Does the EU AI Act cover simple rules-based software as an AI system?

Usually no, if the software is based only on rules defined by people to automatically execute operations. Recital 12 says the AI system definition should not cover simpler traditional software or programming approaches based solely on human-defined rules. Escalate the case when the rules engine also learns, reasons, models, ranks, recommends, predicts, or otherwise infers from inputs or encoded knowledge.

Does inference under the EU AI Act require machine learning?

No. The Act's recital explains that inference can be enabled by machine learning and also by logic- and knowledge-based approaches that infer from encoded knowledge or symbolic representations. The classification question is therefore not only 'does it use ML?' but 'does the machine-based system infer how to generate outputs for an explicit or implicit objective?'

Is a general-purpose AI model automatically an AI system under the EU AI Act?

No. Article 3 separately defines a general-purpose AI model and a general-purpose AI system. A GPAI model displays significant generality and can be integrated into downstream systems or applications. A general-purpose AI system is an AI system based on a GPAI model and capable of serving a variety of purposes. The classification record should therefore identify the model, the system built from it, and the actor responsible for each.

When can an embedded AI component become high-risk under the EU AI Act?

An embedded AI component can be high-risk when Article 6(1) applies: the AI system is intended as a safety component of a product, or is itself a product, covered by Annex I Union harmonisation legislation and that product or system must undergo third-party conformity assessment. Separately, an embedded or non-embedded AI system can be high-risk if its intended use is listed in Annex III.

Can a non-EU AI provider fall within the EU AI Act?

Yes. Article 2 covers providers placing AI systems or GPAI models on the Union market regardless of whether the provider is in the Union or a third country. It also covers providers and deployers in a third country where the output produced by the AI system is used in the Union.

Can a deployer or distributor become the provider of a high-risk AI system under the EU AI Act?

Yes. Article 25 treats a distributor, importer, deployer, or other third party as the provider of a high-risk AI system when it puts its own name or trademark on the system, makes a substantial modification, or changes the intended purpose of a non-high-risk system so that it becomes high-risk.

FAQEU

EU AI Act AI System Classification Edge Cases

Use this FAQ to classify borderline software, model, product, supplier, and deployment situations under the EU AI Act before assigning obligations.

Covers inference versus simple rules, general-purpose AI models versus AI systems, embedded systems, EU territorial scope, operator roles, and evidence for high-risk assessments.

Back to main artifact Review sources

Author

Sorena AI

Published

May 9, 2026

Updated

May 9, 2026

Questions

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published May 9, 2026

Updated May 9, 2026

Overview

EU AI Act classification starts with the thing being assessed: software or model, standalone service or embedded component, EU market or EU use, provider or deployer role, and intended purpose. Borderline cases should be resolved with the Act's definitions and Article 6 classification rules, then documented with enough technical and commercial evidence to repeat the conclusion.

Search this module

Find a question or answer quickly

4 of 4 questions

Question 1

When is borderline software an AI system under the EU AI Act?

A borderline tool is more likely to be an AI system when it is machine-based, operates with some autonomy, and infers from inputs how to generate outputs such as predictions, content, recommendations, or decisions that can influence a physical or virtual environment.

A tool is less likely to be an AI system when it only executes rules defined solely by people, such as fixed validation checks, deterministic routing tables, hard-coded eligibility rules, or ordinary calculations with no learning, reasoning, modelling, or inference beyond basic data processing.

Record the inputs, objective, output type, autonomy level, and whether the system derives a model, algorithm, recommendation, prediction, content, or decision from data or encoded knowledge.
Separate deterministic automation from inference: a manually written rule that always produces the same result from the same fields is not enough by itself.
Treat logic- and knowledge-based systems as possible AI systems when they infer from encoded knowledge or symbolic representations, even without machine learning.
Keep the intended-purpose evidence from instructions, sales material, product specifications, and technical documentation because Article 6 high-risk classification depends on purpose and use context.

Citations

Regulation (EU) 2024/1689 (EU AI Act)

Supports the Article 3 AI system definition and Recital 12 distinction between inference-based AI and simpler human-defined rule execution.

Question 2

How should GPAI model, AI system, and embedded product edge cases be classified?

Do not collapse a general-purpose AI model and an AI system into the same record. The model is the reusable capability; the AI system is the deployed or supplied system that uses a model to serve an intended purpose. A downstream provider can integrate a GPAI model into an AI system and then have system-level obligations for that integration.

Embedded and product-linked cases need two checks. First, decide whether the AI component itself is an AI system. Second, decide whether Article 6 makes it high-risk because it is a safety component, is itself a covered product, or falls into an Annex III use case.

For GPAI, identify the model, the provider placing the model on the Union market, and any downstream provider integrating it into a specific AI system.
For embedded software, document whether the AI system is physically integrated into the product or serves product functionality without being physically integrated.
For product safety cases, check whether the AI system is a safety component of a product or is itself a product covered by Annex I legislation and subject to third-party conformity assessment.
For Annex III cases, check whether the intended use falls into a listed sensitive area, then assess whether Article 6(3) permits a not-high-risk conclusion; profiling of natural persons remains high-risk.

