What We Mean by AI

Why the term needs care

For many organizations, AI is already part of daily work, and much of it arrives inside software they already license rather than through a project of their own. A statement such as “we use AI in hiring” or “our close is AI-assisted” therefore says little on its own. It does not say what the system does, who can change it, whether it decides anything about a person, or what evidence supports relying on its output. A vendor’s description of a product as “AI” says no more.

The recognized definitions are broad and closely aligned. The OECD defines an AI system as a machine-based system that, for explicit or implicit objectives, infers from the input it receives how to generate outputs such as predictions, content, recommendations or decisions that can influence physical or virtual environments, and notes that AI systems vary in their levels of autonomy and adaptiveness after deployment. The EU AI Act uses almost the same wording. NIST’s AI Risk Management Framework uses a definition adapted from the OECD’s 2019 wording and from ISO/IEC 22989:2022.

Under these definitions, a machine learning forecasting model, a chat assistant and an agent that initiates payments each qualify as an AI system, while a purely rules-based matching engine may not. Laws aimed at particular decisions often reach further. New York City’s hiring law covers automated employment decision tools derived from machine learning, statistical modeling, data analytics or artificial intelligence that issue a simplified output, such as a score or recommendation, used to substantially assist or replace discretionary decisions. Colorado’s law, which applies from January 1, 2027, covers automated decision-making technology used to materially influence consequential decisions, including employment. An April 27, 2026 stipulated court order restricted enforcement pending a ruling on a forthcoming preliminary-injunction motion; the hiring watch follows the litigation and rulemaking. Whether a rule applies can depend on what a tool does to a decision, not on whether anyone calls it AI.

The label alone cannot tell anyone what to control. Achieving Effective Internal Control Over Generative AI, a publication commissioned by COSO, written by academic and practitioner authors, and released on February 23, 2026, makes a similar point: because generative AI appears in a wide variety of tools, interfaces and embedded features, classifying it by the latest product name or vendor is a moving target, so the publication looks instead at what the system actually does.

Four kinds of AI

The Center of Eminence groups the AI an organization is likely to meet into four kinds. They describe roles, not products, and they overlap: a single platform can include all four.

1. AI built into the software you license

Features delivered inside the ERP, close, planning, HR, applicant tracking and other business software an organization already licenses. Examples include suggested matches in a reconciliation tool, flagged journal entries, draft variance commentary, candidate rankings in a recruiting system and data extracted from invoices or résumés.

Named examples. Oracle’s Transaction Matching Assistance uses machine learning trained on an organization’s past manual matches to predict matches for unmatched transactions. Anaplan’s Forecaster is a machine-learning forecasting tool whose forecast items can be budget lines such as a spend category or cost center.

What changes it. The vendor builds these features and changes them through its releases. The organization decides which ones to enable and how to configure them, within the options the vendor offers. The COSO-commissioned publication notes that any generative AI capability obtained from a vendor, whether hosted, embedded in an application or deployed on premises, limits visibility and oversight of training data, model updates, change cadence, data and underlying control processes. It adds that significant changes to a model, its data, its prompts or its connections can materially alter risk, and that risk assessment must track them.

The question to ask. Which AI features are switched on in the software we license, who decided to switch them on, and how will we know when a release changes what they do? Where we rely on a vendor’s assurance report, does it cover the AI feature?

2. General-purpose AI assistants

Chat assistants and productivity copilots that people use alongside other systems to draft, summarize, analyze or build files. For example, Microsoft’s Copilot in Excel can create a chart from a description of the chart a user wants, and Microsoft tells users to review, edit and verify anything it creates.

What changes it. The provider updates the underlying model; the individual user supplies the prompt and the data. The COSO-commissioned publication notes that generative AI has a low barrier to entry and that controls should be designed to govern who can build, deploy and interact with it.

The question to ask. Which assistant outputs reach a report, a ledger, a client, a candidate or a decision, and what review do they receive before they do?

3. AI agents and automated actions

AI configured to take actions in other systems, such as posting entries, approving transactions, changing records, sending messages or initiating payments. Agents may be built in house, bought as a product or included in software the organization already licenses. Microsoft’s Account Reconciliation Agent for Dynamics 365 Finance, released as a production-ready preview, for example evaluates reconciliation exceptions and recommends an action for each, such as creating a journal entry the user can accept. The COSO-commissioned publication describes AI agents as coordinating and performing multi-step tasks with minimal human input, and notes that agents can introduce authorization risks, excessive agency and insecure interfaces.

OWASP’s Gen AI Security Project defines excessive agency as the vulnerability that enables damaging actions in response to unexpected, ambiguous or manipulated outputs from a large language model; its root cause is typically excessive functionality, excessive permissions, excessive autonomy, or a combination of them.

What changes it. Its permissions, its instructions and configuration, the tools and data it connects to, and the model underneath.

The question to ask. What can it do without a person’s approval, under whose authority, and is that limit enforced by the system it acts in rather than by its own instructions? OWASP recommends enforcing authorization in downstream systems rather than relying on the model to decide whether an action is allowed.

