AI Definition
1. What is it?
An AI system is a machine-based system designed to operate with varying levels of autonomy, that uses data and computational models to infer outputs—such as predictions, recommendations or decisions—that influence physical or virtual environments. The defining characteristic is not automation alone, but learning, inference and adaptive behaviour based on data.
2. What problem does it aim to address within governance and regulation?
The concept of an AI system exists to clearly delineate when software moves from “ordinary IT” into a category that requires enhanced governance. By defining what constitutes an AI system, regulators and organisations can determine:
-
when AI-specific risks arise,
-
when additional controls are required,
-
and when accountability can no longer be delegated to generic IT governance.
3. Where does it typically appear in organisational practice?
AI systems appear:
-
in business processes involving automated or semi-automated decisions,
-
in customer-facing applications (e.g. credit scoring, recommendations),
-
in internal decision support (e.g. forecasting, risk assessment),
-
in operational optimisation (e.g. pricing, scheduling, fraud detection).
In governance terms, AI systems should be explicitly identified in system inventories, risk registers and control frameworks.
4. What can go wrong if it is interpreted or applied incorrectly?
If organisations fail to correctly identify an AI system, they may:
-
underestimate regulatory and ethical risks,
-
apply insufficient controls or oversight,
-
misclassify AI-driven decisions as “tool support”,
-
face compliance failures under AI-specific regulation.
The primary risk is governance blind spots, not technical malfunction.
5. Who is accountable, and what oversight is required?
Management is accountable for identifying, classifying and governing AI systems, including their purpose, data use and decision impact. Boards and oversight bodies should ensure that:
-
AI systems are explicitly recognised as such,
-
risk assessments are performed at system level,
-
ownership and escalation paths are clear,
-
AI systems are subject to periodic review and assurance.