What counts as an AI system under the EU AI Act?

One definition decides whether the EU AI Act applies to your system at all. Under Article 3, point (1), an AI system is a machine-based system that, for explicit or implicit objectives, infers from the input it receives how to generate outputs capable of influencing physical or virtual environments. Inference is the hinge; nothing else on this page moves without it.

Written 10 August 2026 against Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744.

Quick answer

• Seven limbs, one sentence. Article 3, point (1) packs seven conditions into one definition. Read them apart before deciding.
• Adaptiveness is optional. An AI system may exhibit adaptiveness after deployment. A model frozen at release still qualifies.
• Autonomy is a range, not a threshold. A human approving every output does not take the system out.
• The Regulation defines what an AI system is. It never counts them. How many systems that makes is its own question, answered in how many AI systems do you have.

What does Article 3, point (1) actually require?

The definition is one sentence, and one sentence is where limbs go missing. Pulled apart, an AI system is:

• a machine-based system;
• designed to operate with varying levels of autonomy;
• which may exhibit adaptiveness after deployment;
• which, for explicit or implicit objectives;
• infers, from the input it receives, how to generate outputs;
• outputs such as predictions, content, recommendations, or decisions;
• that can influence physical or virtual environments.

Two of those are permissions, not requirements, and both get summarised into their opposite. May exhibit adaptiveness means self-learning is not required: a model trained once and never retrained is inside the definition. Varying levels of autonomy describes a range, so a system whose every output a person signs off is not excluded by that fact. A summary reading learns and adapts autonomously is silent about the two words that decide most real cases.

Two further limbs are wider than they look. Objectives may be implicit, so nothing turns on whether anyone wrote one down. And the output list is introduced by such as — it illustrates, it does not close. A ranking, a score, a routing decision and a generated paragraph are all outputs here.

What falls outside, and what is "solely" doing there?

Recital 12 is the Regulation's own account of what the definition is for. Recitals do not create obligations; they explain the enacting terms. This one says the definition "should be based on key characteristics of AI systems that distinguish it from simpler traditional software systems or programming approaches and should not cover systems that are based on the rules defined solely by natural persons to automatically execute operations."

"Solely" is the limb that dies, and in a SaaS product it is the one that decides the case. A rules engine whose thresholds a person wrote points at the exclusion — and does not land there by that fact alone, because the same recital names knowledge-based systems among the techniques that infer, two sentences below. If your system is a rules engine, that is the beginning of the question and not the answer to it. Running ours through this question showed how hard encoded expert knowledge pulls the other way. The same engine with one threshold fitted from historical data is no longer obviously outside, because the rules are no longer defined solely by natural persons.

The exclusion is narrower in a second way. Recital 12 puts symbolic systems squarely inside: the techniques enabling inference "include machine learning approaches that learn from data how to achieve certain objectives, and logic- and knowledge-based approaches that infer from encoded knowledge or symbolic representation of the task to be solved." The distinguishing property is stated separately — "The capacity of an AI system to infer transcends basic data processing by enabling learning, reasoning or modelling."

Article 96(1), first subparagraph, point (f) requires Commission guidelines on "the application of the definition of an AI system as set out in Article 3, point (1)". The Commission has published them, and is Complipath itself an AI system reads them, paragraph by paragraph, against our own engine — the borderline call this guide describes, made about ourselves.

Keep scope apart from definition. Article 2 carves out things that are AI systems: research, testing or development before placing on the market or putting into service (Article 2(8) — whose third sentence puts testing in real world conditions back in), and free and open-source releases (Article 2(12), unless placed on the market or put into service as high-risk or as a system falling under Article 5 or 50). The thing stays an AI system and re-enters scope when it ships.

How many systems does that make?

The definition decides what qualifies; how many systems it adds up to is a question Article 3 never answers, and it moved to its own page on 12 August 2026: how many AI systems do you have carries the intended-purpose seam, the worked examples, and the counting rule — including the limb that is our convention and not law.

What this means for you

If you're a provider: the definition decides whether you are a provider at all — Article 2(1), point (a) reaches providers placing AI systems on the market or putting them into service in the Union, wherever they are established. Run each function against the seven limbs and write the answer down, including the negatives. A decision that something is not an AI system is still a classification decision, and it is the one nobody documents. Then take the survivors through the high-risk decision tree.

If you're a deployer: Article 2(1), point (b) reaches deployers established or located within the Union, and point (c) reaches providers and deployers in a third country where the output produced by the AI system is used in the Union. Most of what you run is bought, so ask what a feature infers and from what input — the vendor's marketing is not the test. Which duties land on you rather than your vendor is settled by provider versus deployer; when each set applies, by the timeline.

Which of yours count?

Classify your system now — 7 questions on the main line, plus follow-ups where they apply, no account, and the classification runs in your browser: answers stay there unless you choose to keep the result.

FAQ

Is rule-based automation an AI system? Not where the rules were defined solely by natural persons to automatically execute operations — that is recital 12's exclusion, and "solely" carries it. Fit one threshold from data and the exclusion stops obviously applying. Recital 12 also puts logic- and knowledge-based approaches inside the definition, so being made of rules does not settle the question.

Does a system have to learn after deployment? No. Article 3, point (1) says an AI system may exhibit adaptiveness after deployment. That is a permission, not a requirement. A model trained once and never retrained qualifies if it infers from input how to generate outputs. This is the limb most often lost when the definition is summarised as software that learns and adapts.

Is a feature built on someone else's model our AI system? They are two objects. Article 3, point (63) defines a general-purpose AI model and point (66) a general-purpose AI system built on one. What you place on the market is the system, and your intended purpose under Article 3, point (12) is the one your instructions for use, promotional or sales materials and technical documentation specify.

Are research and open-source AI systems outside the Act? They stay AI systems; Article 2 carves them out of scope. Article 2(8) covers research, testing and development before placing on the market — its third sentence puts real-world-conditions testing back in — and Article 2(12) covers free and open-source releases unless placed on the market or put into service as high-risk or as falling under Article 5 or 50.

Sources: Regulation (EU) 2024/1689 (EUR-Lex), Article 2, Article 3 (points (1), (12), (23), (63) and (66)), Article 6, Article 25, Article 96 and recital 12, and Annex III, as amended by Regulation (EU) 2026/1744 (EUR-Lex) — in force 27 July 2026. Of Article 3, that Regulation amended only point (14) and inserted points (14a) and (14b) (Article 1, point (4)); Article 3, points (1), (12), (23), (63) and (66) are unchanged, as are Article 2(1), Article 2(8), Article 2(12), Article 6(2) and Article 25(1). It amended Article 96(1) (Article 1, point (36)) by replacing point (a), adding a point (g) and replacing the second subparagraph — point (f) was not touched. Annex III was not amended. The Commission guidelines on the application of the definition, required by Article 96(1), first subparagraph, point (f) with no date attached in the Regulation, are published and have been in our pinned source corpus since 12 August 2026 — is Complipath itself an AI system reads them paragraph by paragraph against our own engine. The Regulation defines an AI system but not the word "infers"; recital 12 glosses it and is not an operative provision.