What Is AI? The Definitions Regulators And Standards Bodies Use

“Artificial intelligence” is used to describe everything from a chatbot to a spreadsheet macro, which makes it hard to discuss risk or compliance with any precision. Fortunately, the bodies that write rules about AI have settled on a fairly consistent definition, and it is more specific than the marketing use of the term.

This article walks through that shared definition, shows where the OECD, the EU AI Act and the US National Institute of Standards and Technology (NIST) agree and differ, and explains the one idea that separates an AI system from ordinary software.

The Shared Definition In Plain Words

In November 2023 the OECD Council revised the definition of an AI system in its Recommendation on Artificial Intelligence, first adopted in May 2019.¹ Stripped to its parts, the revised version says an AI system is a machine-based system that works towards objectives, uses the input it receives to work out how to produce outputs, and produces outputs such as predictions, content, recommendations or decisions that can affect a physical or virtual environment. It also says that systems differ in how independently they operate and in whether they keep changing after they are deployed.

The EU AI Act, signed on 13 June 2024 and published in the Official Journal on 12 July 2024, uses almost the same wording in Article 3(1).² It was amended in July 2026, but that amendment left the definition unchanged.³ Because the Act is binding law in the EU, this definition is the first test of whether a product falls inside its scope. The key phrase is that an AI system “infers, from the input it receives, how to generate outputs”.³

NIST’s AI Risk Management Framework, published in January 2023 as voluntary guidance, uses an earlier version adapted from the 2019 OECD text and from ISO/IEC 22989.⁴ It describes an engineered or machine-based system that generates outputs for a given set of objectives and operates with varying levels of autonomy.

Where The Definitions Line Up

The three texts share a skeleton. The differences are mostly about timing: NIST published before the OECD revision, so it lacks the newer elements that the EU later adopted.

An explainer from OECD staff set out the reason for each 2023 change.⁵ “Implicit” objectives were added because a system can learn goals during training rather than having them written down. “Content” was added to the list of outputs so that generative AI, which produces text, images or video, is clearly covered. “Real” environments became “physical” ones, since virtual environments are real too. Adaptiveness was added to reflect systems, such as recommendation engines, that keep changing as they are used.

The Idea That Matters Most: Inference

The word doing the work in the modern definition is “infers”. Ordinary software follows rules a programmer wrote explicitly: if the invoice total is over a limit, send it for approval. An AI system works out how to turn inputs into outputs. Today that usually means applying patterns learned from data, but the EU text also counts logic-based and knowledge-based methods that reason from encoded expert knowledge. What it excludes is software that simply executes rules written entirely by people.⁶

A concrete comparison helps. A fraud check that blocks any card payment over 5,000 euros in a foreign currency is a fixed rule. A fraud model that scores each payment based on patterns learned from millions of past transactions is inferring, because nobody wrote down the exact conditions it uses. The first is ordinary automation. The second sits inside the definition.

Autonomy And Adaptiveness

Autonomy comes in degrees, and all three texts recognise that systems vary in how independently they act. A spam filter that labels emails for a person to review has little autonomy. A system that sends payments or changes access rights without a person in the loop has much more. AI agents, which plan and take actions on their own, sit at the high end; they are covered in AI Agents And Multi-Agent Systems.

Adaptiveness is handled differently. NIST’s definition does not mention it, while the OECD and EU texts do. The EU recitals describe it as self-learning that lets a system change while it is in use.⁶ A recommendation engine that updates itself from new user clicks is an example. Many deployed models are frozen and do not change at all, and the EU wording reflects this by saying a system may show adaptiveness, not that it must.

Why The Wording Matters To Your Organisation

Definitions shape scope. If a tool meets the EU definition, the AI Act’s rules for AI systems may apply to it, with obligations that depend on the use case and risk level.² If it does not, those rules do not apply, although other law such as data protection still might. The definition is only one part of the scope question: the Act also covers general-purpose AI models separately, and it has its own territorial reach and exclusions.³ Getting the classification right is a sensible first step in any AI inventory.

A practical approach is to list each tool your organisation uses or sells and ask three questions: does it infer how to produce its outputs, what kind of output does it produce, and how independently does it act. The answers feed directly into risk assessment and governance, which are covered in AI Governance And Regulation.