When personalisation becomes prohibited: the AI Act's ban on manipulation and exploiting vulnerabilities

Article 5(1)(a) and (b) of the EU AI Act ban AI systems that use subliminal, purposefully manipulative or deceptive techniques, or that exploit vulnerabilities linked to age, disability or a specific social or economic situation, where this materially distorts behaviour and causes, or is reasonably likely to cause, significant harm. The bans have applied since 2 February 2025 and carry the Act's highest fines: up to €35M or 7% of worldwide annual turnover. Because the test covers the objective or effect of a system, not just intent, online retailers should look closely at conversion-optimised recommendation and pricing engines, AI-generated false urgency, and targeting that steers credit or high-spend offers toward financially stressed users, compulsive buyers or likely minors. Recital 29 keeps lawful advertising outside the ban, but the line is crossed once a system undermines informed choice and leads to significant harm. Best practice is to add a manipulation review to model governance: check optimisation objectives, screen features for proxies of vulnerability, stress-test generated copy, and align the review with existing Unfair Commercial Practices Directive and Digital Services Act dark-pattern checks.