Is the language model part of the machine?

Yes. Like every model, provider, data centre and network, it is part of the worldwide web that the blueprint calls the machine. What belongs to the company is only the access: this model, in this version, through this gateway, with these settings. That is what documentation can record.

Is an AI assistant that employees use in the company part of the company's AI systems?

Only if the company has made it part of a defined configuration, with its sources and rules. Otherwise its use is unconfigured AI use: the machine reaches the company through it all the same, but outside every decision the company has made.

Why does the blueprint avoid the singular "an AI system"?

On its own, the singular could mean any AI app that happens to be available. Where one function is meant, it is named as an AI function, such as the assistant on the operator panel; the legal term of the AI Act is kept as a separate boundary.

Does the cascade decide whether something falls under the EU AI Act?

No. Whether something is an AI system under Article 3(1) and which obligations apply is decided by the legal assessment. The cascade only says where a source, a rule or a risk sits and who can decide about it.

Where should a change of model version be documented?

At the level of contracted access, where model, version, region and terms are agreed. That is where a changed answer can be traced to a changed model.

All context cards

Context card

AI systems and the machine: scope and out of scope of every level

Where do a company's AI systems end, where does the machine reach into them, and what lies outside every configuration?

By knowledge.aitechdoc.world

Reviewed 7 October 2026

Review log and changes

The short answer

In Saina Veigel's blueprint, AI systems are one configuration of AI functions that a company has defined for a device, a machinery line or a set of interlinked systems. The machine is the unseen worldwide web of AI compute and AI communication that runs through every level and reaches into the company through its AI systems; nobody sees it whole or owns it. The levels differ by who can decide: nobody alone, the contract, the company, the configuration, the user.

For: Technical writers, documentation systems developers and AI governance teams

Key points

Dependence is not membership: every AI function depends on the machine, but only what the company has agreed or decided belongs to its access and its AI systems.
The machine is the unseen worldwide web of AI compute and AI communication: no company owns it, every company decides where it lets it in, and it never means machinery.
AI systems are always one company-defined configuration and always plural; a single function is named as an AI function.
Company-wide rules and shared services belong to the company AI estate, not to one configuration.
AI use outside any configuration has its own name, unconfigured AI use, and is never called AI systems.
None of the levels says whether something is an AI system under Article 3(1) of the EU AI Act.

The context

Why the network needs levels

Behind one answer of the assistant on an operator panel there is a large language model from a provider, a contract and a gateway that fix which model and version are used, company-wide rules, the configuration defined for the machinery line, the documentation the retrieval selects and the assistant itself. The functions a company uses always reach into the global AI environment, so everything seems to belong to everything.

The blueprint AI systems and the machine: levels and boundaries by Saina Veigel separates this network with one test: who can decide or change something here? It keeps the definitions of AI systems and the machine from the blueprint AI-enabled information systems for technical writers word for word and adds the levels through which the machine runs.

The cascade at a glance

Term	Who decides	In scope	Out of scope	Test question
1 · Global AI environment	No single company	Model families and providers, compute and cloud, public content, AI search and crawlers	Anything the company has agreed or configured	Can the company change it, or only choose it?
2 · Contracted access	Company and provider, by contract and settings	Model and version, interface or gateway, tenant, region, retention, terms of use	The provider's training, data and other services	Is it written in a contract or a setting?
3 · Company AI estate	The company	Usage policies, approvals, shared retrieval and terminology services, the AI management system	The decisions of a single configuration	Does it apply to every configuration?
4 · AI systems	The people responsible for the configuration	The AI functions specified and combined for one device, line or set of interlinked systems, with their interfaces	Apps nobody specified; the product (machinery) itself	Did the company decide that it belongs to this configuration?
5 · AI function	The department and the user at the point of use	One named function a user operates or asks	The knowledge it draws on	Is it the one thing a user operates or asks?
Across · The machine	Nobody as a whole; where it reaches in, whoever decides at that level	The worldwide web of AI compute and AI communication as it runs through every level, and every point where it reaches into the company and reads its documentation, data, terminology and rules	Machinery; a map of the machine as a whole	Where does it reach into this configuration, and what does it read there?
Boundary · Unconfigured AI use	Individuals, without a company decision	Any AI app used outside a company-defined configuration	Everything the company has configured	Is it in a configuration?
Boundary · AI system (AI Act)	The legislator	The legal definition of Article 3(1) and its obligations	The levels of the cascade	Is this a legal question?

