What Counts as AI in 2026: A U.S. Legal Guide

The definition of artificial intelligence has left the classroom and become a legal criterion in the United States. By August 2026, three different rules will depend on it to decide whether your system is in or out of scope: the FDA's proposed AI/ML framework, the FTC's enforcement policy on AI, and the state-level AI laws like the Colorado AI Act. If you run a chatbot, this reaches you.

TL;DR

A legal definition of AI exists to separate deterministic automation from systems that infer—and the verb infer is the dividing line.

The OECD rewrote the concept in 2023/2024; the EU AI Act and the Colorado AI Act inherited the same skeleton.

The Colorado AI Act doesn't just define the system: it defines developers, deployers, and AI agents. Those who merely use AI also have obligations.

The FDA's proposed rule on AI in medical devices is expected to be finalized in 2026. The FTC has already signaled that AI claims are subject to existing consumer protection laws.

Only 17% of U.S. businesses used AI in 2025 (according to a national survey). The regulatory bar is arriving before widespread adoption.

What is AI, anyway: technical definition vs. legal definition

A definition of artificial intelligence needs to serve two audiences with opposing needs, and that's where the confusion begins.

In everyday use, "AI" has become an umbrella term for anything that seems smart: email autocomplete, spam filters, video recommendations, store chatbots. This elasticity is harmless in a hallway conversation but costly inside a contract.

The technical definition describes a field of research: systems that perform tasks typically associated with human cognition—recognizing patterns, learning from examples, deciding under uncertainty. It's useful for engineers and terrible for lawyers, because it doesn't delimit anything.

The legal definition does the opposite. It needs to be narrow enough not to capture an Excel spreadsheet and broad enough not to let a language model escape on a technicality. That's why legal texts have converged on a specific verb: infer.

If the system merely executes a rule you wrote ("if the message contains the word 'invoice,' reply with link X"), it doesn't infer—it obeys. If the system derives on its own how to reach a goal from input data, it infers. That's the dividing line that underpins nearly all AI regulation written in the last five years.

Holding onto this difference is what separates a useful answer from unnecessary panic. Much of the customer service automation running today in the U.S. is not AI in the legal sense. Another part is—and doesn't know it.

The OECD's definition of AI has become the global standard

In 2023 and 2024, the OECD revised the concept it had published in 2019. The current version reads:

"An AI system is a machine-based system that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments. Different AI systems vary in their levels of autonomy and adaptability after deployment."

Three words carry the weight of the sentence: infers, autonomy, and adaptability.

The most relevant change from the 2019 text is subtle but important: the system's objectives no longer need to have been set by a human. An agent that generates sub-goals on its own still falls within the concept. It was a course correction in light of what models began doing between 2020 and 2024.

This formulation has been adopted by the EU AI Act, the Council of Europe, the United Nations, and U.S. standards. When you read an international contract that mentions AI system, this is almost always the yardstick being applied—including in the annexes of cloud providers that many U.S. companies sign without reading. The full text is in the OECD AI Principles.

Why lawmakers prefer "infer" over "learn"

"Learn" would exclude symbolic systems and also already-trained models that just run in production. "Infer" covers both cases: the model that continues training and the frozen model that only produces outputs. Every definition of AI written after 2019 inherited this verb for that reason.

For a company, the consequence is direct: running a ready-made model—like a GPT or a Gemini via API—is enough to fall under the concept. You don't need to train anything or hire a data scientist.

How the Colorado AI Act writes the definition of AI in the U.S.

The most concrete U.S. state law to date is the Colorado AI Act, signed into law in May 2024 and taking effect in 2026. It defines an AI system as:

"any machine-based system that, for any explicit or implicit objective, infers from the input it receives how to generate outputs that can influence physical or virtual environments, and that can, with varying levels of autonomy, operate without human oversight."

Compare that with the OECD and you'll see the same skeleton: variable autonomy, inference, outputs that influence the world. The U.S. difference lies in what comes next. The Colorado Act doesn't stop at the definition—it distributes responsibilities.

