Prohibited AI Practices Under the EU AI Act: What Website Owners Must Avoid
Understand the EU AI Act Article 5 bans, how manipulative AI and dark patterns affect websites, and the compliance safeguards website owners need now.
The EU AI Act doesn't just require transparency—it outright bans certain AI practices. If your website violates these prohibitions, you face penalties up to €35 million or 7% of your annual turnover.
Most website owners don't realize their AI-powered tools could be crossing these lines. This guide explains what's prohibited, how it applies to websites, and how to ensure your platform keeps you compliant.
Related: See our guide on EU AI Act Transparency Requirements for disclosure obligations.
What Are "Prohibited AI Practices"?
Article 5 of the EU AI Act establishes "unacceptable risk" AI systems that are banned throughout the EU. These prohibitions went into effect in February 2025—meaning they're already law.
Why These Practices Are Banned
The EU identified AI practices that:
- Manipulate human behavior to cause harm
- Exploit vulnerabilities of specific groups
- Enable social control or surveillance
- Threaten fundamental rights
For website owners: Most bans target government or enterprise systems, but two categories directly affect commercial websites—manipulation and dark patterns.
The Big One: Manipulative AI Systems (Article 5(1)(a))
This is the prohibition most relevant to websites and online businesses.
What's Banned
The AI Act prohibits AI systems that deploy "subliminal techniques beyond a person's consciousness" or "manipulative or deceptive techniques" to materially distort behavior in a way that causes or is likely to cause significant harm (Article 5(1)(a)).
In plain English: You cannot use AI to manipulate people into doing things they wouldn't otherwise do, especially if it harms them.
How This Applies to Websites
Many common website optimization techniques cross into prohibited territory when powered by AI:
Fake Scarcity Tactics
AI generates fake urgency signals or false social proof.
- AI generates "Only 2 items left!" when inventory is actually unlimited
- Dynamic countdown timers that reset for each visitor
- False "X people are viewing this" notifications
Exploitative Psychological Pressure
AI identifies vulnerability signals and applies targeted pressure.
- AI chatbot trained to detect hesitation and apply emotional pressure
- Systems that identify vulnerable users (financial stress, emotional state) and target them with manipulative messaging
- Dark pattern flows that make cancellation intentionally difficult
Hidden Persuasion Techniques
AI personalizes persuasion in ways users can’t detect.
- AI that adjusts pricing based on estimated willingness to pay (price discrimination)
- Systems that personalize content to exploit known cognitive biases
- Manipulative language generation designed to override rational decision-making
Aggressive Lead Generation
AI pressures users into sharing data or contact details.
- AI that creates fake urgency to extract contact information ("Sign up now or lose this forever!")
- Chatbots designed to wear down users into providing personal data
- Manipulative "limited time offers" that aren't actually limited
Not all persuasion is prohibited—only techniques that are manipulative, deceptive, or exploit vulnerabilities:
Legitimate marketing
- Genuine limited-time offers with real expiration dates
- Accurate inventory counts
- A/B testing to improve user experience
- Personalized recommendations based on browsing history
- Honest product comparisons
The "Significant Harm" Threshold
Not every manipulative technique is automatically illegal—it must cause or be likely to cause significant harm:
What counts as significant harm:
- Financial loss or damage
- Physical injury or health impacts
- Psychological harm
- Loss of fundamental rights
- Damage to reputation or relationships
Practical impact: A mildly pushy chatbot probably isn't "significant harm." A system that manipulates elderly users into buying unnecessary expensive services definitely is.
What About "Dark Patterns"?
Dark patterns—design tricks that manipulate users—have existed long before AI. The AI Act specifically targets AI-powered dark patterns.
The Key Difference
Traditional dark patterns (human-designed): Still regulated under consumer protection laws, but not the AI Act.
AI-powered dark patterns (AI-generated or optimized): Now explicitly prohibited under the AI Act if they cause significant harm.
