Artificial intelligence differs from conventional software mainly in where its behavior comes from: a conventional program follows rules a developer wrote, while an AI system's behavior is set by parameters fitted to data. The U.S. National Institute of Standards and Technology (NIST) lists the practical consequences in Appendix B of its AI Risk Management Framework 1.0, published in January 2023, including data that may not represent the real setting, drift over time, opacity, and harder testing. The differences concern how systems are built and checked, not any claim that AI is a separate kind of technology.
Key takeaways
- NIST defines an AI system as an engineered or machine-based system that generates outputs such as predictions, recommendations, or decisions for a given set of objectives.
- Appendix B of NIST AI 100-1 lists risks that are "new or increased" compared with traditional software, such as stale training data, drift, and difficulty testing.
- A learned rule can change when data changes, with no edit to the program code, which is rarely true of a hand-written rule.
- NIST also states that AI shares risks with traditional software, and AI usually sits inside ordinary software applications.
- As of October 2026 NIST says the framework is being revised, and version 1.0 remains the published text.
Where the behavior comes from: a threshold example
A small illustrative example shows the core difference. A payment system flags a purchase as suspicious by amount. In the conventional version, a person picks a cutoff, say USD 500, and writes it into the code. In the learned version, a program is given past purchases labeled as fraud or legitimate and picks the cutoff that makes the fewest mistakes on them. The numbers below are invented for illustration and come from no real dataset.
In the first set of past data, legitimate amounts are 20, 45, 60, 80, 120, and 250, and fraudulent amounts are 310, 400, 520, and 900. The hand-written cutoff of 500 catches two of four fraud cases. Any cutoff between 250 and 310 separates the two groups perfectly, and the midpoint, 280, is what a simple learner would choose. Later, prices rise. Legitimate amounts are now 30, 90, 150, 300, 380, and 420, and fraud starts at 450, 520, 700, and 900. The old learned cutoff of 280 now flags three of six legitimate purchases, while retraining moves the cutoff to 435 and again makes no errors on this data. The hand-written 500 still misses the 450 case.
| Rule | Where the number came from | Errors on first data | Errors on later data |
|---|---|---|---|
| Hand-written cutoff, 500 | A person's judgment, visible in the source code | Two missed frauds | One missed fraud |
| Learned cutoff, 280 | Fitted to the first data | None | Three false alarms |
| Retrained cutoff, 435 | Fitted to the later data | Not applicable | None |
Neither approach is better in general. The learned rule fit the data it saw and then went stale, and the change that fixed it was new data, not new code. That is the pattern NIST describes.
What NIST lists as different
The AI Risk Management Framework 1.0 introduces its Appendix B with a statement that AI-specific risks "new or increased" relative to traditional software include the items in the table. The right-hand column is a plain-language reading, not NIST's wording.
| NIST item (paraphrased) | Plain reading |
|---|---|
| Training data may not represent the intended context, and ground truth may not exist | The model can be right about the past and wrong about the setting where it is used |
| Training datasets can become detached from context or outdated | The cutoff example above: prices changed, the data did not |
| Changes during training can alter performance fundamentally | Two training runs on slightly different data can behave differently |
| Billions or trillions of decision points inside ordinary applications | No one reads the rule line by line |
| More frequent maintenance because of data, model, or concept drift | Retraining is routine upkeep, not a one-time fix |
| Increased opacity and concerns about reproducibility | It can be hard to explain or repeat a result |
| Underdeveloped testing standards; difficulty deciding what to test | Passing a test set does not certify behavior elsewhere |
The Executive Summary adds that AI systems are socio-technical, meaning their risks and benefits depend on how people use them as well as on the code.
What does not differ
The same appendix opens by saying that, as with traditional software, risks from AI-based technology can be bigger than a single enterprise, span organizations, and lead to societal impacts. It notes that some of the features that create AI risk can also be beneficial: pre-trained models and transfer learning can raise accuracy and resilience compared with other approaches. NIST further points to existing frameworks for cybersecurity and privacy, including its Cybersecurity Framework and Privacy Framework, as guidance that applies to AI systems too, while saying they leave gaps such as harmful bias and machine learning attacks. Both kinds of technology, in its words, are subject to rapid innovation. A bug in a payment rule and a stale fraud model can cost the same money; what changes is how the fault is found.
Status of the framework in October 2026
The framework is voluntary and not specific to any sector, according to its own text. NIST's AI Risk Management Framework page states that version 1.0, released on January 26, 2023, is being revised as part of the White House AI Action Plan. No revised text had been confirmed as published on that page at the last check, so the January 2023 document is the one cited here. Readers relying on it for compliance work should check the page for updates and ask counsel, since this article gives general information and not legal advice.
FAQ
Is AI just software?
It is software, and NIST says AI systems are often housed within traditional software applications. What differs is that part of the behavior is fitted to data instead of written as explicit rules, which changes how the system is tested and maintained.
Does learning from data make AI more accurate than rules?
Not automatically. In the threshold example the learned rule beat the hand-written one on the first data and then failed when the data shifted. Accuracy depends on the data, the task, and how often the model is checked.
Why do AI systems need retraining?
NIST names data, model, and concept drift as reasons AI systems may need more frequent maintenance. When the world changes, a fitted rule can fall out of date without any change to the program.
Is the NIST framework a law?
No. The framework describes itself as intended to be voluntary. Legal duties come from separate statutes and regulations.
Related reading
- How AI and IT differ
- Alternatives to AI for the same task
- What toy problems leave out
- A chatbot as a learned system
More in AI Basics.
Last verified: October 2026
Sources
- Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1, National Institute of Standards and Technology, January 2023
- AI Risk Management Framework overview page, National Institute of Standards and Technology, 2026