The boundary layer: contracted access

Contracted access is the level that is most often left out. It is where the machine reaches from the global environment into the company: the model belongs to the provider, but which model, which version, through which API gateway, in which region and on which terms is the company's decision. When answers change after a model update, this is where the change can be traced. An unchanged app is no proof of an unchanged model.

The machine runs through every level

The machine is not a level. It is the unseen worldwide web of AI compute and AI communication — models and their providers, data centres, networks and the content they draw on — and it changes faster than any description of it, so it can be named but not mapped. It reaches into the company through its AI systems: a retrieval-augmented generation setup reads the documentation, the terminology and the knowledge graph that the company maintains, and the language model is reached through contracted access. The machine as a whole can't be documented; every point where it reaches in can.

What lies outside

Any available app can answer questions about a product. Used without a company decision, it is unconfigured AI use: the machine reaches the company through it all the same, outside every decision, and documentation doesn't promise anything for it. Naming it makes it visible, so that someone can decide whether it becomes part of a configuration, for example under the company's AI usage policy.

The legal term AI system (AI Act) is a boundary of its own. Whether a function or a configuration is an AI system under Article 3(1), and which roles such as provider or deployer apply, is decided by the legal assessment, not by the cascade.

Related established models

The EU AI Act assigns obligations along the AI value chain (Articles 3 and 25); it doesn't describe where an answer comes from.
ISO/IEC/IEEE 21841 distinguishes directed, acknowledged, collaborative and virtual systems of systems by how far they are centrally managed — the same question of control the cascade asks.
ISO/IEC 42001 sets requirements for an AI management system within an organisation, which corresponds to the company AI estate.
ISO/IEC 22989 names the roles in the AI ecosystem; the NIST AI Risk Management Framework describes AI actors across the lifecycle.

Limits

The cascade is a way to place sources, rules and risks for documentation. It is not a legal classification, it doesn't replace the manufacturer's risk assessment or the safety information required for a product, and naming a law or standard doesn't mean that anything conforms to it.

Questions readers ask next

Is the language model part of the machine?: Yes. Like every model, provider, data centre and network, it is part of the worldwide web that the blueprint calls the machine. What belongs to the company is only the access: this model, in this version, through this gateway, with these settings. That is what documentation can record.
Is an AI assistant that employees use in the company part of the company's AI systems?: Only if the company has made it part of a defined configuration, with its sources and rules. Otherwise its use is unconfigured AI use: the machine reaches the company through it all the same, but outside every decision the company has made.
Why does the blueprint avoid the singular "an AI system"?: On its own, the singular could mean any AI app that happens to be available. Where one function is meant, it is named as an AI function, such as the assistant on the operator panel; the legal term of the AI Act is kept as a separate boundary.
Does the cascade decide whether something falls under the EU AI Act?: No. Whether something is an AI system under Article 3(1) and which obligations apply is decided by the legal assessment. The cascade only says where a source, a rule or a risk sits and who can decide about it.
Where should a change of model version be documented?: At the level of contracted access, where model, version, region and terms are agreed. That is where a changed answer can be traced to a changed model.

Sources

Saina Veigel, AI systems and the machine: levels and boundaries (blueprint, edition 1) — knowledge.aitechdoc.world, 7 October 2026
Saina Veigel, AI-enabled information systems for technical writers (blueprint, edition 1) — knowledge.aitechdoc.world, 6 October 2026
Regulation (EU) 2024/1689 (Artificial Intelligence Act), Articles 3 and 25 — EUR-Lex, 7 October 2026
ISO/IEC/IEEE 21841:2019, Systems and software engineering — Taxonomy of systems of systems — ISO, 7 October 2026
ISO/IEC 42001:2023, Information technology — Artificial intelligence — Management system — ISO, 7 October 2026
ISO/IEC 22989:2022, Artificial intelligence concepts and terminology — ISO, 7 October 2026
Artificial Intelligence Risk Management Framework (AI RMF 1.0) — NIST, 7 October 2026

Review log and changes

Every context card is checked against its sources before it is published, and again whenever it changes; the date under the byline is the last review. Corrections (something was wrong) and additions (something was missing) are logged below with date and time (Berlin time). Typos, formatting and link fixes are not listed.

