Is your software actually an "AI system" under the EU AI Act?

Almost every EU AI Act obligation sits behind one gate: is the thing you built or bought an "AI system" at all? If it is not, the Act's rules on AI systems do not reach it — not the high-risk regime, not the transparency duties, not the prohibitions. (The separate rules for providers of general-purpose AI models attach to the model, not to this definition.)

This question is easy to skip, and it has a real answer. Article 3(1) of Regulation (EU) 2024/1689 supplies the definition, and the Commission has published guidelines on how to apply it — including four named categories of software that can fall outside it, with worked examples.

This is an information service to help you plan, not legal advice. To see which duties follow once you are through this gate, check which obligations apply to your company.

The definition, and the one element that decides most cases

Article 3(1) defines an AI system as:

"a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments"

The Commission's guidelines break that into seven elements: (1) a machine-based system; (2) designed to operate with varying levels of autonomy; (3) that may exhibit adaptiveness after deployment; (4) for explicit or implicit objectives; (5) infers, from the input it receives, how to generate outputs; (6) such as predictions, content, recommendations or decisions; (7) that can influence physical or virtual environments.

Two points matter more than the list itself.

First, the elements need not all be present at once. The guidelines note that the definition takes "a lifecycle-based perspective" across a pre-deployment "building" phase and a post-deployment "use" phase, and that the seven elements "are not required to be present continuously throughout both phases".

Second, one element does the real work. On the fifth element the guidelines are explicit: the capability to infer is "a key, indispensable condition that distinguishes AI systems from other types of systems". If your software does not infer how to generate its outputs, the other six elements cannot make up for it.

Note also element (3): the system "may" exhibit adaptiveness. Self-learning is optional, not required. A frozen model that never updates after deployment can still be an AI system. This is where a lot of internal "it doesn't learn, so it isn't AI" reasoning goes wrong.

One trap runs the other way. Inference is not only machine learning. Recital 12 also names "logic- and knowledge-based approaches that infer from encoded knowledge or symbolic representation of the task to be solved", and the guidelines (paragraph 39) list knowledge bases, inference and deductive engines, (symbolic) reasoning and expert systems among the AI techniques, even though the rules and facts such systems reason over were written by human experts. One of their examples is an early-generation medical-diagnosis expert system, built by encoding the knowledge of medical experts to draw conclusions from a patient's symptoms. What Recital 12 excludes is software that simply executes rules defined solely by people; the guidelines' description of basic data processing (paragraph 46) is systems that operate on fixed human-programmed rules "without using AI techniques, such as machine learning or logic-based inference". A rules engine that reasons over encoded knowledge to reach its own conclusions can still be an AI system.

The line here is not sharp. Elsewhere (paragraph 55) the same guidelines give "certain non-AI medical device expert systems" as an example of non-AI systems typically based on historical data, scientific data or predefined rules, so not every expert system is treated as AI. If you run a rules or inference engine, particularly in a use case that could be high-risk, assess it on its own facts rather than assuming "rules-based" means out of scope.

The four categories that fall outside

This is the practically useful part, and it comes straight from section 5.2 of the guidelines. The starting point is Recital 12 of the AI Act, which says the definition should rest on key characteristics that distinguish AI systems from "simpler traditional software systems or programming approaches" and "should not cover systems that are based on the rules defined solely by natural persons to automatically execute operations".

The guidelines then name four categories that "have the capacity to infer in a narrow manner but may nevertheless fall outside of the scope of the AI system definition because of their limited capacity to analyse patterns and adjust autonomously their output":

Category	What it covers	The Commission's own examples
Systems for improving mathematical optimisation	Systems that accelerate or approximate "traditional, well established optimisation methods, such as linear or logistic regression" — they "do not transcend 'basic data processing'"	ML models approximating cloud microphysics or turbulence to speed up physics-based weather simulation; ML predicting network traffic to allocate satellite bandwidth
Basic data processing	Systems following "predefined, explicit instructions or operations ... without any 'learning, reasoning or modelling' at any stage"	Database management systems sorting or filtering ("find all customers who purchased a specific product in the last month"); standard spreadsheet software without AI features; software calculating a population average from a survey
Systems based on classical heuristics	"Predefined rules or algorithms" and trial-and-error strategies "rather than data-driven learning"	A chess program using a minimax algorithm with heuristic evaluation functions, which "can assess board positions without requiring prior learning from data"
Simple prediction systems	Systems "whose performance can be achieved via a basic statistical learning rule" — outside the definition because of their performance, even if technically machine learning	Predicting stock prices with a "mean" strategy (always predict the historical average); using last week's average temperature to predict tomorrow's; static estimation of mean customer-support resolution time; trivial demand forecasting by average

