Almost every AI law starts with the same question: is this system AI at all? The definition decides which obligations apply and which rules can be ignored. Get it wrong and an organization either over-governs ordinary software or under-governs a real AI system.
This lesson climbs a ladder, and each step is one question about a system. What makes it AI at all: the definition, and its key term, inference. What it is made of: the difference between an algorithm, a model, and the AI system around them. How it learns: the five ways machine learning systems are trained or used, and what zero-shot use does to the evaluation burden. How the knowledge got in, and whether it keeps changing: the two historical traditions, and locked versus continuously learning models. And how far it reaches: narrow AI, AGI and ASI. A worked case then runs one system through every question.
By the end, you can apply the "who wrote the decision logic?" test to any system description and name what you are looking at.
Note
Without this definition, every governance decision starts from the wrong place. Classify a rules-based tool as AI and you add compliance work that serves no purpose. Fail to classify a machine-learning model as AI and legal obligations go unmet, affecting the people the system makes decisions about. The definition is also the first step in a risk assessment: you cannot assign a risk level to a system you have not correctly identified. This is why the exam tests it directly through definition questions, and indirectly in scenarios where the opening move is to decide whether the system is AI at all.
Step 1
The definition: it is about inference
Start with the definition itself. There is no single agreed definition of artificial intelligence. The most influential one in governance comes from the OECD, and the EU AI Act follows it closely. Here it is.
A machine-based system that, for explicit or implicit objectives, infers from the input it receives how to generate outputs, predictions, content, recommendations, or decisions, that can influence physical or virtual environments.
Source: OECD-style definition, followed by the EU AI Act
The key word is infers. A traditional program follows rules a person wrote: if income is below X, decline the loan. An AI system instead builds its own internal logic from data. The person sets the objective and supplies the training data, and the system finds the mapping itself.
This is the main difference, and it causes most governance problems in this course. You can audit a rule that a person wrote down. You cannot read a model's learned parameters and know what it will do.
The definition adds two properties that often appear together: autonomy and adaptiveness. Autonomy means the system can act without a human approving each output, for example, a fraud model that blocks a payment by itself. Adaptiveness means the system can continue changing after deployment, for example, a model that retrains on new data each week.
Neither property is required for a system to be AI. A simple, locked model with a human approving every output is still an AI system. But when either property is present, governance becomes harder. Autonomy removes the human review at the moment of action, and adaptiveness means the system you reviewed is no longer the system running today.
This gives you a quick test for scenario questions: ask "who wrote the decision logic?" If a person wrote the rules, it is conventional software. If the logic was learned from data, it is AI. Marketing labels like "AI-powered" or "smart" are not evidence either way. Try the test on the next question.
A vendor sells "AI-powered route optimization". The tool assigns deliveries using 4,000 if-then rules written by human planners. Is it an AI system under the OECD/EU-style definition?
- AYes, it automates a complex expert task
- BNo, its logic was written, not inferred· good thinking
No. Every rule was written by a person, so nothing is inferred from data. This is conventional software, even though it looks advanced. The marketing label changes nothing. The tool may still need risk review as ordinary software, but it does not trigger AI-specific obligations. "Who wrote the decision logic?" answers most definition questions.
Step 2
Algorithm and model, and the system around them
Three terms recur in exam questions, and mixing them up changes who is responsible for what. The table separates algorithm, model and the system around them; then check each card below.
| Term | What it is | Why it matters for governance |
|---|---|---|
| Algorithm | The learning procedure: the method, such as gradient descent or decision-tree induction. | "We validated the algorithm" does not answer "did you validate the model?" They are different claims. |
| Model | The result of running the algorithm on training data: the learned parameters, its weights, that make the predictions. | The same algorithm produces many models, because the data you give it differs each time. |
| AI system | The model plus everything around it: the interface, the data pipelines, the monitoring and the human procedures. | Laws mostly attach obligations here. Moving the same model from film recommendations to loan approvals makes a different system with a different risk profile. |
Algorithm, model and system: what each one is and why it matters
Algorithm
The learning procedure (for example, gradient descent). Running it on data produces a model. Validating the algorithm is not the same as validating the model.
Model
The result of training: learned parameters, its weights, that make the predictions. Different training data gives a different model from the same algorithm.
AI system
The model plus its interface, pipelines, monitoring and human procedures. Obligations attach here, in a context of use.
Context of use
What the system decides, about whom, and with what consequences. Change the context and you change the governance problem: risk follows the use case, not the technology.
Vendors often license a model built for one purpose and reuse it for another. Decide what that reuse changes: the context decides the risk.
Check your understanding
A vendor's movie-recommendation model is licensed by a bank, which integrates it unchanged into a system that ranks loan applicants by 'financial reliability'. The vendor objects that the model was never validated for lending. What does this scenario best illustrate?
