5(1)(b) requires the system to make use of a disability-related susceptibility in a manner that distorts behavior and creates the requisite significant harm.

1(c). Vulnerabilities due to a specific social or economic situation

This category protects people whose social or economic circumstances make them particularly susceptible to exploitation.

• “Specific” does not mean unique to one person. It can refer to a person’s legal status or membership in a vulnerable social or economic group, such as people living in extreme poverty, ethnic or religious minorities, migrants, refugees, people who are unemployed or over-indebted, and others facing serious financial or social disadvantage. (See, Recital 29)
• The category generally concerns relatively stable or long-term conditions, but temporary circumstances may also qualify when they create a specific susceptibility to exploitation.
• Not every difficult emotional or personal circumstance is a “specific social or economic situation.” Loneliness, dissatisfaction or personal grievances that anyone might experience do not, without more, fall within this category. Their exploitation could nevertheless be examined under Article 5(1)(a) if the system uses purposefully manipulative or deceptive techniques.

Commission Guidelines, § 3.3.1(c), para. 109.

Example: An AI system uses postal codes or similar indicators to identify people experiencing severe financial hardship and exploits their financial desperation by targeting them with advertisements for predatory financial products.

Commission Guidelines, § 3.3.1(c), paras. 110–111; § 3.3.3, para. 117.

Practice Tip: Review AI-enabled differential pricing for exploitation of economic vulnerability. Charging low-income consumers more for essential services, such as insurance, because of their precarious financial circumstances may impose a significant financial burden and increase their vulnerability to future economic shocks. However, bias is not automatically exploitation: An AI system that inadvertently produces a disparate impact because of biased training data does not automatically exploit socio-economic vulnerabilities. The distinction turns partly on whether the system targets—or knowingly makes use of—the vulnerability.

Practice Tip: Review proxy variables, not only express classifications. Postal code, migration status, language, debt history or other variables may allow a system to identify and exploit a protected socio-economic vulnerability even if the system never expressly labels the person as poor, marginalized or otherwise disadvantaged.

Migrants and refugees: Migrants and refugees may experience unstable legal status, economic insecurity, limited access to services or reduced familiarity with local institutions. Those circumstances can create a specific social or economic vulnerability.

Example: A personalized chatbot identifies users who are migrants and exploits the insecurity and discontent associated with their unstable social or economic circumstances to push them toward extremist views and violence against groups in the host country. The Article 5 concern here is not that migrants happen to use the chatbot. It is that the system identifies and makes use of vulnerabilities associated with their unstable social or economic circumstances to distort their behavior in a manner capable of producing serious psychological, physical and societal harm to other people (in this case, citizens of the host country).

Commission Guidelines, § 3.3.1(c), para. 112.

2. The objective or effect of materially distorting behavior

Exploitation of a protected vulnerability is not enough by itself. The practice must also have the objective or effect of materially distorting behavior.

• “Materially” requires a substantial impact rather than a minor or trivial influence. But intent is not required. Article 5(1)(b) can apply where the system has the effect of materially distorting behavior even if the provider or deployer did not intend that result.

The concepts of objective, effect and material distortion generally operate in the same way under Articles 5(1)(a) and 5(1)(b). There is, however, an important textual difference. Article 5(1)(a) expressly requires the manipulative or deceptive technique to ‘appreciably impair the ability to make an informed decision’. Article 5(1)(b) does not include that additional language.

• The difference reflects the nature of the protected population. Children and other vulnerable persons may already have a reduced ability to recognize or resist exploitation. Article 5(1)(b) therefore focuses on whether the system exploits the protected vulnerability and materially distorts behavior—not on separately proving an appreciable impairment of informed decision-making.

Commission Guidelines, § 3.3.2, para. 113.

Practice Tip: Do not import every element of Article 5(1)(a) into the vulnerability analysis. Article 5(1)(b) does not separately require proof that the system appreciably impaired the person’s ability to make an informed decision. The relevant questions are whether the system exploited a protected vulnerability and whether that exploitation materially distorted behavior.

3. Significant harm remains the limiting principle

The materially distorted behavior must cause, or be reasonably likely to cause, significant harm to the affected person or another person. Article 5(1)(a) and (b) AI Act are interpreted in the same way. The explanation of significant harm in When AI Persuasion Becomes Prohibited Manipulation also applies here.

Commission Guidelines, § 3.3.3, paras. 114–115.

Example: Children: Emotional dependency and addictive design. An anthropomorphic AI system may exploit children’s developmental vulnerabilities by fostering an unhealthy emotional attachment, manipulating engagement time or distorting their understanding of authentic human relationships. Potential harms can include: increased anxiety and dependency; impaired emotional regulation; reduced empathy or social understanding; displacement of sleep, physical play and face-to-face interaction; interference with normal social and emotional development; and longer-term harm to the child’s well-being. Similarly, AI systems that use personalized reinforcement schedules to keep young users dependent on a service may contribute to depression, body dissatisfaction, eating disorders, self-harm or suicidal behavior, as well as impaired learning and cognitive development.

