Quick answer: AI systems are machine-developed systems that, based on some input, use AI techniques to infer what (prediction, content, recommendation or decision) should be outputted that can have impact on physical or virtual environments. Today this is almost synonymous among the OECD, NIST and ISO/IEC 22989 and throughout the EU AI Act. An AI system isn’t just an AI model, it contains the interface as well as the data flows and controls surrounding the interface.
The Official Definition
According to the EU AI Act, Article 3(1): An AI system is a machine-based system that is designed to operate with varying degrees of autonomy and that can be able to adapt its behavior after deployment – a machine that generates outputs based on inputs it faces after deployment. The European Commission’s guidelines addresse this in 7 components and mention 4 different kinds of outputs: predictions, content, recommendations and decisions. They also say that the definition, AI systems are not passive, but active.
The definition was intentionally modified to reflect the updated language used by OECD. The OECD text is a source that has been imported, with minor modifications, by the EU Act and ISO/IEC 22989 while NIST used an earlier version, one explainer says. NIST’s definition is a more general one that does not specify any autonomy criterion.
What Doesn’t Count
Recital 12 of the AI Act says the definition aims to distinguish AI systems from simpler traditional software and shouldn’t cover systems based solely on rules defined by people to execute operations automatically. Systems that require complete manual (human) interaction are also not covered. Any AI system used solely for military purposes are outside the scope of the Act pursuant to Article 2(3).
Classification matters. If it doesn’t fit the definition the regulation would not apply to the product. If so, this is followed by imposing of great onerous requirements, such as conformity assessments and technical documentation, risk management, post market monitoring and registration in an EU database.
Model vs System
It is common to see the two terms used interchangeably and neither do regulators. The weights, architecture and learned parameters of the trained artefact is a model. The interface, data pipeline and surrounding logic are made part of a system. The only law to differentiate between the two is the EU AI Act, where general purpose AI models are a distinct category.
The same applies to agents. In the Commission’s AI Act service desk, the agents they are using are said to be not a separate category of AI covered by the Act. The rules for an AI system, and rules for a model, apply to the agent if it has at least one model (usually a general purpose model) and if it typically includes some kind of interface. If all the agents are performing a single user-oriented function, one source suggests to consider the assembly as one AI system with parts. ISO also indicates that a combination of AI components can be used to create an AI system.
Different Types
The type of category varies from the source. Common type(s) are listed together on this editorial table by function and classification is only meant as a general guide and not legal advice.
| Type | Example | Possible an AI system? |
| Data mining | Yes, if it infers outputs from dataPredictive Fraud scoring, demand forecasting | Yes, if it infers outputs from data |
| Other generators such as Generative Chatbots, image and code generators | Yes | |
| Recommendation | Content and product recommenders | Yes |
| Yes Autonomous or agentic | Robots, vehicles, workflows that operate without human intervention and approval on other systems | |
| Probably not, per Recital 12; Rule based, or a calculator or fixed if then workflow | ||
| Manual with assistive device | A tool that requires a person to use it as their only means of input (those not used for manual-only operation are excluded) | Excluded |
As described by one explainer, autonomous systems encompass examples such as robotics, autonomous vehicles, and agentic workflows that require actions of external systems, but don’t include a human approval process.
Five Question Test
Five Question Test (Original Framework)
Apply this to understand what may constitute an AI system or not. It’s a simplified version of that definition in the editorial; if it does really matter, check the legalese.
- Is it machine-based? It is software/service based or hardware.
- Is it a suggestion of input? Does it work out to make any outputs rather than a script?
- What is the result it prints? Predictions, content, recommendation or decisions?
- Is it a factor that affects an environment? Physical or virtual?
- Is there some independence of operation? Any amount is a good amount to have.
If you answered in the negative to that second question, it is likely that a rules-only system is not within the definition.
Regulation Timeline
The EU AI Act came into force on August 1, 2024 and will take effect in parts on August 2, 2026 and August 2, 2027. As per the Commission’s FAQ, the requirement for Annex III high-risk systems and Article 50 transparency requirements start on August 2, 2026. The Commission has also recommended modifications to the procedures in the Act, meaning that timelines may change. Please verify dates with official service desk.
AI System Inventory Checklist
This is AI System Inventory Checklist (Linkable Asset).
- Identified all the tools and features that leverage AI.
- The systems and models they separate.
- Used the five question test for each
- Responsible person who builds and deploys each of these systems.
- Noted if any system does not require human approval
- Data that have been recorded are the output and input data objets.
- Marked any items that could be high risk
- Assigned an owner for each system
- Described the characteristics of multi-agent configurations
- Met with the list quarterly
Guest Post Angles
Here are a few topics that fit AI governance, compliance and developer publications:
- Model or system? How the legal difference is important.
- The role of agentic AI in the EU AI Act: who’s responsible?
- The first step towards compliance is to build an AI inventory.
Initiate the System Boundary First
Determine the start and end points of each system before discussing rules and/or risk. Describe the model, the interface, the data the model has access to and the actions the model may perform. Defining the boundary makes it much easier to classify the system, define ownership and validate the extent of regulation. For anyone managing an AI system, this is the most helpful initial act.
2 Responses