# AI Act Scope — legal context bundle > Curated from overview.legal on 2026-08-22. Canonical page: https://overview.legal/topics/ai-act-scope-and-definitions > Sources are cited per item. Verify against the official texts before relying on them. The 'Subject matter' section is foundational to understanding what the AI Act covers, defines key terms, and establishes the scope of application. This concept deserves its own dedicated topic as it is distinct from general compliance requirements. ## Overview ## Legal Context The AI Act’s “subject‑matter” clause is the cornerstone that determines what falls under its ambit. It draws on the material scope of the GDPR (art‑2‑en) and the territorial reach (art‑3‑en) while also borrowing from the NIS2 framework (nis2‑art‑1‑nl/en) and the UAVG provisions (art‑2, art‑4, art‑34). The commentary on the AVG clarifies how data of a “strafrechtelijke aard” is treated, how authorities can issue warnings, and how categories such as “ras of etnische afkomst” are defined. These insights help us see that the AI Act covers not only AI systems that process personal data but also the related administrative and technical infrastructure that supports such processing. ## Core Requirements 1. **Definition of an AI system** – any automated or semi‑automated tool that processes personal data, whether it is a standalone application or part of a larger data‑handling ecosystem. 2. **Scope of data** – includes both “geheel” and “gedeeltelijk” automated processing, as well as non‑automated entries that are later incorporated into structured datasets. 3. **Territorial reach** – the Act applies to activities conducted within the EU, to public authorities, and to any other body that falls under the UAVG definition of a “public authority” (art‑4). 4. **Administrative oversight** – authorities may issue a “bestuurlijke waarschuwing” (art‑58‑2‑a) to signal that the Act’s provisions are being applied, and they must respond to such warnings (art‑58‑4). 5. **Data retention and reporting** – the Act obliges entities to retain and report on the use of AI systems, echoing the requirements in the Data Retention Directive (art‑1‑nl of the AVG). ## Interpretation & Application The AVG commentary on “betekenis” shows that data of a criminal nature is treated as a special category, which the AI Act expands to cover all AI‑driven data processing. In the BONNIER case, the court held that the directive’s retention requirements apply to AI systems that generate data for criminal investigations, illustrating how the AI Act’s subject matter can be applied in practice. The ASNEF ruling confirms that the directive’s provisions can be directly applied by national authorities, which means the AI Act can be enforced without additional national legislation. RUNDFUNK demonstrates that the same principle applies to civil proceedings, reinforcing the idea that the AI Act’s scope is both broad and flexible. ## Practical Considerations Compliance professionals must first map their AI systems to the Act’s definition, ensuring that all automated and non‑automated processes are included. They should document the data flow, retention schedules, and the roles of public authorities involved. A key challenge is aligning the AI Act’s requirements with existing GDPR and NIS2 obligations; a clear audit trail will help avoid overlap. It is also essential to monitor the evolving interpretation of “AI system” in court decisions, as new case law may refine the scope. ## Connections The AI Act’s subject‑matter clause is the bridge between AI, personal data, and processing. It informs law‑enforcement agencies on how to use AI for investigations, guides HR departments on data‑driven recruitment tools, and supports the broader data‑economy strategy. By understanding the scope, practitioners can better integrate AI solutions into their data‑management frameworks, ensuring compliance across all relevant legal domains. ## Legislation (full text of key provisions) ### Recital 100 — general-purpose AI system definition and integration *Source: AI Act, aiact-rec-100-en, 2024-06-12 — https://overview.legal/posts/93882* When a general-purpose AI model is integrated into or forms part of an AI system, this system should be considered to be general-purpose AI system when, due to this integration, this system has the capability to serve a variety of purposes. A general-purpose AI system can be used directly, or it may be integrated into other AI systems. ### Recital 12 — AI system definition and characteristics *Source: AI Act, aiact-rec-12-en, 2024-06-12 — https://overview.legal/posts/93706* The notion of ‘AI system’ in this Regulation should be clearly defined and should be closely aligned with the work of international organisations working on AI to ensure legal certainty, facilitate international convergence and wide acceptance, while providing the flexibility to accommodate the rapid technological developments in this field. Moreover, the definition should be based on key characteristics of AI systems that distinguish it from simpler traditional software systems or programming approaches and should not cover systems that are based on the rules defined solely by natural persons to automatically execute operations. A key characteristic of AI systems is their capability to infer. This capability to infer refers to the process of obtaining the outputs, such as predictions, content, recommendations, or decisions, which can influence physical and virtual environments, and to a capability of AI systems to derive models or algorithms, or both, from inputs or data. The techniques that enable inference while building an AI system include machine learning approaches that learn from data how to achieve certain objectives, and logic- and knowledge-based approaches that infer from encoded knowledge or symbolic representation of the task to be solved. The capacity of an AI system to infer transcends basic data processing by enabling learning, reasoning or modelling. The term ‘machine-based’ refers to the fact that AI systems run on machines. The reference to explicit or implicit objectives underscores that AI systems can operate according to explicit defined objectives or to implicit objectives. The objectives of the AI system may be different from the intended purpose of the AI system in a specific context. For the purposes of this Regulation, environments should be understood to be the contexts in which the AI systems operate, whereas outputs generated by the AI system reflect different functions performed by AI systems and include predictions, content, recommendations or decisions. AI systems are designed to operate with varying levels of autonomy, meaning that they have some degree of independence of actions from human involvement and of capabilities to operate without human intervention. The adaptiveness that an AI system could exhibit after deployment, refers to self-learning capabilities, allowing the system to change while in use. AI systems can be used on a stand-alone basis or as a component of a product, irrespective of whether the system is physically integrated into the product (embedded) or serves the functionality of the product without being integrated therein (non-embedded). ## Recent developments ### CJEU: PNR Directive Valid if Limited to the “Strictly Necessary” *Source: eucrim, 2022-08-04 — https://overview.legal/posts/6292 — original: https://eucrim.eu/news/cjeu-pnr-directive-valid-if-limited-to-the-strictly-necessary/#entry-388* > In a landmark ruling of 21 June 2022, the CJEU (Grand Chamber), upheld the EU’s regime to collect and use records of travellers, provided that it is strictly interpreted in line with the EU’s fundamental rights. In addition, indiscriminate processing of the data in cases of flights carried out only within the EU is banned unless there is a threat of terrorism. In general, the passengers’ data must also be deleted after six months at the latest. ## Related topics - **Artificial Intelligence** — https://overview.legal/topics/ai AI systems and their implications for data protection - **AI Act Definitions and Terminology** — https://overview.legal/topics/ai-act-definitions While 'AI Act Scope and Definitions' exists, a more granular topic specifically focused on the definitional content and terminology would better capture the nua - **AI Act Material Scope** — https://overview.legal/topics/ai-act-material-scope The material scope defines which types of AI systems and activities fall within the regulation's coverage, including specific exclusions and definitional bounda - **Human Oversight** — https://overview.legal/topics/human-oversight-ai This new topic is needed because human oversight is a specific and distinct requirement under the AI Act that deserves dedicated coverage, encompassing mechanis - **Education** — https://overview.legal/topics/education Processing in educational institutions - **GPAI Systemic Risk** — https://overview.legal/topics/general-purpose-ai-models-systemic-risk This new topic is needed because the content specifically addresses the classification and identification of general-purpose AI models that present systemic ris --- Generated by overview.legal · https://overview.legal/topics/ai-act-scope-and-definitions · 2026-08-22