This guidance addresses the ICT risks associated with the use of AI systems.
The term “AI system” is legally defined in Article 3(1) of the EU AI Act5. This states that an AI system is “a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments”.
“Machine-based” refers to the fact that AI systems are developed with the help of machines and run on machines. “Machines” consist of hardware and software components that enable AI systems to function. The hardware components refer to the physical elements of the machine, such as processing units, memory, network devices and input/output interfaces. Among other things, the software components include computer code, operating systems and applications (see Commission Guidelines of 29 July 2025, C(2025) 5053 final, margin no. 116).
“AI systems” are thus a subset of the broader category of “network and information systems” as defined in Article 3(2) of the Digital Operational Resilience Act (DORA). The use of such machine-based systems and the hardware and software they contain gives rise to ICT risks. This guidance exclusively addresses these ICT risks and is based on the requirements of DORA and the RTS RMF and RTS Subcontracting. The term “machine-based system”, as defined by DORA, is therefore understood to refer to a combination of ICT assets (hardware and software) and infrastructure in which a complex mathematical model is implemented (see also Figure 1). The model itself is understood to be an ICT asset (software).
The term “AI system” used in this guidance should therefore be understood as a combination of ICT assets and ICT infrastructure (see also Figure 1). This guidance does not address the terms "autonomy" and "adaptiveness" contained in the definition of the AI Act, or the mathematical modelling methodology, including the data used, its development or validation.
AI systems – as with ICT systems in general – serve business processes. The nature and scope of an AI system depend on the individual case and must correspond in particular to the business purpose, the risk situation and the relevant context.