What Counts as AI

What Counts as AI

Automatic is not the same as AI. Learn the legal test.

What Is What Counts as AI?

The EU AI Act applies to AI systems, and it defines one precisely: software that infers from its input how to produce predictions, content, recommendations or decisions. Rules a person wrote in full do not count, however automatic they are. In this exercise you classify a team's everyday tools against that definition, decide whether your organisation is each system's provider or deployer, and match plain descriptions to the terms the rest of the course relies on.

What You'll Learn in What Counts as AI

What Counts as AI — Training Steps

  1. A List for Maren

    Tuesday, half past eight. Maren Aasland, who runs AI governance at Brakvik Freight, wants the same thing from every team before the quarterly review: the tools it uses, and which of them count as AI. You plan delivery routes. You are not sure you use any AI at all.

  2. The Register

    The register lives on the governance portal. Maren has already filled in the tool list from the software inventory. The classification is yours.

  3. One Sentence Decides

    The dark panel on the left is the one sentence in the AI Act that decides whether any of the rest applies: the definition of an AI system. Most people remember only 'machine-based'. The word that does the work comes later.

  4. Automatic Is Not AI

    Before you sort the list, test the definition on its simplest tool.

  5. Six Tools

    Six tools, one question each. Read how each one works and ask whether it works out its output from data and learned patterns, or only applies rules and arithmetic a person set. The register will not accept the page until every row matches the definition.

  6. Two Forecasts

    Two rows both produce a forecast, and only one of them is an AI system. They are worth seeing side by side, because this is exactly where registers go wrong.

  7. Who Built It

    Three of the six are AI systems. Maren's second question is about the obligations that come with them, and the Act hands those out by role: the provider that builds a system, and the deployer that uses it.

  8. Brakvik's Role

    For each of the three AI systems, one question: did Brakvik Freight build it and run it under its own name, or does it use something another company built?

  9. Built In-House

    One of those three answers surprises most people the first time.

  10. Shared Words

    Maren attaches a short glossary to every team's page, so that when someone says high-risk or deep fake, the whole company means the same thing. Four everyday descriptions, four terms from the Act, from the general-purpose AI model underneath a tool to the high-risk systems that carry the strictest duties.

Security Framework Coverage

CIS Controls

  • CIS 14.4 Train Workforce on Data Handling Best Practices

NIST CSF

  • PR.AT-01 Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind

EU AI Act

  • Art. 3 Definitions
  • Art. 4 AI literacy