What are AI systems? Rethinking the core definition in the EU AI Act

The EU Artificial Intelligence Act (AI Act) is the first comprehensive attempt to regulate AI systems , with Article 3(1) providing a legal definition as the entry point for most obligations. This paper argues that the primary criterion of the definition, a system's ability to "infer how to generate outputs", remains vague and ambiguous when applied to real-world examples. Our analysis traces the legislative evolution of the definition, from the Commission’s original method-based draft, through the OECD’s influence, to the final functional wording of Article 3(1). It then examines the concept of inference, highlighting unresolved ambiguities between what the AI Act classifies as covered AI systems and excluded rule-based systems. Using the example of the COMPAS recidivism risk assessment tool and other borderline cases, the paper illustrates how technically simpler software can still produce high-risk outcomes. Excluding such systems could allow for regulatory arbitrage, especially when rule-based systems include results from the use of statistical or machine learning methods. Building on this, the paper provides a critical assessment of the European Commission's 2025 guidelines and argues for a shift in focus from technical complexity to a “limited controllability” as a more workable indicator for identifying AI systems.