Developer, deployer, and AI agent: the labels that decide who's responsible

Term (Colorado AI Act)	Who it is	Practical example
Developer	A person or entity that designs, codes, or substantially modifies an AI system for use by another	The company that builds and sells the AI-powered customer service platform
Deployer	A person or entity that uses an AI system in the course of a business or commercial activity	The clinic, school, or store that turns on the chatbot on its website
AI agent	An AI system that can take actions on behalf of a user or system, with some degree of autonomy	A bot that autonomously responds to customer inquiries
Regulator	The state attorney general has exclusive enforcement authority	The Colorado Attorney General's office

The point that often goes unnoticed: you don't need to develop AI to have obligations. Merely using it is enough. The deployer figure exists precisely to reach the pizzeria that contracted a bot, not just the lab that trained the model. It's the same logic as controller and processor under the GDPR or CCPA.

Why the definition of AI became urgent in 2026

Three developments pushed the topic to the top of search queries in recent weeks.

1. The FDA's proposed rule on AI in medical devices is expected to be finalized in 2026. The agency has been working on a framework for AI-enabled devices, including requirements for transparency and real-world performance monitoring. The rule would classify AI systems by risk level and impose obligations on developers and deployers in healthcare.

2. The FTC has stepped up enforcement on AI-related claims. In 2024 and 2025, the FTC brought actions against companies for deceptive AI claims and has signaled that it will use its authority under Section 5 of the FTC Act to police AI practices. This includes chatbots that mislead consumers.

3. State-level AI laws are proliferating. Beyond Colorado, states like California, New York, and Texas have introduced or passed AI legislation. The Colorado AI Act takes effect in 2026, and other states are following suit.

None of these moves works without an operational concept. Classifying risk requires knowing what the classified object is. Labeling synthetic content requires knowing what counts as synthetic. That's why the search for the definition of AI has risen in the U.S. this year: it has become a compliance prerequisite, not a blog curiosity.

The practical test: does your chatbot fit the legal definition of AI?

Before applying the definition of AI to your case, run through five questions. I use this sequence with clients before any conversation about risk:

Does the system produce outputs that no one wrote in advance? If every possible response is in a human-designed flow, it's deterministic automation.
Does it decide the path on its own from the input? Classifying intent, choosing a service route, summarizing history—all of that is inference.
Does it use a language model, computer vision, or machine learning, even from a third party? Calling an API counts. Developer and deployer are distinct roles, but both are agents.
Does the output influence a decision about a person? Triage, prioritization, credit scoring, product recommendation, denial of service.
Can you explain why it responded that way? If you can't, you have a transparency problem before you have a legal problem.

When your bot is probably not AI

Numbered menu, exact keyword response, fixed link trigger, business hours notice, handoff to human by rule. That's flow, not model. It's still subject to the FTC Act and state consumer protection laws, but it falls outside the definition of AI adopted by regulatory texts—which changes the size of your homework considerably.

When it is, without question

Response generated by a language model, automatic intent classification, conversation summary, audio transcription, personalized recommendation, automatic lead qualification. If you use any of these pieces—and most modern customer service operations use at least two—you are a deployer of an AI system. It's worth reading about what AI agents mean for businesses before deciding on the design.

AI in the 2026 elections: the rules that already reach chatbots and avatars

While the U.S. has no federal AI law yet, the Federal Election Commission (FEC) has been considering rules on AI-generated content in campaign ads. In 2024, the FEC dismissed a petition to ban deepfakes in political ads, but states have stepped in. As of 2026, over 20 states have laws regulating AI in elections, including labeling requirements and bans on deepfakes.

What these rules typically require and prohibit:

Mandatory labeling. Any campaign ad created or significantly altered by AI—text, audio, video, or image—must include a clear disclosure that AI was used, with specific placement rules.
Deepfake bans. Synthetic content that creates, replaces, or alters the image or voice of a person (living, dead, or fictional) to harm or benefit a candidacy is prohibited. Labeling doesn't legalize it.
AI cannot recommend candidates. Systems cannot rank, recommend, suggest, or prioritize candidates, campaigns, parties, or coalitions—even when the user asks.
Blackout periods. Some states prohibit AI-generated content using the voice or image of candidates in the days immediately before an election.
Fines. Penalties range from $1,000 to $100,000 per violation, depending on the state, plus removal of content and potential criminal charges.

