Does the EU AI Act Even Apply to Your Software? What Counts as an 'AI System'

Before you spend a minute on risk tiers, obligations, or deadlines, there is an earlier question worth answering: does the EU AI Act even apply to what you have built? The Act only regulates something it calls an "AI system," and that phrase has a specific legal definition. Plenty of software that gets called AI in a pitch deck does not meet it, and some software nobody markets as AI does.

This is one of the more useful things to get right, because it decides whether the rest of the Act is your problem at all. And we are not guessing at the edges. In February 2025 the European Commission published formal guidelines on how to apply the definition, which is where most of the detail below comes from.

The definition, in plain terms

Article 3(1) defines an AI system as a machine-based system that, for explicit or implicit objectives, infers from the input it receives how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments. It operates with some degree of autonomy, and it may adapt after it is deployed.

Lawyers split that into seven elements, but you do not need to memorise them. What matters is that the definition is deliberately broad and technology-neutral. It does not care whether you used deep learning, a statistical method, or a logic-based approach. Modern machine learning is in. Some older statistical and logic-based methods are in too.

The line that matters: inference

If the definition is that wide, what is actually left out? The Commission is clearest on one element, and it is the one doing the real work: inference. An AI system infers how to produce its output. It is not told, step by step, exactly what to do in every case.

Contrast that with software that only executes rules a person wrote out in full. A tax calculator applying bracket thresholds a human coded. A form validator checking whether an email address contains an @ sign. A classic chess engine searching moves with a fixed algorithm. These follow instructions. They do not infer. The Commission says plainly that systems based on rules defined solely by natural persons are not AI systems.

What falls outside the definition

Drawing on the Commission's own examples, these generally sit outside the "AI system" definition:

• Traditional rule-based software where a person specified all of the logic
• Simple heuristics and classic search algorithms that do not evolve from data
• Basic statistical estimators and plain descriptive analytics
• Straightforward data visualisation and reporting tools
• Systems that run only under full manual human control, with no independent operation

So a rules engine that flags a payment because it crosses a fixed threshold you set is probably not an AI system. Replace that with a model that learned what fraud looks like from historical data, and you are almost certainly back inside the definition. Same goal, different mechanism, different answer.

Why this is not an escape hatch

Here is the honest part, because it matters more than the neat examples. It is tempting to read all of this as a way out, and we would not lean on it too hard. Three reasons.

First, the line is fuzzier in practice than on a page. A lot of systems that feel rule-based have a learned component somewhere, and that can be enough to pull them in. Second, the Commission's guidelines are guidance, not the final word. A national authority or a court can read a borderline case differently. Third, being outside the AI Act does not put you outside every other law. GDPR still applies to the personal data, and your sector's rules still apply to your sector.

How to tell where you land

Two questions settle most cases. Does your system infer or derive how to generate its outputs, rather than following rules a person wrote out in full? And does it operate with at least some independence, rather than only under full manual control? If the answer to both is yes, it is an AI system under the Act, and the next question is which risk tier it falls into, which turns on what you use it for rather than how it is built. We walk through that in how to classify AI systems under the EU AI Act.

None of this needs a law degree. It needs an honest look at how your system actually works. Most teams know the answer once they stop asking whether their product sounds like AI and start asking whether it infers.