EU AI Act Does this tool count as AI?

An AI system is machine-based, operates with some autonomy and infers from inputs how to generate outputs. Those outputs can include predictions, content, recommendations or decisions that influence a physical or virtual environment. Check all parts of Article 3(1), including explicit or implicit objectives and the possibility of adaptation after deployment.

A tool is less likely to be an AI system when it only executes rules defined solely by people, such as fixed validation checks, deterministic routing tables, hard-coded eligibility rules, or ordinary calculations with no learning, reasoning, modelling, or inference beyond basic data processing.

Use Article 3(1) and Recital 12 to classify the actual system. The Commission's definition guidelines explain its interpretation; they do not replace the legal definition. Keep evidence of how the tool infers its outputs. A supplier label such as AI-powered or automated does not settle the question.

Keep separate records for the general-purpose AI model (GPAI model) and the AI system built with it. The model supplies reusable capabilities. The system uses those capabilities for an intended purpose. A company that integrates the model into its own system can have system-provider duties for that integration.

Embedded and product-linked cases need two checks. First, decide whether the AI component itself is an AI system. Second, decide whether Article 6 makes it high-risk because it is a safety component, is itself a covered product, or falls into an Annex III use case.

Apply the amended safety-component tests in Regulation (EU) 2026/1744. A safety function has the intended purpose of preventing or mitigating health and safety risks. Solely non-safety user assistance, optimisation, efficiency, automation, convenience, or quality control does not qualify, but a failure or malfunction that would endanger health and safety still does. A product assessment required solely for non-health-and-safety risks, such as spectrum distribution or electromagnetic interference without a health-and-safety effect, does not satisfy Article 6(1)(b).

The Act can cover providers outside the EU when they place AI systems or general-purpose AI models on the EU market. It can also cover non-EU providers or deployers whose system outputs are used in the EU. Article 2 separately addresses EU deployers, importers, distributors, product manufacturers, authorised representatives and affected people in the EU.

Role classification is fact-specific and can change after launch. A distributor, importer, deployer, or other third party can become the provider of a high-risk AI system if it puts its name or trademark on the system, substantially modifies it, or changes the intended purpose so that the system becomes high-risk.

Scope exclusions also matter. The Regulation contains specific exclusions for personal non-professional use, certain scientific research and development activity, pre-market research, testing or development that respects applicable Union law, and some free and open-source releases. Those exclusions have conditions and do not create a general exemption for commercial deployment, prohibited practices, high-risk systems, or Article 50 uses. The Article 2(8) pre-market exclusion does not cover testing in real-world conditions.

Keep enough evidence for someone else to repeat the classification. Identify the software, model or system assessed; why it meets or falls outside the AI definition; its intended purpose; the EU connection; each actor's role; and the high-risk checks completed.

For high-risk and near-high-risk cases, align the evidence with Annex IV-style system description fields even if the team is still at classification stage: interactions with other hardware or software, form of supply, product integration, development methods, third-party components, output quality, monitoring, limits, and lifecycle changes.