The fourth row is the one worth re-reading. The guidelines say these systems "technically may be classified as relying on machine learning approaches" and still fall outside — the test is what the system achieves, not which library you imported. That performance test is the Commission's own, and a genuinely useful one. Its example is "an estimator with the 'mean' strategy" that always predicts the historical average; on the guidelines' reading, a model that does no more than that is outside the definition even if you built it with a machine-learning library. (Like the rest of the guidelines, that is an indicator rather than a safe harbour; see the cautions below.)

There is a matching caution on the first row. The guidelines allow that such systems "may incorporate automatic self-adjustments", but only where those adjustments target "optimising the functioning of the systems by improving its computational performance rather than ... permitting adjustments of their decision making models in an intelligent way". Self-tuning for speed is fine. Self-tuning what the system decides is not.

Working the test on real software

Your software	AI system?	Why
Approval workflow with thresholds a human wrote ("flag invoices over €10,000")	Almost certainly not	Rules defined solely by natural persons to execute operations automatically (Recital 12)
Sales dashboard showing totals, regional averages and trends	No	Descriptive analysis and visualisation; "does not recommend how to improve sales or which products to promote"
The same dashboard, now recommending which accounts to prioritise	Likely yes, if a trained model produces the ranking	A learned model infers how to generate the recommendation; a ranking by rules a person wrote generally would not (the guidelines note that non-AI systems can make recommendations too)
Demand forecast that predicts each day's sales as the historical average	No	Simple prediction system — baseline/benchmark performance
Demand forecast using a trained time-series model on many features	Likely yes	Transcends basic data processing
Chatbot answering from a hand-written decision tree	Probably not	Predefined rules, no inference
Chatbot built on a language model	Yes	Infers content from input
Spreadsheet with formulas and pivot tables	No	Standard spreadsheet software without AI-enabled functionality
CV-screening tool ranking candidates on learned patterns	Yes — and likely high-risk; see HR and recruitment software	Infers a recommendation, and lands in a sensitive area

If your answer is "yes", the next question is which tier you are in — start with is your AI system high-risk?, then which obligations apply.

If your answer is "no", write down why, against the category and the element that fails. A documented, reasoned scope conclusion is worth a great deal more than an undocumented one if a market surveillance authority ever asks — and unlike most compliance artefacts, this one is usually quick to produce.

Three cautions before you conclude you are out

1. The guidelines are not binding, and the edges are deliberately soft. The guidelines state plainly that they "are not binding" and that "[a]ny authoritative interpretation of the AI Act may ultimately only be given by the Court of Justice of the European Union". They also warn that the definition "should not be applied mechanically; each system must be assessed based on its specific characteristics", and that no exhaustive list of AI systems is possible. Treat the four categories as strong indicators, not as safe harbours.

2. "Not an AI system" is not the same as "unregulated". Falling outside Article 3(1) takes your software out of the AI Act's rules on AI systems. It does nothing about the GDPR, sectoral product-safety law, the Digital Services Act, employment law or anything else that already applied to your software.

3. The definition has applied since 2 February 2025. It came into application with Chapters I and II, alongside the original Article 5 prohibitions (the two prohibitions added by the Digital Omnibus, in Article 5(1)(ba) and (bb), apply from 2 December 2026). This is not a future problem.

Citing the guidelines correctly

If you cite the guidelines — in a policy, a due-diligence pack, or a customer questionnaire — cite them correctly. The operative instrument is:

Communication from the Commission, C(2025) 5053 final, Brussels, 29.7.2025 — Commission Guidelines on the definition of an artificial intelligence system established by Regulation (EU) 2024/1689 (AI Act)

That reference is taken from the cover page of the document itself. The guidelines are often cited instead under a February 2025 reference: the Commission first announced them on 6 February 2025, and its library page still shows that publication date. The February document is the internal communication approving the draft content; the guidelines that were actually issued are the July instrument above.

This is the same two-document pattern as the prohibited-practices guidelines, whose operative reference is likewise a 29 July 2025 communication rather than the February one usually quoted. If your compliance file cites the February references, it cites approval paperwork rather than the guidance.