Reviewed 7 October 2026

Corrections and additions

Every correction and addition to this card, with date and time (Berlin time).

Correction7 October 2026, 21:12 CEST
Corrected the definition of “the machine” with edition 2 of the blueprint: it is the unseen worldwide web of AI compute and AI communication that runs through every level and reaches into a company through its AI systems — not the parts that serve one configuration.

Glossary terms on this card

AI system (AI Act)
Under the EU AI Act, an AI system is a machine-based system designed to operate with varying levels of autonomy, which may exhibit adaptiveness after deployment and which, for explicit or implicit objectives, infers from the input it receives how to generate outputs such as predictions, content, recommendations or decisions that can influence physical or virtual environments.
General-purpose AI model (AI Act)
Under the EU AI Act, a general-purpose AI (GPAI) model is an AI model, including one trained with a large amount of data using self-supervision at scale, that displays significant generality, is capable of competently performing a wide range of distinct tasks and can be integrated into a variety of downstream systems or applications. Models used only for research, development or prototyping before being placed on the market are excluded.
Provider (AI Act)
Under the EU AI Act, a provider is a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model, or has one developed, and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge.
Deployer (AI Act)
Under the EU AI Act, a deployer is a natural or legal person, public authority, agency or other body using an AI system under its authority, except where the system is used in the course of a personal, non-professional activity.
Foundation model
A foundation model is a large AI model trained on broad data at scale that can be adapted to a wide range of tasks — through prompting, retrieval or fine-tuning — instead of being built for a single purpose.
Large language model (LLM)
A large language model (LLM) is a generative AI model, usually a transformer, trained on very large amounts of text to predict the next token in a sequence. From this single skill emerge abilities such as answering questions, summarizing, translating, writing code and following instructions.
Retrieval-augmented generation (RAG)
Retrieval-augmented generation (RAG) is an architecture in which an AI system first retrieves relevant passages from a trusted content source and then has a language model generate its answer from those passages, often with citations — so answers reflect current, approved content rather than only the model’s training data.
Knowledge graph
A knowledge graph is a network of entities — such as products, components, functions and documents — and the typed relationships between them, stored in a machine-readable form such as RDF, so that people and AI systems can query and reason over connected knowledge.
AI agent
An AI agent is a system in which a language model pursues a goal over several steps on its own — planning, calling tools, observing the results and deciding what to do next — until the task is done or it needs human input.
API gateway
In software architecture, an API gateway is a service that acts as the single entry point for client requests to a set of backend services, routing each request and typically handling authentication, rate limiting, protocol translation and logging.
System-of-systems
In systems engineering, a system-of-systems (SoS) is a set of independent systems that interact to provide a capability that none of them provides alone, while each constituent system keeps its own operational and managerial independence.
AI management system (AIMS)
An AI management system (AIMS) is the set of interrelated policies, objectives, processes and controls an organization establishes to develop, provide or use AI systems responsibly, including risk and impact assessment, lifecycle controls and continual improvement. ISO/IEC 42001 specifies requirements for such a system and allows certification.
AI usage policy
An AI usage policy is an organization’s internal rule set for using AI tools — which tools are approved, which data may be entered, which tasks require review or disclosure, and who is accountable — so that employees can use AI productively without creating legal, security or quality risks.
AI governance
In organizations, AI governance is the system of roles, policies, processes and controls by which the development, procurement, use and monitoring of AI systems is directed and overseen, so that AI is used effectively, responsibly and in line with legal requirements. ISO/IEC 38507 addresses the governance implications of AI for governing bodies.