Drawing the line around AI

Most definitions of artificial intelligence are written to impress. A working definition has to do something harder: tell you whether a particular thing in your organisation is caught by a particular rule.

The useful question is not whether a system is clever. It is whether the system infers. Ordinary software applies rules a person wrote down. An AI system derives its behaviour from data, which means nobody wrote down the rule it is applying, and often nobody can state it afterwards.

That single property is what the obligations attach to, because it is what makes a system hard to predict, hard to explain, and hard to hold anyone accountable for.

What the law actually says

The EU AI Act defines an AI system in Article 3(1) as a machine-based system designed to operate with varying levels of autonomy, that may exhibit adaptiveness after deployment, and that infers from the input it receives how to generate outputs such as predictions, content, recommendations or decisions that can influence physical or virtual environments.

Read that again for the load-bearing word. It is infers. Autonomy varies. Adaptiveness is optional, which is why "it does not learn in production" is not a defence. Inference is the constant.

This matters more than it sounds. A spreadsheet that scores loan applications using a formula in column H is not an AI system, however consequential its output. A model trained on past lending decisions that produces the same score is, even if the two agree nine times out of ten. The difference is not the consequence. It is whether a person can point at the rule.

Why "is it AI?" is the wrong first question

People reach for the definition hoping it will exclude them. It rarely does, and arguing about the boundary is usually a poor use of the argument.

A better question is: what happens to a person when this is wrong? If the answer is "a slightly worse film recommendation", the definitional question is academic. If the answer is "their claim is declined, or their application never reaches a human", then you are in scope of something, and which instrument applies is a question for the classification record rather than for a debate about whether the tool deserves the name.

The Act reflects this. Its obligations do not scale with how sophisticated a system is. They scale with what the system is used for. A simple model deciding creditworthiness carries far heavier duties than a sophisticated one recommending music.

Three things that are AI and are usually missed

AI inside software you bought. A summarisation feature switched on by a vendor update is an AI system in your organisation, whether or not anyone decided to adopt it.

AI someone is using without telling you. Pasting a customer complaint into a public chatbot to draft a reply is a deployment. It is unrecorded, unassessed, and it has already happened.

AI you built years ago. The propensity model from 2019 that still runs nightly did not stop being an AI system because it is old and nobody talks about it.

Where the line genuinely sits

Plain automation is not AI. A workflow that routes an invoice above a threshold to a second approver is a rule, written by a person, inspectable by anyone. Statistical reporting is not AI either: an average is a description of what happened, not an inference about what to do.

The grey area is narrower than people hope, and it tends to be older statistical models. A logistic regression fitted to historical data infers. It is not fashionable, and it is squarely within the definition.

As of 24 September 2026.