- AThe governance burden attaches to the system in its context of use, not to the model alone· correct
- BThe obligations stay with the model's original training purpose until it is retrained
- CA model becomes generative AI when it is applied to a new domain
- DLicensing a model transfers all compliance obligations to the licensor
Why: The same model becomes a different AI system when it is used in a new context. Lending decisions about people carry a very different risk profile and legal classification than movie suggestions. Laws attach obligations to systems in their context of use, so the bank — as the deployer — carries the governance burden, regardless of what the model was first built for.
Step 3
How machines learn: the approaches
AI is the broad field: making machines do tasks that normally need human intelligence. Machine learning is the part of AI that learns patterns from data instead of following written rules. Deep learning is the part of machine learning that uses multi-layered neural networks. Each one is a subset of the one before it.
- Artificial intelligence, The broad field: making machines do tasks that need human-like reasoning, perception or language.
- Machine learning (ML), Today's main approach: the system learns patterns from data instead of following written rules.
- Deep learning, ML built on multi-layered neural networks. The source of modern capability, and of modern opacity.
AI contains machine learning, which contains deep learning. Each inner level is a narrower, more specific approach.
Within machine learning, you must be able to classify a setup quickly. There are five approaches to know: four training paradigms, how the model is trained, plus zero-shot, which is a use mode of an already-trained model. For each one, notice the data it needs and the main governance concern it raises. The table presents them side by side.
| Approach | Data it needs | What it learns | Governance hook |
|---|---|---|---|
| Supervised | Labeled examples | To predict the label for new cases | Label quality and bias pass directly into the model |
| Unsupervised | Unlabeled data | Structure nobody defined in advance, such as clusters | Patterns are hard to validate: what does a cluster mean? |
| Semi-supervised | A few labels plus much unlabeled data | Labels, extended across the unlabeled data | The cheap unlabeled data carries quality and rights risk at scale |
| Reinforcement | Actions and reward signals | A policy that maximizes reward by trial and feedback | A poorly chosen reward produces harmful behavior (misalignment) |
| Zero-shot | No task examples at all | To do a new task from a large pre-trained model's general knowledge | No one validated the model for your task: you must check it yourself |
Five ways ML systems are trained or used. The first four are learning paradigms (how the model is trained); zero-shot is a use mode of an already-trained model, included here because you must classify it on the exam. The governance hook is the first risk each one raises.
Now practice classifying them. Put each setup in its approach.
Classify each setup.
- “A model trained on millions of transactions, each labeled 'fraudulent' or 'legitimate', scores new transactions.” → SupervisedLabeled examples mean supervised learning. The 'supervision' is the labels, not a human watching at runtime.
- “A retailer's model groups customers into segments no one defined in advance.” → UnsupervisedThere are no labels. The model finds the structure (clusters) on its own.
- “A system learns warehouse-robot routing by receiving penalties for collisions and rewards for speed.” → ReinforcementThe system learns from reward signals through trial and interaction. There is no labeled dataset.
- “A general-purpose model is asked, through instructions alone, to sort contracts into risk categories, a task it was never specifically trained for.” → Zero-shotThere are no task-specific training examples. The capability comes from the pre-trained model, and no one has validated it for this task.
Exam trap
"Supervised" read as runtime supervision. Supervised refers to labels in the training data, not to a human supervising the system at runtime. Those are different ideas.
Semi-supervised confused with zero-shot. Semi-supervised means a few labels plus many unlabeled examples; zero-shot means no task examples at all. Read which data the scenario describes.
Step 4
Zero-shot and the evaluation burden
Zero-shot use deserves a separate note, because it is how most organizations now adopt AI. They take a large pre-trained model, give it instructions, and apply it to a task it was never specifically trained for.
The capability is real, but the validation is absent. The provider tested the model in general, not on your contracts, claims or candidates. Zero-shot use therefore transfers the work of task-specific testing to the deployer, the organization using the system. Test the quality on your own material before anyone relies on it. "It is a frontier model" describes capability, not evidence.
Now check what that change means.
Check your understanding
A legal team starts using a general-purpose LLM to classify incoming contracts into risk categories — a task the model was never specifically trained or validated for, relying on instructions alone. What is the most important governance implication of this zero-shot use?
- ANo one has validated it for this task — task-specific evaluation falls on the deploying team· correct
- BZero-shot use is risk-free because the model was trained on broad data
- CThe approach is prohibited, since models may only do tasks they were trained for
- DThe vendor automatically becomes liable for classification errors
Why: Zero-shot capability means the task works without task-specific training — and therefore without task-specific validation. The deployer inherits the evaluation burden: test the classification quality on its own contracts before anyone relies on the output.
