Every AI law starts with a definition. If a tool falls outside it, none of the obligations apply. If it falls inside, all of them may.
European Union
The AI Act defines an AI system as a machine-based system that operates with some autonomy, may adapt after deployment, and infers from its inputs how to produce outputs such as predictions, content, recommendations or decisions. The key word is “infers”. The Commission’s 2025 guidelines say that simple rule-based software, where a human wrote every rule, is usually outside the definition. The definition is modelled on the OECD’s.
United Kingdom
The UK has no statutory definition. Its policy describes AI by two features, adaptivity and autonomy, and leaves each regulator to apply existing law. The practical test is the one the regulator in your sector uses. For personal data, the UK GDPR applies whether or not the tool is called AI.
United States
Federal law defines AI in the National AI Initiative Act of 2020, but that definition mainly governs federal programmes. State laws each use their own wording. Colorado’s revised law now regulates “automated decision-making technology” that materially influences a consequential decision, rather than “AI” as such. California’s privacy rules use a similar term.
The useful question is not “is this AI?” but “does this tool fall within the definition in each law that could apply to us?”
What to do
Keep an inventory of the tools your organisation uses, and record for each one why it is or is not inside each definition that matters to you. Expect the answer to differ between jurisdictions. A spreadsheet macro may be outside the EU definition and inside a US state law that targets automated decisions.
This article is general information on the law as at November 2026. It is not legal advice and has not been updated since that date. See the terms of use.