Here the definition of AI matters twice: to know if the content is synthetic and to know if the system distributing it is AI. For those running automated customer service, the message is direct—if your bot operates during an election year and someone asks who to vote for, it cannot answer. And if it talks to voters, they need to know they're talking to a machine. Reviewing your system prompt before the election season costs an hour and avoids a notification.

Transparency, logs, and privacy laws: what changes for companies already using AI

The three core obligations stem from the same definition of AI that the texts share, even if they appear with different words in each rule.

Disclose that it's AI. The patient needs to know (FDA). The voter needs to know (state laws). The affected person has a right to an explanation (Colorado AI Act). In practice, a line in the bot's first message solves much of this: "Hello! I'm the virtual assistant for Company X." It costs nothing and is worth a lot in a dispute.

Keep records. If you don't store what the model responded, you can't prove anything. Log the conversation, model version, system prompt, and date. That's not bureaucracy: it's the only defense available when someone claims the bot promised a discount that didn't exist.

Process data with a legal basis. A customer conversation is personal data. If it feeds a model, that's processing. The CCPA and other state privacy laws already applied before any AI law, and they remain the floor, not the ceiling.

There's a fourth item, less cited and more expensive: human escalation channel. Every recent rule keeps the relevant decision with a person. The doctor decides (FDA). The voter cannot be induced (state laws). The affected person can contest (Colorado AI Act). A bot without a "talk to a human" button is legal risk disguised as savings.

If you use the official WhatsApp Business API, you've already solved part of this through the channel itself, which logs messages and requires opt-in. If your operation still runs on the regular app, it's worth understanding the difference between the WhatsApp Business App and the Official API, because that's also a difference in auditability. And if automated volume has grown in recent months, the practices that prevent number blocking go hand in hand with transparency rules.

AI adoption in the U.S.: 17% and what that number hides

The regulatory bar is arriving faster than adoption. According to a 2025 survey by the U.S. Census Bureau, only 17% of U.S. businesses used AI in their operations. Among large firms (250+ employees), the rate was 50%, but among small businesses (10-49 employees), it was just 15%.

Segment	2024	2025
Businesses using any AI	13%	17%
Large businesses (250+ employees)	38%	50%
Small businesses (10-49 employees)	10%	15%
Text mining / analysis of written language	33%	38%
Natural language generation	20%	30%

Two sector cuts stand out: accommodation and food services jumped from 13% to 51% in text mining, and arts, culture, sports, and recreation went from 14% to 40%. These are intensive customer service sectors—exactly where the chatbot enters first.

What the aggregate number hides is the gap between sizes. Half of large companies already operate AI; among small ones, which represent 87% of the surveyed population, it's 15%. In other words, most of the U.S. market will encounter the definition of AI for the first time inside a contract, a request for proposal, or a notification—not in a carefully planned project.

How we handle this in Agathas Web projects

Since 2008, I've built systems for clients in the U.S. and abroad, and the most annoying part of any AI project is never the model—it's the perimeter. In the last two years, I've made four questions mandatory before turning on any automation with a language model:

Which decision does the system make on its own, and which does it only suggest?
Does the end user know they're talking to a machine?
Where is the log, in what format, and for how long?
Who is the human on duty when the bot makes a mistake?

It's not conservatism. It's that the answers to these four questions are exactly the material the client will need to present if ever questioned—by the FTC, a state attorney general, or an angry consumer in court.

In WhatsApp customer service projects, the standard architecture we use separates the deterministic flow (menu, protocol, hours, handoff) from the inference layer (intent classification, summarization, response drafting). That's not technical fussiness: it's what allows us to answer precisely which parts of the system fall under the definition of AI and which don't. When the question comes from a lawyer, that separation is worth more than any model benchmark.

Conclusion: concept first, tool later

The definition of AI is not a decorative preamble to legal text—it's the switch that turns on or off an entire set of obligations for your operation.

Next practical step, and it takes less than an hour: list the automations running in your company today, mark which ones produce output that no one wrote in advance, and note where the log for each one is. That simple spreadsheet is the beginning of your AI inventory.

With the FDA rule expected in 2026, state laws like Colorado's taking effect, and the FTC actively enforcing, those who already have an inventory will spend weeks less than those who start after the first notification. If you want to discuss the technical design of that separation in your customer service, it's the kind of conversation we have here every month.