Loading
Machine learning (ML) is the branch of artificial intelligence in which a system improves its performance on a task by finding statistical patterns in data, rather than by executing rules a programmer wrote out in advance. NIST's Computer Security Resource Center glossary defines it as \"the development and use of computer systems that adapt and learn from data with the goal of improving accuracy,\" while ISO/IEC 22989:2022, the international standard for AI concepts and terminology, describes it as the process of optimizing a model's parameters through computational techniques so the model's behaviour reflects the data it was trained on. Nearly every prominent AI capability in production today, from fraud-detection scoring to large language models, is built on one or more ML techniques. For governance teams this distinction is not academic: because ML systems learn their behaviour from data instead of executing fixed logic, they inherit failure modes, data dependency, statistical unpredictability, post-deployment drift, that rule-based software simply does not have, which is why frameworks like the NIST AI Risk Management Framework require ML-specific controls (training-data governance, model validation, bias testing, continuous performance monitoring) on top of conventional software assurance.
Run the free AI Health CheckMachine Learning, the branch of artificial intelligence in which algorithms learn patterns from data and use those patterns to make predictions or decisions, rather than following explicitly programmed rules.
Machine learning is the underlying technique behind most modern AI: supervised learning (most enterprise ML), unsupervised learning (clustering, anomaly detection), reinforcement learning (decision-making over time), and deep learning (neural networks with many layers). Governance-wise, ML systems require training data governance, model validation, performance monitoring, and bias testing in ways that traditional rule-based software does not.
Source: NIST AI RMF; ISO/IEC 22989 (AI concepts and terminology)
Supervised learning
Trains only on labelled data, inputs paired with known correct outputs (ISO/IEC 22989:2022). The model learns to map new inputs to predicted outputs, as in credit-scoring models or spam classifiers. This is the most common and most auditable ML paradigm because ground truth exists to check predictions against.
Unsupervised learning
Trains only on unlabelled data (ISO/IEC 22989:2022), finding structure, clusters, groupings, anomalies, without being told the "right answer" in advance. Used for customer segmentation, anomaly detection, and dimensionality reduction. Harder to govern because there's no labelled ground truth to validate the output against.
Reinforcement learning
An agent learns an optimal sequence of actions to maximize a reward signal through interaction with an environment (ISO/IEC 22989:2022; NIST). Used in robotics, game-playing systems, and, notably, reinforcement learning from human feedback (RLHF), the technique used to align chatbot behaviour with human preferences.
Deep learning
Not a fourth, separate category, an architectural approach that can be applied within supervised, unsupervised, or reinforcement learning. ISO/IEC 22989:2022 defines it as creating "rich hierarchical representations" through training neural networks with many hidden layers. It is the technique underlying most modern generative AI and large language models.
NIST's AI Risk Management Framework devotes an appendix specifically to explaining how AI/ML risk differs from traditional software risk, and the reasons trace directly back to how ML systems are built. First, ML behaviour is inherited from training data rather than written by a developer: NIST notes that "the data used for building an AI system may not be a true or appropriate representation of the context or intended use," can become "detached from their original and intended context or...stale or outdated," and can carry harmful bias that a static code review would never catch.
Second, ML systems are statistical and probabilistic rather than deterministic. NIST points to "AI system scale and complexity (many systems contain billions or even trillions of decision points)" and a "higher degree of difficulty in predicting failure modes for emergent properties of large-scale pre-trained models", meaning conventional software test suites, which check known inputs against known correct outputs, are poorly suited to validating a model's full behavior space.
Third, ML performance is not fixed at deployment the way compiled code is. NIST observes that AI systems "may require more frequent maintenance and triggers for conducting corrective maintenance" than conventional software, because model accuracy degrades as real-world data drifts away from the data the model was trained on, a phenomenon with no equivalent in rule-based systems, whose logic doesn't decay just because the world changes around it.
Training-data dependency and drift
A model is only as good as the data it learned from. Unrepresentative, stale, or biased training data becomes embedded in model behaviour in ways that are invisible until the model is tested against real-world outcomes, which is why AI governance frameworks require data lineage, representativeness checks, and documented data provenance that rule-based software has no equivalent need for.
Statistical opacity and hard-to-test failure modes
Large ML models can have billions of internal parameters and emergent behaviours that were never explicitly specified by any engineer, making it difficult to enumerate what to test or predict how the system will behave on inputs unlike anything in its training data (NIST AI RMF).
Adversarial ML attack surface
Because ML systems learn from data, that data and the model itself become attack surfaces that rule-based code doesn't have: NIST's AI 100-2e2025 taxonomy catalogues data-poisoning attacks (corrupting training data), evasion attacks (crafting inputs to fool a trained model), and model-extraction attacks, none of which have a meaningful analogue in software that just executes fixed logic.
