Article 3: Definitions
According to Article 3, an AI system is a machine-based system designed to operate with varying levels of autonomy, that may exhibit adaptiveness, and infers from input how to generate outputs such as predictions, recommendations or decisions.
Praxikon tracks Article 3 (Definitions) under the EU AI Act, citing the source for every statement.
Official text
Source: EUR-Lex, Regulation (EU) 2024/1689. Text reproduced verbatim.
Download AI Act (PDF) →Decision tree
Is your application an AI system?
Assess the system as it actually works, not as it is called in marketing. A product can contain AI components next to ordinary software.
Question 1 · Art. 3(1)
Does the system itself infer, from the input it receives, how to generate outputs, for example through machine learning or logic- and knowledge-based techniques?
Software that only executes rules defined entirely by people does not infer anything. The guidelines also give basic data processing, classical heuristics and systems that only improve mathematical optimisation as examples outside the definition.
Full diagram
- 1
Does the system itself infer, from the input it receives, how to generate outputs, for example through machine learning or logic- and knowledge-based techniques?
Art. 3(1)
- Yes, it infers → Question 2
- No, it only executes fixed rules → Outcome B
- 2
Is the system designed to operate with some level of autonomy, meaning some independence from human involvement in each step?
Art. 3(1)
- Yes → Question 3
- No, a human steers every step → Outcome B
- 3
Does the system, for explicit or implicit objectives, generate outputs such as predictions, content, recommendations or decisions that can influence physical or virtual environments?
Art. 3(1)
- Yes → Question 4
- No → Outcome B
- 4
Do you place the system on the market or put it into service in the EU, use it from an establishment in the EU, or is its output used in the EU?
Art. 2(1)
- Yes → Question 5
- No, no link with the EU at all → Outcome C
- 5
Is the system used exclusively for military, defence or national security purposes?
Art. 2(3)
- Yes, exclusively → Outcome D
- No → Question 6
- 6
Is the system specifically developed and put into service for the sole purpose of scientific research and development?
Art. 2(6)
- Yes, solely for that → Outcome E
- No → Question 7
- 7
Is the system still in research, testing or development and not yet placed on the market or put into service, and are you not testing it in real world conditions?
Art. 2(8)
- Yes → Outcome F
- No, it is in use or tested in real world conditions → Question 8
- 8
Do you use the system as a natural person in the course of a purely personal, non-professional activity?
Art. 2(10)
- Yes → Outcome G
- No, we use or supply it professionally → Question 9
- 9
Is the system released under a free and open-source licence?
Art. 2(12)
- Yes → Outcome H
- No → Outcome A
Outcome A · Applies
It is an AI system within the scope of the AI Act
The regulation applies. Which obligations apply depends on your role (provider or deployer) and on the risk: first the prohibited practices, then the high-risk classification, then the transparency obligations. Article 4 on AI literacy applies to every provider and deployer.
Art. 3(1) · Art. 2(1) · art. 4 · art. 5 · art. 6 · art. 50
Outcome B · Does not apply
Probably not an AI system
Without the capacity to infer, some autonomy or outputs that can influence environments, the application falls outside the definition. Record the reasoning, because the line is often thin in practice. If the application processes personal data, the GDPR still applies.
Art. 3(1) · overweging 12
Outcome C · Does not apply
Outside the territorial scope
Without placing on the market or putting into service in the EU, without a deployer in the EU and without use of the output in the EU, the regulation does not apply. If the output is later used in the EU, that changes.
Art. 2(1)
Outcome D · Does not apply
Excluded: military, defence or national security
The regulation does not apply to AI systems placed on the market, put into service or used exclusively for military, defence or national security purposes, regardless of who does so. If the system is also used for other purposes, the regulation applies to that use.
Art. 2(3)
Outcome E · Does not apply
Excluded: solely scientific research
Systems and models specifically developed and put into service for the sole purpose of scientific research and development, including their output, fall outside the regulation. If the system later goes to market or into use for another purpose, the regulation does apply.
Art. 2(6)
Outcome F · Partly applies
Not yet: the development phase falls outside the regulation
Research, testing and development before placing on the market or putting into service fall outside the regulation, except testing in real world conditions. Other Union law, such as the GDPR, still applies. As soon as you place the system on the market or put it into service, the obligations apply.
Art. 2(8)
Outcome G · Does not apply
No obligations for you as a private user
Deployer obligations do not apply to natural persons using an AI system in the course of a purely personal, non-professional activity. The provider of the system keeps its own obligations.