These practices should be distinguished from legitimate efforts to create engaging products. User engagement is not inherently exploitative. The prohibition targets design practices that make use of protected vulnerabilities, materially distort behavior and create a reasonable likelihood of significant harm.

Commission Guidelines, § 3.3.3, para. 116.

Example: Older persons. An AI system exploits older people’s reduced cognitive capacity and digital literacy by targeting them with expensive medical treatments, unnecessary insurance policies or deceptive investment schemes, causing significant loss of savings, increased debt and emotional distress.

Commission Guidelines, § 3.3.3, para. 117

Example: Harm to persons with disabilities. An emotion-recognition system designed to support a person with a mental disability might also manipulate that person into purchasing products that promise unrealistic mental-health benefits. The practice could worsen the person’s condition while also causing financial loss. The relevant harm may therefore be both psychological and financial.

Commission Guidelines, § 3.3.3, para. 118.

Example: Socially or Economically Disadvantaged Individuals. An AI chatbot exploits the heightened susceptibility of socially or economically disadvantaged users by targeting them with fear-based narratives, hate speech or exploitative offers that may cause anxiety, depression, isolation, self-harm, radicalization, violence or deeper social and economic disadvantage.

Commission Guidelines, § 3.3.3, para. 119.

Examples of AI Systems That Do Not Cause Significant Harm: An anthropomorphic AI companion uses affective features to increase engagement but does not create unhealthy attachment, dependency or other serious harm. An emotion-recognition system on a music platform recommends songs matching a user’s mood while limiting excessive exposure to depressive content, without causing anxiety, depression or other significant harm.

Commission Guidelines, § 3.5.2, para. 134

NOTE: Articles 5(1)(a) and (b) Interplay with other EU law - Articles 5(1)(a) and (b) complement rather than replace other EU laws. The same AI practice may violate the AI Act as well as consumer-protection, data-protection or non-discrimination law because those regimes protect different interests and apply different legal standards. For example, the AI Act’s prohibitions protect all natural persons in commercial and noncommercial settings and require significant harm, while consumer-protection law may prohibit misleading or aggressive practices without requiring that threshold. A practice falling outside Article 5 may therefore still be unlawful under another EU law. Commission Guidelines, § 3.6, paras. 135–144.

Other Resources and Recommended Reading

• EU AI Act — Exploitation of Vulnerabilities — Article 5(1)(b) addresses vulnerabilities linked to age, disability or a specific social or economic situation. Recital 29 supplies the rationale.
• European Commission — Guidelines on Prohibited AI Practices — Explains the covered vulnerabilities, material distortion, significant harm and the relationship with Article 5(1)(a). See §§ 3.3–3.6, paragraphs 98–144.
• Unfair Commercial Practices Directive — Article 5(3) addresses identifiable vulnerable consumer groups; Articles 8–9 concern aggressive practices. See recitals 18–19.
• Charter of Fundamental Rights of the European Union — Articles 21 and 24–26 address nondiscrimination, children, older people and persons with disabilities; Article 1 protects dignity.
• General Data Protection Regulation — Articles 9 and 22 address sensitive data and automated decisions. Recitals 38, 51 and 71 explain children’s protection, special categories and profiling safeguards.

Related The De La Torre Review Articles

• Prohibited AI Practices Under the EU AI Act: Where Europe Draws the Line — Explains Article 5’s scope and the responsibilities of providers and deployers. Read the Article.
• Prohibited AI Practices Under the EU AI Act: When AI Persuasion Becomes Prohibited Manipulation — Explains the elements separating persuasion from prohibited harmful manipulation and deception. Read the Article.
• Prohibited AI Practices Under the EU AI Act: The Social Scoring Ban — Explains when evaluations of behavior or personal characteristics lead to prohibited adverse treatment and how social scoring differs from legitimate assessments. Read the Article.
• Prohibited AI Practices Under the EU AI Act: Limits on Crime Prediction — Examines the prohibition on predicting individual criminal conduct based solely on profiling or personal characteristics and the exception for supporting human assessments grounded in objective, verifiable facts. Read the Article.
• Prohibited AI Practices Under the EU AI Act: Facial-Recognition — Explains the ban on untargeted scraping of facial images from the internet or CCTV footage to create or expand facial-recognition databases. Read the Article.
• Prohibited AI Practices Under the EU AI Act: Emotion Recognition at Work and School — Examines prohibited emotional inferences from biometric data in workplaces and educational institutions, including the medical and safety exceptions. Read the Article.
• Prohibited AI Practices Under the EU AI Act: Inferring Sensitive Characteristics From Biometrics — Explains the prohibition on individual biometric categorization used to infer specified sensitive characteristics, its exclusions and its relationship with data-protection law. Read the Article.
• Prohibited AI Practices Under the EU AI Act: Real-Time Remote Biometric Identification — Explains the conditions, exceptions and safeguards governing real-time biometric identification in publicly accessible spaces for law-enforcement purposes. Read the Article.
• Prohibited AI Practices Under the EU AI Act: Non Consensual Intimate Material and Child Sexual Abuse — Examines the new Digital Omnibus prohibitions on generating or manipulating non-consensual intimate material or child sexual abuse material, including provider safeguards and deployer responsibilities. Read the Article.