Continuous performance monitoring burden
A rule-based system behaves the same on day 1,000 as on day 1 unless someone changes the code. An ML model's real-world accuracy can silently decay as the data it sees in production diverges from its training distribution, so governance requires ongoing performance and drift monitoring rather than one-time pre-deployment validation.
ISO/IEC 22989:2022, developed by ISO/IEC JTC 1/SC 42, the joint technical committee for AI standardization, is the terminology base that later AI management-system standards (including ISO/IEC 42001) and many national frameworks build on, giving ML its own defined place within the broader AI concept hierarchy rather than treating it as a synonym for AI.
The EU AI Act's Article 3(1) definition of an 'AI system' is written to be technique-neutral, and Recital 12 explains that "the techniques that enable inference while building an AI system include machine learning approaches that learn from data how to achieve certain objectives, and logic- and knowledge-based approaches that infer from encoded knowledge or symbolic representation of the task to be solved." Recital 12 itself does not enumerate supervised, unsupervised, self-supervised, or reinforcement learning, or name deep learning, that more granular breakdown appeared in Annex I of the Commission's original 2021 proposal, was deleted from the final adopted text during trilogue negotiations, and now appears instead in the Commission's 2025 Guidelines on the definition of an AI system. Whether a system uses ML is therefore directly relevant to whether it falls inside the Act's scope.
The NIST AI Risk Management Framework doesn't create a separate track for ML versus other AI, instead its four functions (Govern, Map, Measure, Manage) are written to apply across the AI lifecycle, with the Measure function in particular built around the recognition that ML performance, bias, and security need continuous re-assessment rather than a one-time sign-off.
What is the simplest definition of machine learning?
Machine learning (ML) is a way of building software that improves at a task by finding statistical patterns in data, instead of following rules a programmer typed out in advance. NIST's glossary puts it as "the development and use of computer systems that adapt and learn from data with the goal of improving accuracy," and ISO/IEC 22989:2022 frames it as optimizing a model's parameters so its behaviour reflects the data it was trained on.
What is the difference between machine learning and artificial intelligence?
AI is the broader field of building systems that infer outputs (predictions, decisions, content) from inputs toward a goal. Machine learning is one way to build such a system, by learning from data, but not the only way: early AI systems used hand-coded logic and expert rules with no learning involved. Every ML system is an AI technique; not every AI system uses ML.
What are the main types of machine learning?
The standard taxonomy used by NIST and ISO/IEC 22989 is supervised learning (trains on labelled data), unsupervised learning (finds structure in unlabelled data), and reinforcement learning (an agent learns by taking actions in an environment and getting reward feedback). Semi-supervised and self-supervised learning are recognized variants that mix labelled and unlabelled data. Deep learning cuts across all three, it's an architectural approach (neural networks with many layers), not a separate fourth category.
Is deep learning the same thing as machine learning?
No. Deep learning is a subset of machine learning, specifically, an approach that uses neural networks with many hidden layers to build rich, hierarchical representations of data (ISO/IEC 22989:2022). It can be applied within supervised, unsupervised, or reinforcement learning; it is the technique behind most modern generative AI and large language models.
How is machine learning different from traditional rule-based software governance-wise?
NIST's AI RMF documents this explicitly: ML behavior depends on training data that may not represent the deployment context, can go stale, or can encode bias; ML systems can have billions of internal parameters whose failure modes are hard to predict or test with conventional software QA; and their performance can silently drift after deployment as real-world data changes, none of which apply to code that just executes fixed, human-written rules.
Why do AI laws like the EU AI Act specifically call out machine learning?
Recital 12 states only that 'the techniques that enable inference while building an AI system include machine learning approaches that learn from data how to achieve certain objectives, and logic- and knowledge-based approaches that infer from encoded knowledge or symbolic representation of the task to be solved.' It does not itself enumerate supervised, unsupervised, self-supervised, or reinforcement learning, or name deep learning, that more granular breakdown appeared in Annex I of the European Commission's original 2021 proposal, which was deleted from the final adopted text during trilogue negotiations, and is now discussed instead in the Commission's 2025 Guidelines on the definition of an AI system, which describe supervised, unsupervised, self-supervised, reinforcement, and deep learning as examples of machine learning approaches that enable inference. Regulators use this framework to distinguish adaptive, data-derived systems from simple deterministic software.
Last reviewed July 2026
This page is general information about What Is Machine Learning?, not legal, regulatory, or professional advice, and does not capture every nuance or exception. Requirements change and can be fact-specific. Always verify against primary sources and your own qualified legal counsel before relying on it.