Art. 2(10) · Art. 3(4)
Outcome H · Partly applies
Open source: only for high risk, prohibited practices or transparency duties
The regulation does not apply to AI systems released under free and open-source licences, unless they are placed on the market or put into service as high-risk AI systems, or fall under Article 5 or Article 50. The exclusion attaches to the system, not to your role: it therefore also covers you if you only use the system. If you deploy it for a high-risk purpose, for example one listed in Annex III, it is put into service as a high-risk system and the exclusion falls away; then check under Article 25 who is the provider. If the system is provided against a price or otherwise monetised, for example through paid support, the exclusion does not apply according to recital 103. General-purpose AI models have their own regime (Article 53(2)).
Art. 2(12) · art. 5 · art. 6 · art. 50 · art. 25 · overweging 103
Official guidance on this article
7- Guidelines on transparency obligations for providers and deployers of certain AI systems under Article 50 of the AI ActSpecifies the concepts of provider, deployer and deepfake that determine who in a chain bears which transparency obligation.PublishedGuidelinesEuropean Commission20 Jul 2026
- Guidelines on the scope of obligations for providers of general-purpose AI models under the AI ActSpecifies the definition of a general-purpose AI model in Article 3, point 63, with an indicative threshold based on training compute.PublishedGuidelinesEuropean Commission18 Jul 2025
- AIB 2025-1 / MDCG 2025-6 Interplay between the Medical Devices Regulation (MDR) and In vitro Diagnostic Medical Devices Regulation (IVDR) and the Artificial Intelligence Act (AIA)Specifies that the deployer under the AI Regulation does not coincide with the user under the Medical Devices Regulation and in vitro Diagnostic Medical Devices Regulation, which determines who bears which obligation.PublishedGuidelinesAI Board (AIB) and Medical Device Coordination Group (MDCG), European Commission
- Commission Guidelines on the definition of an artificial intelligence system established by Regulation (EU) 2024/1689 (AI Act)Works through the definition of AI system in Article 3, paragraph 1, element by element so that organisations can classify their software portfolio as in scope or out of scope.PublishedGuidelinesEuropean Commission (DG CONNECT / AI Office)6 Feb 2025
- AI Literacy - Questions & AnswersClarifies who falls within the definition of staff, including contractors and third parties who work with AI on behalf of the organisationPublishedQ&AEuropean Commission, DG CONNECT27 Jul 2026
- Draft guidance and reporting template on serious AI incidents (Article 73)Clarifies the definition of serious incident from Article 3, paragraph 49, with examples of harm to health, property, environment and fundamental rightsDraftTemplateEuropean Commission26 Sept 2025
- EU AI Act Compliance CheckerHelps determine what role an organisation has, provider or deployer, because the entire package of obligations depends on itDraftQ&AEuropean Commission (AI Act Service Desk)
Related enforcement
No enforcement actions for this article yet. Follow developments via the Enforcement Tracker.
Related blog posts
Related articles
Frequently asked questions
How does Article 3 AI Act define an AI system?+
What is a provider under the AI Act?+
What is a deployer under Article 3 of the AI Act?+
Connections
What connects to Article 3 AI Act
Themes where this returns
Where this meets the other law
- Profiling in the GDPR sense always makes an Annex III system high-risk
uses the definition in
The counterpart in the other law
- Article 4 GDPR: Definitions
via Profiling in the GDPR sense always makes an Annex III system high-risk
- Article 9 GDPR: Processing of special categories of personal data
- Article 22 GDPR: Automated individual decision-making, including profiling
via Profiling in the GDPR sense always makes an Annex III system high-risk
- Article 24 GDPR: Responsibility of the controller
- Article 28 GDPR: Processor
- Article 33 GDPR: Notification of a personal data breach to the supervisory authority
- Article 34 GDPR: Communication of a personal data breach to the data subject
GDPR interpretation that also applies here6 of 15
- Guidelines 07/2020 on the concepts of controller and processor in the GDPR
2021-07-07 · final, European Data Protection Board (EDPB) · via Who is responsible: roles in both laws
- EDPB Template for personal data breach notification
2026-06-10 · under consultation, European Data Protection Board (EDPB) · via Reporting: data breaches and serious incidents
- IAB Europe: the TC String is personal data and the industry body is a joint controller
2024-03-07 · final, Hof van Justitie van de EU (Vierde kamer), IAB Europe tegen Gegevensbeschermingsautoriteit (België) · via Who is responsible: roles in both laws
- Council of State: 600,000 euro fine for wifi tracking in Enschede stays annulled
2026-07-29 · final, Raad van State, Afdeling bestuursrechtspraak · via Who is responsible: roles in both laws
- Guidelines 02/2026 on Anonymisation
2026-07-07 · under consultation, European Data Protection Board (EDPB) · via Who is responsible: roles in both laws
- EDPS v SRB: pseudonymised data are not always personal data for everyone, but the information duty applies from collection
2025-09-04 · final, Hof van Justitie van de EU (Eerste kamer), Europese Toezichthouder voor gegevensbescherming (EDPS) tegen Gemeenschappelijke Afwikkelingsraad (SRB) · via Who is responsible: roles in both laws