The guidelines were required of the Commission by Article 96(1)(f) of the AI Act, and were adopted in parallel with the prohibited-practices guidelines precisely because the definition governs the scope of the Article 5 prohibitions too.

One thing in the guidelines that the law has since overtaken

Worth knowing if you are relying on the document: footnote 6 of the guidelines describes Article 111(2) as it stood before the Digital Omnibus amended it.

It states that systems already placed on the market or put into service before 2 August 2026 benefit from the grandfathering clause in Article 111(2). That matched Article 111(2) when the guidelines were issued in July 2025. It no longer tells the whole story: high-risk systems placed on the market or put into service before 2 August 2026 are still covered by the clause, but on the natural reading of the amended text (explained below) 2 August 2026 is no longer the cut-off.

Article 111(2), as amended by Regulation (EU) 2026/1744, no longer names a fixed date. It provides that the Regulation applies to operators of high-risk AI systems placed on the market or put into service before "the date of application of Chapter III referred to in Article 113" only if, from that date, those systems "are subject to significant changes in their designs". Under the amended Article 113, Chapter III Sections 1–3 apply from 2 December 2027 for Annex III high-risk systems and 2 August 2028 for Annex I ones. Providers and deployers of high-risk systems intended for use by public authorities must comply by 2 August 2030 in any case.

Read naturally, then, the grandfathering line moved later, not earlier: it now floats with the Chapter III Sections 1–3 dates above rather than sitting on 2 August 2026. But Article 113 applies different parts of Chapter III from different dates (Section 4 from 2 August 2025, and Section 5, Articles 40–49 on standards, conformity assessment, certificates and registration, from the general date of 2 August 2026, the old cut-off), so the amended text does not say in terms which Chapter III date it means. Recital 39 of Regulation (EU) 2026/1744, which explains the Article 111(2) change as giving "sufficient time for providers of high-risk AI systems" and ties the grace period to when "the relevant provisions" apply, supports the Sections 1–3 reading; and a reading that kept 2 August 2026 would leave the amendment changing nothing about the cut-off. Still, it is a reading of an ambiguous text, not a settled rule, and the difference is real: an Annex III high-risk system first placed on the market in October 2026 is grandfathered on the Sections 1–3 reading (so long as its design is not significantly changed) but not on the literal one. If your position depends on a system placed on the market after 2 August 2026 being grandfathered, take advice. As at 29 September 2026, the English guidelines on the Commission's library page still carry footnote 6 unchanged, and the AI Act Service Desk's own Article 111 page still displays the pre-Omnibus text under a notice that it "has not yet been updated to reflect those amendments".

And one transitional deadline on 2 December 2026. Separately from the grandfathering rule, Article 111(4) requires providers of AI systems — including general-purpose AI systems — "generating synthetic audio, image, video or text content" that were placed on the market before 2 August 2026 to comply with Article 50(2) (machine-readable marking of synthetic content) by 2 December 2026. If you shipped a generative feature before 2 August 2026, that is your date. See the 2 December 2026 deadline, Article 50: what you must disclose and the wider AI Act timeline.

What to do now

1. List your candidate systems — anything anyone in the company calls "AI", plus anything with a model, a score, a ranking or a generated output.
2. Run each against element five first. Does it infer how to generate its output (from a learned model, or by reasoning over encoded rules and knowledge as an expert system does), or does it simply execute rules a person wrote? That single question resolves most of the list.
3. For the ones you are excluding, name the category — mathematical optimisation, basic data processing, classical heuristics, or simple prediction — and record the reasoning in a sentence or two.
4. Do not exclude on "it doesn't learn". Adaptiveness is optional in the definition.
5. Check whether you shipped anything generative before 2 August 2026. If so, Article 111(4) gives you until 2 December 2026 on Article 50(2).
6. Re-check scope if you are outside the EU — the definition is only the first gate; territorial reach is a separate one, covered in does the EU AI Act apply to companies outside the EU?.

Getting this gate right is the cheapest compliance work available: it narrows everything downstream. If you would rather be told when the guidance behind it changes than re-read it yourself, join the waitlist — or work through which obligations apply to you now.

The official text is Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744; article references are to the consolidated version as at 27 July 2026. The guidelines quoted are Communication from the Commission C(2025) 5053 final of 29 July 2025, which are non-binding. This article is an information service to help you orient — it is not legal advice, and you should confirm the position against the official sources before acting.