The European Commission has published its first report under Article 112(1) of the AI Act, assessing whether the EU’s lists of prohibited artificial intelligence practices and high-risk AI systems should be updated.

The report, issued on 20 May 2026, reviews the framework established by the Regulation (EU) 2024/1689 (AI Act), which entered into force in 2024 and introduces a risk-based system for regulating AI across the EU. It examines whether the current list of prohibited AI practices (Article 5) and the list of high-risk AI use cases (Annex III) remain adequate in light of early implementation experience and emerging risks.

Overall, the Commission concludes that it is still too early to make major changes, as many provisions have only recently started to apply and enforcement mechanisms are not yet fully operational. However, the report identifies potential regulatory gaps that require further monitoring.

In particular, the Commission highlights concerns around AI systems generating non-consensual intimate deepfakes, including child sexual abuse material, which may not be fully covered by existing prohibitions. It also flags risks linked to AI-driven fraud, political disinformation, and certain AI companions or mental health chatbots, recommending closer observation as evidence develops.

On high-risk AI systems listed in Annex III, most stakeholders and Member States do not currently support expanding or removing existing categories. Nevertheless, the Commission notes areas requiring further analysis, such as AI use in public administration, eligibility decisions for services, and AI systems used in debt collection or critical infrastructure.

The report is based on consultations with Member States, stakeholders, and analysis of AI incident databases, including over 3,700 reported cases. These were used to assess real-world risks and potential gaps in the regulatory framework.

The Commission stresses that this is an early-stage evaluation and that more substantial conclusions will only be possible once enforcement of the AI Act matures. A further annual review is expected in 2026, when additional evidence and implementation experience will inform possible legislative updates.