AI system

The term ‘artificial intelligence system’ means any data system, software, application, tool, or utility that operates in whole or in part using dynamic or static machine learning algorithms or other forms of artificial intelligence.

Source: AIEOG AI Lexicon (Feb 2026), 40 USC Subtitle III, Chapter 113

An AI system is the complete package: the software, data infrastructure, and operational environment that uses AI technology to perform a function. While an AI model is the computational engine that processes inputs and produces outputs, the AI system is everything surrounding that model, including data pipelines, user interfaces, integration layers, business rules, and the operational processes that rely on the model’s outputs.

The statutory definition is deliberately broad. It covers dedicated AI applications (a purpose-built fraud detection platform) and embedded AI capabilities (an AI scoring feature within a larger loan origination system). This breadth matters for governance because it means institutions cannot limit their AI oversight to standalone AI products. Any system that uses AI technology, even partially, falls within the scope.

The definition also includes an important exclusion: common commercial products with embedded AI (like spell-check or map navigation). This exclusion recognizes that not every AI-enabled tool requires the same level of governance. However, financial institutions should be cautious about applying this exclusion too broadly. An AI feature in a general-purpose tool that is used for a business-critical or regulatory function may still warrant governance attention.

The distinction between an AI system and an AI model has direct governance implications. Many financial institutions have model risk management frameworks that focus narrowly on the model itself. The AI system definition expands the governance perimeter to include the full operational context.

This matters because risk can arise from any component of the system, not just the model. A perfectly accurate model can produce harmful outcomes if the data pipeline feeding it is corrupted, the business rules applied to its outputs are flawed, or the human override process is poorly designed.

Regulatory implications include:

• Inventory scope. AI use case inventories should document systems, not just models. This captures the full risk surface including data dependencies, integration points, and operational workflows.
• Validation scope. Validation should assess the system holistically, including how the model interacts with other components and how outputs are used in business decisions.
• Change management. Changes to any component of an AI system (data sources, business rules, integration logic, user interfaces) can affect system behavior and should be subject to change management controls.

1. Define “AI system” for your organization. Adopt a definition that aligns with the statutory language and apply it consistently across your governance framework.
2. Inventory at the system level. Your AI use case inventory should capture the full system, including all models, data sources, integrations, and operational processes.
3. Assess risk holistically. Risk assessments should evaluate the entire system, including components beyond the model itself.
4. Govern embedded AI. AI capabilities embedded within larger systems (CRM platforms, loan origination systems, compliance tools) should be identified and brought into the governance framework.
5. Document system architecture. Maintain architecture diagrams and data flow documentation for each AI system that show how all components interact.
6. Apply proportionate governance. Use the exclusion for common commercial products judiciously, but ensure any AI feature used for business-critical or regulatory functions receives appropriate oversight.

AI model, Artificial intelligence (AI), AI use case, AI governance, AI lifecycle, AI use case inventory