The AI Regulation defines AI systems as machine-based technologies that operate autonomously, make decisions, and influence their physical or virtual environment. Unlike traditional applications, such as software that works by fixed rules (“If A occurs, then do B”), AI uses statistical models. These “AI models” calculate probabilities to determine the best-fit solution for a task.

AI can analyze large amounts of data faster than humans. It does not “think” like us, based on logic and context, but calculates which outcome is the best fit. This includes generative AI systems like ChatGPT that produce text, images, or music from prompts. The foundation is the data used to train the AI. In this respect, it's important to note that the AI Regulation does not override other laws: companies must still address data protection, copyright, and liability issues separately.

The AI Regulation ensures that AI systems do not pose unmanageable or unintended risks to people. Different AI systems are categorized by risk levels (none, low, high, and unacceptable), determining the obligations for providers and users accordingly (see "How does the AI Regulation handle AI systems with varying risk profiles?"). The regulation only applies to systems that have real-world impacts—like an AI tool that creates images or operates a machine. Particularly strict rules apply to high-risk AI systems, such as those making decisions about individuals or controlling safety-critical processes.

The AI Regulation permits EU member states to establish so-called regulatory sandboxes. These are specific test environments where companies can trial new AI systems under realistic conditions—supervised by the competent authority and without immediately meeting all legal requirements.