What the prohibitions actually banned

The Record, written in October 2026. A retrospective. This piece covers February 2025, when the prohibitions in Article 5 began to apply, and was written afterwards from the documents. Nothing here was published at the time.

On 2 February 2025, Article 5 of the AI Act started applying. From that morning, certain uses of AI were not regulated, not notified, not registered — they were prohibited, with fines sitting behind them.

The trade press, reasonably, led with the dramatic cases: social scoring, real-time biometric surveillance in public spaces, systems that exploit a person's vulnerability to change their behaviour. Those are real and they are in the text. But an association reading only those headlines concluded the prohibitions were aimed at somebody else — a government, a police force, a disreputable data broker.

Two of the eight prohibitions were aimed squarely at employers, and employers are what associations are.

The one that reached into HR

Article 5(1)(f) prohibits the use of AI systems to infer emotions of a natural person in the workplace and in education institutions. Not to register them, not to report on them, to infer them at all. There is no risk-management route out, no derogation to apply for. It is banned, and it applied from February 2025.

By then, emotion-inference features had quietly arrived in ordinary software. A wellbeing survey that reads free-text answers and scores "sentiment risk" per team. A video-interview tool that reports on "engagement" and "confidence". A call-centre platform that flags an agent as "stressed" from vocal tone. Each of those was sold as analytics. From 2 February 2025, used on staff, each of them was a prohibited practice.

The distinction that matters, and that was widely muddled: a personality questionnaire is not emotion recognition. A psychometric test that asks a candidate to answer questions about themselves is not inferring emotion from their body or their voice. A tool that watches their face on a webcam and reports what it thinks they feel is. The first is lawful, subject to the ordinary data-protection rules. The second was banned outright.

The one that reached into membership

Article 5(1)(c) prohibits biometric categorisation systems that sort people by inferring race, political opinions, trade-union membership, religious or philosophical beliefs, sex life or sexual orientation.

For a trade association, trade-union membership and political opinion are not abstract categories. They are the organisation's reason for existing, written into its membership records. Any supplier proposing to "enrich" a member database by inferring attributes from names, photographs or public profiles was proposing a prohibited practice, and the prohibition applied before the enrichment ran, not after.

What was not banned, and people assumed was

Two persistent myths, both of which cost associations money.

"We cannot use AI on CVs." Screening and ranking candidates is not prohibited. It is high-risk, which means a long list of obligations for the provider of the tool and a shorter, real list for the employer using it: follow the instructions, keep human oversight, retain the logs. The obligations were deferred in July 2026 to December 2027. The tool was never illegal.

"We need consent for everything." The AI Act does not run on consent. It runs on prohibitions, risk classification and transparency. Consent is the GDPR's instrument, and it still applies — but an association that built its entire AI policy around a consent banner had answered a question nobody was asking.

What February 2025 actually changed

Not much, operationally, for an association that had done nothing. That is the uncomfortable part. The law changed and the world did not visibly change with it, which is exactly why the next twelve months were spent catching up.

What it changed legally was the existence of a floor. Before 2 February 2025, an association could argue that a badly chosen tool was a procurement error. After it, the same tool was a prohibited practice with a penalty attached, and the argument moved from "we should review this" to "we should not have bought this".

The inventory that would have taken a week in 2024 took a quarter in 2025, because by then it had a deadline and a lawyer attached. The work was identical. Only the price of doing it late had changed.

---

The Record · ← The eighteen months nobody prepared for · AI literacy is an obligation, not a training course →

---

Running an association? The AI Act for associations — what your body must actually do sets out the whole thing on one page: whether you are a provider or a deployer, the four duties that reach a membership body, the dates that matter, and the five items of evidence a board will ask for.