Citations

Regulation (EU) 2024/1689 (EU AI Act)

Supports the separate definitions for AI systems, general-purpose AI models, general-purpose AI systems, safety components, and Article 6 high-risk classification.

European Commission - Guidelines for providers of general-purpose AI models

Supports the distinction between GPAI model-provider scope and downstream AI ecosystem roles.

AI Act Service Desk - Article 6 classification rules

Official article page for the high-risk classification rules used to screen product-linked and Annex III edge cases.

Question 3

Which scope and role questions change the EU AI Act answer?

Territorial scope is not limited to EU-established providers. The Act can apply to providers placing AI systems or GPAI models on the Union market, EU deployers, non-EU providers or deployers whose AI-system output is used in the Union, importers, distributors, product manufacturers, authorised representatives, and affected persons located in the Union.

Role classification is fact-specific and can change after launch. A distributor, importer, deployer, or other third party can become the provider of a high-risk AI system if it puts its name or trademark on the system, substantially modifies it, or changes the intended purpose so that the system becomes high-risk.

Map the market path: who develops, brands, imports, distributes, deploys, integrates, or productizes the system or GPAI model.
Record the EU connection: Union market placement, Union putting into service, EU establishment or location of the deployer, Union use of outputs, or affected persons located in the Union.
Check whether a supplier answer covers only the model, only the AI system, only the deployment, or the product into which the system is integrated.
Reclassify after material changes to intended purpose, branding, integration, safety function, user population, EU market availability, or human-impacting use case.

Citations

Regulation (EU) 2024/1689 (EU AI Act)

Supports Article 2 territorial scope, Article 3 operator definitions, and Article 25 role changes along the AI value chain.

European Commission - Navigating the AI Act

Commission FAQ source explaining that the framework applies to public and private actors inside and outside the EU in relevant market or use scenarios.

Question 4

What classification evidence should teams keep for EU AI Act edge cases?

A defensible classification file should show the same facts a reviewer would need to reach the answer again: the object classified, why it is or is not an AI system, whether it is a GPAI model or a system, the intended purpose, the EU nexus, the operator role, and the high-risk screening result.

For high-risk and near-high-risk cases, align the evidence with Annex IV-style system description fields even if the team is still at classification stage: interactions with other hardware or software, form of supply, product integration, development methods, third-party components, output quality, monitoring, limits, and lifecycle changes.

AI system definition evidence: autonomy, inputs, objectives, output type, inference method, model or algorithm derivation, and why simple human-defined rules are or are not enough to describe the tool.
GPAI evidence: model identity, model provider, downstream system provider, integration method, tasks the model can perform, and system-specific intended purpose.
High-risk evidence: Article 6(1) product-safety check, Annex III use-case check, any Article 6(3) not-high-risk rationale, and profiling status.
Role and scope evidence: provider, deployer, importer, distributor, product manufacturer, authorised representative, EU market or output-use facts, branding, substantial modifications, and intended-purpose changes.
Change evidence: version history, technical modifications, deployment context changes, supplier changes, instructions for use, and the date and approver of each reclassification.

Citations

Regulation (EU) 2024/1689 (EU AI Act)

Supports the evidence fields from Article 3 definitions, Article 6 classification documentation, Article 25 role changes, and Annex IV technical-documentation content.

AI Act Service Desk - Article 6 classification rules

Supports keeping a documented high-risk or not-high-risk assessment for Annex III edge cases.

Recommended next step

Turn borderline AI system facts into a reviewed classification file

Sorena can help convert model, product, supplier, and deployment facts into a source-cited EU AI Act classification record with role, scope, high-risk, and evidence checks.

Research workflow

Open Research Copilot for EU AI Act

Ask source-linked questions about AI system definitions, high-risk classification, GPAI boundaries, and operator roles using the cited sources on this page.

Explore next step

Talk to Sorena

Talk through implementation

Review your EU AI Act classification edge cases, evidence gaps, and escalation points with Sorena.

Explore next step

Primary sources

References and citations

AI Act Service Desk - Article 6 classification rules

ai-act-service-desk.ec.europa.eu

Referenced sections

Supports keeping a documented high-risk or not-high-risk assessment for Annex III edge cases.

"Classification rules"

European Commission - Guidelines for providers of general-purpose AI models

digital-strategy.ec.europa.eu

Referenced sections

Supports the distinction between GPAI model-provider scope and downstream AI ecosystem roles.

"general-purpose AI models"

European Commission - Navigating the AI Act

digital-strategy.ec.europa.eu

Referenced sections

Commission FAQ source explaining that the framework applies to public and private actors inside and outside the EU in relevant market or use scenarios.

"inside and outside the EU"

Regulation (EU) 2024/1689 (EU AI Act)

eur-lex.europa.eu

Referenced sections

Supports the evidence fields from Article 3 definitions, Article 6 classification documentation, Article 25 role changes, and Annex IV technical-documentation content.