Examples of AI-Powered Dark Patterns
❌ Prohibited:
- AI that automatically generates manipulative copy optimized for conversion without safety checks
- Machine learning systems that learn which dark patterns work best and implement them
- AI chatbots that dynamically adjust tactics based on user vulnerability signals
✅ Allowed with safeguards:
- AI content generation with built-in ethics filters
- Conversion optimization that respects user autonomy
- Personalization that improves experience without manipulation
How Your Website Builder Should Handle This
Essential safety features:
-
Content Safety Filters
- AI outputs screened before publication
- Automatic blocking of manipulative language
- Removal of false urgency indicators
-
Ethical Guardrails
- Prohibited from generating fake scarcity
- Cannot create misleading countdown timers
- Restrictions on pressure tactics
-
Human Oversight
- Review capabilities for AI-generated content
- Ability to preview before publishing
- Clear documentation of what AI generated
Red flags:
- "Optimize for maximum conversions" with no ethical constraints
- AI that generates content without human review
- No content safety policies documented
- Platform encourages manipulative tactics
Other Prohibited Practices (Less Common for Websites)
While less likely to affect standard business websites, be aware of these additional bans:
Social Scoring (Article 5(1)(c))
Prohibited: AI systems that evaluate or classify people based on social behavior or personal characteristics, leading to:
- Detrimental treatment in unrelated contexts
- Unjustified or disproportionate treatment
Website relevance: Don't use AI to automatically block, deprioritize, or discriminate against visitors based on profiling.
Exploiting Vulnerabilities (Article 5(1)(b))
Prohibited: AI that exploits vulnerabilities related to age, disability, or socioeconomic situation to materially distort behavior and cause harm.
Website relevance: Be especially careful if your audience includes:
- Children or teenagers
- Elderly users
- People in financial distress
- Individuals with cognitive impairments
Example violation: AI-powered payday loan website that identifies financially desperate users and uses manipulative tactics to push high-interest loans.
Biometric Categorization (Article 5(1)(e))
Prohibited: Using biometric data to infer sensitive characteristics (race, political opinions, sexual orientation) except for specific law enforcement cases.
Website relevance: Don't use AI to analyze visitor photos or videos to categorize them by protected characteristics—even if you think it's for "personalization."
Penalties and Fines Under the EU AI Act
Understanding the penalty structure helps you assess risk.
Penalty Tiers
The AI Act establishes three levels of penalties (Article 99):
| Violation Type | Maximum Fine |
|---|---|
| Prohibited AI practices (Article 5) | €35 million or 7% of global annual turnover (whichever is higher) |
| Non-compliance with obligations (high-risk systems) | €15 million or 3% of global annual turnover |
| Incorrect or incomplete information to authorities | €7.5 million or 1.5% of global annual turnover |
How Penalties Are Calculated
Enforcement authorities consider:
- Severity and duration of the infringement
- Intentional or negligent character
- Actions taken to mitigate harm
- Degree of responsibility considering technical/organizational measures
- Previous relevant infringements
- Level of cooperation with authorities
- SME status (smaller companies may receive reduced fines)
Real-World Impact
For small businesses: Even the lowest tier (€7.5 million) would be catastrophic. However, proportionality principle means actual fines scale with company size.
For influencers/solopreneurs: While unlikely to face maximum fines, you could still face:
- Cease-and-desist orders
- Website takedown requirements
- Injunctions prohibiting specific AI features
- Reputational damage
- Legal fees and compliance costs
The German Warning Letter Risk
In Germany specifically, competitors can send Abmahnungen (warning letters) for violations. These include:
- Immediate cease-and-desist demand
- Claims for legal fees (often €1,000-€3,000)
- Threat of court action if not resolved
What triggers warnings: Competitors actively scan websites for violations. AI-powered manipulation is an easy target for these letters.
How to Ensure Your Website Builder Keeps You Compliant
Questions to Ask Your Platform
1. "How do you prevent AI from generating manipulative content?"
Good answer
- ✅We have built-in content safety filters
- ✅AI outputs are screened for dark patterns
- ✅Ethical guidelines are part of our prompt engineering
Bad answer
- ❌You're responsible for reviewing content
- ❌Our AI optimizes for conversions (without mentioning ethics)
- ❌Vague or dismissive response
2. "Can your AI create fake scarcity or urgency indicators?"
Good answer
- ✅No, our system prohibits false inventory claims
- ✅Countdown timers must reflect actual deadlines
- ✅We don't support manipulative tactics
Bad answer
- ❌Yes, these features help conversions
- ❌You can customize urgency messages
- ❌No policies on truthfulness
3. "What happens if AI generates content that violates EU AI Act?"
Good answer
- ✅We maintain safety filters to prevent this
- ✅Content flagged for review before publication
- ✅We take responsibility for built-in compliance
Bad answer
- ❌That's your responsibility to check
- ❌We're not liable for how you use our tools
- ❌No answer or unclear liability
4. "Do you have documented AI ethics policies?"
