AI system
Article 3, point 1, of Regulation (EU) 2024/1689:
a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments.
The definition that delimits the scope of Regulation (EU) 2024/1689: if a tool does not fit it, no obligation under the Regulation applies to it.
It is the gateway to the Regulation: everything else — categories, obligations, dates — starts from whether a tool meets this definition.
Which obligations it carries
The definition imposes nothing by itself: it is not an obligation, it is the threshold. What applies depends on the risk category of the specific system. The prohibited practices of Article 5 are a legal obligation of providers and deployers applicable from 2 February 2025. The transparency obligations of Article 50 are a legal obligation applicable from 2 August 2026. The requirements for systems classified as high-risk under Annex III are a legal obligation applicable from 2 December 2027.
What it is not
It is not “any software with statistics in it”. The definition requires inferring, from the input, how to generate outputs; a system of hand-written rules, which applies what a human decided in advance, does not infer. Nor is it a risk category: “AI system” does not mean “regulated”. The vast majority of systems that meet the definition carry no obligation beyond Article 4 and, where applicable, Article 50.
The nuance almost nobody captures
The definition includes “may exhibit adaptiveness after deployment” — “may”, not “must”. A system that does not learn after being deployed is still an AI system if it meets the other elements of the definition. It is the most frequent misreading in inventories: discarding tools because “they don’t learn on their own”.