Is it even an AI system?
Every obligation in the Act hangs off this definition, and a surprising amount of enterprise software sits near the line. Get the answer wrong in one direction and you build a compliance programme you did not need. Get it wrong in the other and you have none at all.
The definition, in five elements
Article 3(1) is one sentence doing five jobs. Take them separately.
| Element | What it does |
|---|---|
| Machine-based | Excludes purely human processes. Almost never the deciding factor. |
| Varying levels of autonomy | Some independence from human involvement. A system requiring a human to press go each time still qualifies. |
| May exhibit adaptiveness after deployment | “May”. Optional. A frozen model that never retrains is not excluded by this. |
| For explicit or implicit objectives | The objective need not be stated anywhere. |
| Infers how to generate outputs | This is the test. Everything contested turns on it. |
The inference test
The question is whether the system derives how to produce its output from the input it receives, or whether a human wrote out the rules in full and the machine executes them. The Commission’s guidelines on the definition indicate that systems based on rules defined solely by natural persons to automatically execute operations fall outside.
Put practically: did the behaviour come from data, or from a specification a person wrote?
Where this usually goes next
Three situations account for most people reading this page. Each has a different answer.
A deal is blocked on an AI questionnaire
Legal will not sign until you can evidence how AI is governed. HumanAudit’s AI Trust Package is a fixed $3,500 over five business days: a public trust page, a pre-filled SIG Lite / CAIQ / SSPA Section K questionnaire bank, and your AI inventory and classification.
You need ISO/IEC 42001 documentation
23 clause-mapped AIMS documents with all 38 Annex A controls pre-populated, editable and yours to keep, from $199. Or score your gaps first: 18 questions, free, no signup to begin.
You are not sure what reaches you
Twenty minutes with the founder. No prep, no deck, straight to the person accountable for the work. If none of this applies to you, you get told that on the call.
This reference is published by HumanAudit Inc. Not a law firm, not an accredited certification body, not a registered auditor. We build documentation, your counsel interprets it, and an accredited body of your choosing certifies you. How this is funded →
Where the line falls
Not an AI system
- Rules engines where a human specified every rule
- Deterministic eligibility calculators
- Conventional BI dashboards and descriptive statistics
- Optimisation solvers running a human-specified objective with no learned component
- Keyword search and boolean filters
An AI system
- Any model whose parameters were learned from data
- LLMs and everything built on them
- Classifiers, recommenders, ranking models
- Computer vision, speech recognition, OCR with a learned component
- Forecasting models fitted to historical data
The three genuinely hard cases
- Fitted statistical models. A logistic regression scorecard whose weights were estimated from data has inferred. A scorecard whose weights a credit officer chose has not. Same maths, different answer.
- Hybrid systems. A rules engine with one learned component is, in our reading, an AI system: the definition attaches to the system, not to its cleanest subcomponent.
- Bought software you cannot see inside. You often cannot tell. Ask the vendor in writing and keep the answer. That question belongs in your vendor due diligence questionnaire, not in a compliance review two years later.
Status label
Verified: the text of Article 3(1) and the existence of Commission guidelines on the definition. Expert analysis: the placement of specific technologies above, and the hybrid-system reading. Unsettled: the treatment of fitted statistical models, on which reasonable practitioners disagree and no enforcement decisions exist.
What to do at the boundary
Do not resolve it by assertion in either direction. Write a short determination for each system: what it does, whether any component learned its behaviour from data, which limb of the definition you rely on, who decided, and when. Half a page.
Two reasons. First, if you conclude “not an AI system” and an authority disagrees, an undocumented conclusion looks like an unconsidered one. Second, Article 4 AI literacy applies to providers and deployers of AI systems, so the same determination tells you whether a live obligation already binds you.
Turn determinations into an inventory
One determination is a note. Forty determinations, kept current, with the role and risk tier recorded against each system, is the artefact that answers procurement questionnaires, seeds a conformity assessment and satisfies an auditor.
Not sure where you sit?
The classifier maps your system against Articles 5, 6, 50 and Annex III. Twelve questions, no email.
Questions
What is the EU AI Act definition of an AI system?
Article 3(1) defines an AI system as a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations or decisions that can influence physical or virtual environments.
Is traditional software an AI system under the EU AI Act?
Not automatically. The distinguishing element in the Article 3(1) definition is inference: the system derives how to generate outputs from the input it receives, rather than following rules a human wrote out in full. The Commission's guidelines on the definition indicate that systems based on rules defined solely by natural persons to automatically execute operations fall outside the definition. Rules-based decision engines, deterministic scoring formulas and conventional statistical reporting are generally outside; a model whose parameters were learned from data is generally inside.
Does a linear regression count as an AI system?
It depends on how it is built and used, and the answer is genuinely contested. A regression whose coefficients were estimated from data is inferring rather than following human-specified rules, which points inside the definition. A simple mathematical formula written by an analyst points outside. Because the boundary matters so much for obligations, providers should document the reasoning rather than assume either way.
Who decides whether something is an AI system?
In the first instance the provider does, and it should record that decision. A market surveillance authority may disagree. The Commission has issued guidelines on the definition of an AI system to support consistent application; guidelines are not binding but authorities and courts will refer to them.