4. Established machine learning and rules-based automation

Matching engines, anomaly and risk scoring, forecasting models, document capture and the scoring rules in screening tools. Much of this predates generative AI, and organizations often already test it as automated controls. Some purely rules-based automation would not meet the OECD or EU definitions, which require a system that infers from its input how to generate outputs, but the Center of Eminence includes it because it raises the same questions, and because some laws, such as New York City’s, cover statistical tools as well. The COSO-commissioned publication advises organizations to decide first whether generative AI is the right tool, noting that deterministic automation or traditional machine learning sometimes provides greater reliability and lower risk.

What changes it. Changes to rules and thresholds, model retraining, and shifts in the data the system receives, usually made through the organization’s change management.

The question to ask. Is it covered by existing IT controls and testing, and has anything about it, including the data it receives, changed since it was last tested?

Where the kinds overlap

One recruiting platform might parse résumés with established machine learning, rank candidates with a scoring model, offer a generative assistant that drafts outreach and include an agent that schedules interviews. One close platform might match transactions with rules, score entries for anomalies, draft commentary and post entries. Each feature belongs to the kind that describes its role and needs its own answers to the questions below.

The COSO-commissioned publication sorts generative AI uses into eight capability types, from ingestion and posting to human-AI interaction. Those describe what the AI does within a process; the four kinds describe how it reaches an organization and who can change it.

The questions that matter more than the label

Four distinctions do more than the word “AI” to determine the controls and evidence an organization needs.

Does it suggest or act?

AI that suggests drafts, recommends, ranks or flags, and a person decides what happens next. AI that acts posts, approves, rejects, changes, sends or pays. When AI suggests, the person’s decision is the control, and the evidence is what that person checked; when AI acts, the control moves to the system’s permissions and the limits placed on them. A screening tool that ranks candidates for a recruiter suggests; one that rejects applications automatically acts.

For high-impact actions, OWASP recommends human-in-the-loop control that requires a person to approve the action before it is taken. Where management relies on AI output as evidence that a financial control works, the COSO-commissioned publication says AI controls should meet the same evidence standards expected for internal control over financial reporting.

Who controls it?

Who can change its configuration, prompts, data connections or behavior: the vendor, the business team, IT or an individual user? Whoever can make that change can change the result, and possibly the control. The COSO-commissioned publication treats prompts, system prompts, retrieval connectors and transformation rules as governed configurations with version history, approval workflows and rollback plans. Among common control activities, it lists separating the ability to configure AI settings from the authority to approve or review outputs. It also notes that models, prompts and the data they use for retrieval can evolve frequently. When the vendor controls the change, part of the evidence has to come from the vendor.

Is the output generative or deterministic?

A deterministic system gives the same output for the same input, so a test of its logic supports reliance until the logic changes. A machine learning model can produce a probability score and still be deterministic in this sense, returning the same score for the same input. A generative system can produce different output for the same request.

NIST’s Generative AI Profile, published in July 2024, quotes the definition in Executive Order 14110: generative AI is “the class of AI models that emulate the structure and characteristics of input data in order to generate derived synthetic content,” which can include images, videos, audio, text and other digital content. That order was revoked in January 2025.

The COSO-commissioned publication states that generative AI outputs are probabilistic and can be confidently wrong, and that controls should treat outputs as claims requiring validation rather than as facts to accept by default. It contrasts this with COSO’s earlier guidance on robotic process automation, which addressed deterministic, rule-based bots that execute predefined tasks. For generative output, one successful test says less about the next result, so the evidence has to travel with each output. The publication says processes using generative AI should capture and store the information needed to understand and validate output, including prompts, inputs, outputs, source references, and model and configuration versions, to the level of explainability the control activities require.

Does it decide something about a person?

A tool that shapes a decision about someone’s job, pay, credit, benefits or access to a service carries obligations and harms that a tool drafting internal commentary does not. The EU AI Act lists AI systems intended for recruitment or selection, and for decisions on terms of work, promotion or termination, as high-risk, with the obligations for those systems applying from December 2, 2027. Colorado’s law, from January 1, 2027, turns on whether automated decision-making technology materially influences a consequential decision. When the System Is Presumed Right sets out cases in the Eminence Scan record where a system’s output was treated as fact about a person.

How the Center of Eminence uses these terms

Research pieces state near their opening what they cover, and most name the kind or kinds of AI in a short note headed Which AI this covers. Some pieces are deliberately narrower than these categories:

• Internal Control Over Generative AI, Applied to the Close covers generative AI, because the guidance it applies focuses on risks unique to or significantly amplified by generative AI.
• Your AI Agent Is an Unlisted Signer covers agents and other automation that can act, and leaves out assistants that only draft or suggest.
• AI in Hiring: Standards and Regulatory Watch covers any tool that scores, ranks, screens or recommends candidates or employees, because that is how the laws it tracks draw the line.
• Pieces in the Eminence Scan record cover AI and the automation around it, including systems that would not meet a strict definition of AI, where the failure pattern is the same.

Where a piece’s argument applies whatever the kind of AI, or to work prepared without AI, the piece says so. The four kinds are a working vocabulary, not a standard, and one tool can fall under more than one of them. Use the applicable law and standards, rather than our categories, to determine legal obligations. The answers to the four questions above, not the label, determine which controls apply.

For how the Center of Eminence sources and verifies the claims on this page, see Research Methodology & Evidence Standards.