Step 5
Two traditions, and whether the model keeps learning
AI has two historical traditions, and modern systems often combine them. That is why "is it AI?" questions focus on the part that does the inference, not the software around it. The comparison shows the trade-off each tradition makes.
Symbolic AI (rules)
Knowledge is written down explicitly: rules, logic, knowledge graphs. Expert systems are its commercial form.
Transparent but rigid. The logic is easy to audit, but it is costly to maintain and cannot generalize beyond its rules.
Statistical AI (learning)
Patterns are learned from data: today's machine learning.
Powerful but opaque. It generalizes and scales, but it is hard to inspect.
One more distinction has direct control consequences: does the model keep learning after deployment?
A locked (static) model is trained, validated, and then frozen. It changes only through a deliberate, reviewed release. The locked model is easier to govern, because the system you validated is the system running.
A continuously learning system updates from new data while in use. It remains current, but it diverges from what you validated, so it needs revalidation triggers and drift monitoring. In regulated settings, the locked model is usually preferred.
Step 6
Narrow AI, AGI, ASI
One last set of terms. The exam often uses these as wrong answers designed to look right. Everything deployed today is narrow AI (also called weak AI): very good at one defined task, and useless outside that task. A chess engine cannot triage emails.
Artificial general intelligence (AGI) means hypothetical human-level ability across many tasks. No deployed system is AGI. Artificial superintelligence (ASI) is a theoretical stage beyond AGI: ability above human performance across nearly all domains. ASI appears in long-term safety debates, but it is a concept, not a product. Governance frameworks regulate the narrow systems that exist. The strongest general-purpose models get extra attention only because no one can list all their possible uses, or misuses, in advance.
See how this appears in a question.
A scenario describes a deployed enterprise system. One answer option explains its behavior as "emerging general intelligence (AGI)". How should you treat that option?
- APlausible, frontier systems approach AGI
- BAlmost certainly a distractor· good thinking
Almost certainly a distractor. Everything in production is narrow AI. AGI is hypothetical breadth, and ASI is a theoretical stage beyond it. An option that uses AGI or ASI to explain a deployed system is testing whether you know that difference.
Step 7
Worked scenario: one case, all the ideas
Worked scenario
The reasoning. Run the definition test first: who wrote the decision logic? Here the logic was learned from labeled images, so it is AI, and the same fact answers the paradigm question, because labeled examples mean supervised learning. Then place the system on the remaining axes of this lesson: narrow or general, model or system. Close with the governance view: which properties of this setup will obligations attach to? The stakes, the unreadable logic and the dependence on the training images are all visible in the case description itself.
The answer.
- Is it AI? Yes. The detection logic was learned from labeled data, not written by a person.
- Which paradigm? Supervised learning (labeled examples), built on deep learning.
- Narrow or general? Narrow. It knows X-rays and nothing else.
- Model or system? The hospital deploys a system: the model plus the viewer, the alerts, and the radiologist's workflow. Obligations attach to that system in this clinical context.
- Why governance cares: the outputs influence treatment decisions (high stakes); the learned logic cannot be read like code (opacity); and performance depends on whether the training images resemble this hospital's patients (data dependency).
Now change one thing: the vendor adds a feature that writes a draft radiology report. That adds a generative component and a new risk, fluent but wrong text entering the medical record. None of the earlier risks disappear.
Is this tumor-flagging software a generative AI system?
- AYes
- BNo· good thinking
No. It outputs a prediction, a flag, about its input. It does not produce new content, so it is a predictive system, not a generative one. Remember that as we classify the rest.
Step 8
Recap
The lesson in brief. Re-read these points before the exam.
Key takeaways
Definition: an AI system infers from data how to produce outputs, predictions, content, recommendations or decisions. The logic is learned, not written. Ask "who wrote the decision logic?" to decide if something is AI.
Algorithm, model, system: the algorithm is the procedure, the model is the trained result, the system is the model plus its context. Obligations attach to the system in its context of use.
Five approaches: four training paradigms, supervised (labels), unsupervised (structure), semi-supervised (few labels plus many unlabeled), reinforcement (reward), plus zero-shot, a use mode of an already-trained model (no task examples, so you must validate it yourself).
Two traditions: symbolic is transparent but rigid; statistical is powerful but opaque. A locked model is easier to govern than a continuously learning one.
Narrow vs general: all deployed AI is narrow. AGI is hypothetical, and ASI is a theoretical stage beyond it, both are usually wrong answers in questions about real systems.
You can now
- State the working definition of an AI system, and apply the "who wrote the decision logic?" test.
- Separate algorithm, model and system, and explain why obligations attach to the system.
- Classify a setup quickly, including semi-supervised and zero-shot.
- Place narrow AI, AGI and ASI correctly in a scenario.