Good answer
- ✅Yes, here's our AI ethics framework (with actual documentation)
- ✅We align with EU AI Act requirements
- ✅Regular audits of AI outputs
Bad answer
- ❌We're working on that
- ❌Not yet documented
- ❌Just follow terms of service
Essential Safety Features
Your website builder should provide:
- Pre-publication review for AI-generated content
- Content safety filters that block manipulative language
- Accuracy requirements for inventory, pricing, availability claims
- Documentation of what AI generated vs. human-created
- Override controls to disable aggressive optimization
- Ethical guidelines documented and enforced
- Regular audits of AI behavior
Red Flags That Should Worry You
Walk away if the platform:
- Explicitly markets "maximize conversions at all costs"
- Offers fake scarcity generators or manipulative countdown tools
- Has no content safety policies
- Disclaims all responsibility for AI outputs
- Can't explain their AI Act compliance approach
- Is dismissive of EU regulations
- Encourages tactics that sound like dark patterns
The Hidden Dynamics: Lovable, Replit, and Code-Generation Platforms
There's a special consideration for platforms like Lovable and Replit that generate entire applications from natural language prompts.
The Risk Scenario
What happens:
- You prompt: "Create an educational quiz platform"
- AI generates a complete application with dynamic content
- The AI may include optimization features without your knowledge
- Generated code might implement dark patterns automatically
- You deploy without reviewing all AI-generated logic
The problem: You're responsible for what the AI built, even if you don't fully understand the code.
Why This Is High-Risk Under EU AI Act
When AI generates a full application (not just a simple website):
- Complexity obscures manipulation: You can't easily audit what the AI created
- Dynamic behavior: The app might adapt to users in ways you didn't intend
- Educational content: If used for education (Article 5 high-risk category), additional scrutiny applies
- AI-generated grading: Automated assessment systems face specific requirements
What You Must Do
If using code-generation platforms for anything beyond simple static websites:
- Fully audit generated code before deployment
- Understand all AI-driven features the system includes
- Remove or modify any manipulative or concerning behaviors
- Document your review process (proof of due diligence)
- Consider legal review for complex applications
Key point: "I didn't know the AI added that" is not a legal defense.
Practical Compliance Checklist
Use this before launching your website:
Content Review
- Review all AI-generated marketing copy for manipulative language
- Verify all scarcity/urgency claims are factually accurate
- Check that countdown timers reflect real deadlines
- Ensure pricing is transparent and not discriminatory
- Remove any psychological pressure tactics
AI System Settings
- Enable all available content safety filters
- Configure AI to prioritize user autonomy over conversion
- Set up human review workflows for AI outputs
- Document which features use AI
- Test chatbot behavior for manipulative patterns
Platform Verification
- Confirm platform has documented AI ethics policies
- Verify they take responsibility for built-in compliance
- Check they have EU legal representation
- Review their track record on compliance issues
- Ensure they're monitoring AI Act developments
Ongoing Monitoring
- Regularly review AI-generated content
- Monitor chatbot conversations for concerning patterns
- Stay updated on platform's compliance changes
- Document your compliance efforts (evidence of good faith)
The Bottom Line
The EU AI Act's prohibited practices aren't just theoretical—they're enforced law with serious penalties. For website owners, the key risk areas are:
1. Manipulative AI that uses deception or psychological exploitation 2. Dark patterns powered by AI optimization 3. False claims generated by AI (scarcity, urgency, social proof)
The solution: Choose a website builder that:
- Takes compliance seriously with documented policies
- Builds safety into the AI system itself
- Doesn't make you personally responsible for all AI behavior
- Provides tools to review and control AI outputs
Remember: You're legally responsible for your website's behavior, even if you didn't write the code. Choose a platform that shares the compliance burden instead of putting it entirely on you.
How the Aimix platform helps meet EU AI Act requirements
Aimix is designed to produce EU-compliant websites from the start. It manages platform content in line with EU and German legislation, adhering to strict regulatory requirements without compromise. Learn more on our EU AI Act page: Aimix EU AI Act compliance.
Read next: EU AI Act Transparency Requirements: What Your AI Website Builder Must Include
Resources
EU AI Act on Prohibited Practices:
- Article 5 (Prohibited Practices): EUR-Lex
- Article 99 (Penalties): EUR-Lex
- EU AI Act Full Text: Regulation (EU) 2024/1689
Consumer Protection Context:
- EU Consumer Rights Directive: Directive 2011/83/EU
- German Unfair Competition Act (UWG): gesetze-im-internet.de
Further Reading:
- Article #1: EU AI Act Transparency Requirements
- Understanding C2PA Content Credentials
- AI Act Implementation Timeline
This article provides educational information but should not be considered legal advice. For specific compliance questions, consult with a qualified legal professional familiar with EU digital law and consumer protection.