Information technology (IT) is the broad category of equipment, software, and procedures used to handle data, and artificial intelligence is one kind of software that runs inside it. U.S. federal law defines IT to include computers, software, firmware, and related services, while the National Institute of Standards and Technology (NIST) describes an AI system as one that produces predictions, recommendations, or decisions toward set objectives. The practical difference is where behavior comes from: ordinary software does what its code specifies, and an AI system also depends on the data it was trained on.
Key takeaways
- IT is the wider category; an AI system is software, so it is IT, but most IT is not AI.
- The federal definition of IT in 40 U.S.C. 11101 lists computers, ancillary equipment, software, firmware, similar procedures, services, and related resources.
- NIST's AI Risk Management Framework (January 2023) says AI risks are in many ways unique and are not comprehensively addressed by current risk frameworks.
- NIST lists data drift, difficult testing, and opacity among the ways AI differs from traditional software.
- Privacy and cybersecurity practices from IT still apply to AI systems, according to the same framework.
Two definitions that describe different things
Title 40 of the U.S. Code defines information technology, with respect to an executive agency, as any equipment or interconnected system used in the automatic acquisition, storage, analysis, evaluation, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information. The definition adds that IT includes computers, ancillary equipment, software, firmware and similar procedures, services including support services, and related resources. IT is defined by what it does with data, and it stays neutral about how the processing is done.
The NIST framework treats an AI system as an engineered, machine-based system that works toward given objectives and produces predictions, recommendations, or decisions that affect real or virtual environments, with varying levels of autonomy. The wording is adapted from the OECD Recommendation on AI (2019) and ISO/IEC 22989:2022. This definition is about what the system produces and how independently it acts. A payroll system is IT, and a model that flags unusual payroll entries is IT as well as AI.
Where behavior comes from
A simple, illustrative pair shows the split. A payroll routine multiplies hours by a rate. Given the same inputs it returns the same answer, and a tester can verify it by checking a handful of cases and the edges. A spam filter works differently. Its rules were fitted to labeled examples of email, so its behavior reflects whatever those examples contained. It is judged by error rates on mail it has not seen, and those rates can shift when the kind of mail changes.
NIST describes this in its appendix on how AI risks differ from traditional software risks. The data used to build an AI system may not truly represent the context where it is used, datasets may become stale relative to deployment, and systems may need more frequent corrective maintenance because of data, model, or concept drift. The appendix also notes underdeveloped software testing standards for AI and difficulty determining what to test.
Side-by-side comparison
The AI column below follows the NIST appendix. The IT column is a general characterization of conventional software, so it simplifies, and exceptions exist.
| Question | Conventional IT system | AI system |
|---|---|---|
| What fixes the behavior? | Code written by people | Code plus training data and fitted parameters |
| How is it tested? | Cases checked against expected outputs | Statistical measures on data; NIST notes testing standards are underdeveloped |
| What triggers maintenance? | New requirements, bugs, platform changes | Those, plus data, model, or concept drift |
| What does data do? | Is processed and stored | Also shapes the system itself, so unrepresentative data is a risk |
| How easy is it to explain a result? | Trace the code path | NIST cites increased opacity and reproducibility concerns |
What IT practice still covers
The two fields overlap more than the table suggests. NIST observes that many AI systems consist of billions or even trillions of decision points housed within more traditional software applications, so the application, the servers, the network, and the access controls around a model are ordinary IT. The framework adds that privacy and cybersecurity risk management apply to the design, development, deployment, and use of AI systems, and it points to the NIST Cybersecurity Framework, the NIST Privacy Framework, the NIST Risk Management Framework, and the Secure Software Development Framework as sources that may inform AI work.
In practice, an organization that adopts an AI tool inherits both sets of duties. Backups, patching, and access control remain necessary. Measuring accuracy, watching for drift, and checking training data are added.
Questions to ask before calling a project IT or AI
- Is the behavior fully specified in code, or does it depend on fitted parameters?
- Where did the training data come from, and does it resemble the setting where the system will run?
- How will accuracy be measured after launch, and who reviews the errors?
- What event triggers retraining or replacement of the model?
- Which existing IT controls, such as access management and logging, already cover the system?
FAQ
Is AI part of IT?
An AI system is software running on computers, and federal law's definition of IT includes software, so an AI system is IT. The reverse does not hold, because most IT, such as payroll, networking, and file storage, involves no learning from data.
Does AI replace IT staff?
The sources checked for this article do not support that claim. NIST's description places AI inside traditional applications, which still need the infrastructure and security practices IT teams handle.
Why does AI need different testing?
Its behavior depends on data as well as code, so a passing test on one dataset says less about the next one. NIST names data drift and underdeveloped testing standards as reasons the approach differs.
Are the NIST and federal definitions legal rules for private companies?
The statute defines IT for federal executive agencies, and the NIST framework is voluntary guidance. Neither is a general rule for private organizations, and this article is not legal advice.
Related reading
- How AI differs from machine learning
- A rule-based expert system taken apart
- Whether relying on AI weakens human skills
- Properties of intelligent agents
More in AI Basics.
Last verified: October 2026
Sources
- 40 U.S.C. 11101, Definitions, United States Code, Legal Information Institute
- Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1, National Institute of Standards and Technology, January 2023
- Information technology, NIST Computer Security Resource Center glossary, citing FIPS 200 and NIST SP 800-59