Ask five people what “AI” means and you will get five different technologies — a spell-checker, a spam filter, a recommendation engine and a chatbot are all routinely called AI, and only one of them is new. The confusion is not carelessness. The term genuinely covers a much wider range of systems than the current wave of attention suggests, and knowing where the boundary sits is the first thing a business reader needs before any of the rest of this series makes sense.
Key takeaways
The oldest and least controversial layer of “AI” is rule-based automation: software that follows a fixed set of instructions a person wrote in advance — if the invoice total is over a threshold, route it for approval; if an email contains a known spam pattern, move it to junk. Nothing here is learned. The logic is exactly what a programmer typed, and it will do the same thing forever unless someone changes the code. A lot of software marketed as “AI-powered” is really this, dressed up.
The layer most people mean when they say “AI” today is machine learning: a system that is shown a large number of examples and adjusts its own internal parameters until it gets better at a task, rather than being told the rule directly. A spam filter trained on millions of labelled emails, a recommendation engine trained on purchase history, and a fraud-detection model trained on transaction records are all machine learning in this sense — pattern recognition and classification of things that already exist, applied at a scale no person could do by hand.
Canada's Canadian Centre for Cyber Security publishes an awareness guide on generative AI (ITSAP.00.041, dated December 2025) that states the distinction plainly: “Generative AI is a type of AI that generates new content by modelling features from large datasets that were fed into the model. While traditional AI systems can recognize patterns or classify existing content, generative AI can create unique content in many forms, including text, image, audio or software code.” (Canadian Centre for Cyber Security, ITSAP.00.041) That is the cleanest operational boundary available from a Canadian source: not “is it clever”, but does it produce content that did not exist before, or does it sort and score content that already does.
This matters for a business reader because the two categories carry different risks and different value. A classification system can be wrong in a bounded way — it mis-sorts an email, mis-scores a lead. A generative system can produce an entire fabricated paragraph, complete with a confident tone and no visible seam where the invention starts. The rest of this series is mostly about that second category, because it is the one that changed fastest and is least well understood.
Innovation, Science and Economic Development Canada's Voluntary Code of Conduct, dated September 2023, applies specifically to what it calls “advanced generative AI systems” — its own opening line names the trigger: “Advanced AI systems capable of generating content — such as ChatGPT, DALL·E 2, and Midjourney — have captured the world's attention.” (ISED, Voluntary Code of Conduct) The federal government did not write a voluntary code for spam filters or recommendation engines — those have existed for two decades without triggering a policy response. It wrote one for the generative category specifically, which is itself evidence of where the practical dividing line sits.
Put a name on each layer and the boundary gets easier to hold onto. A bank's fraud-detection system scores a transaction against patterns learned from millions of past transactions and returns a number: this is machine learning doing classification, the “traditional AI” half of the Cyber Centre's distinction. It has existed in production, quietly, since well before “AI” became a boardroom topic. A rules-based email router that moves an invoice to the accounts-payable queue because the sender domain matches a known vendor list is not machine learning at all — it is ordinary conditional logic, and it would keep working exactly the same way even if every machine-learning model on earth vanished tomorrow. A chatbot that drafts a reply to a customer's email is the generative layer: it did not look up an existing answer and select it, it produced new sentences, token by token, that never existed in that exact form before. All three might sit inside the same customer-service software suite and all three might be marketed as “AI features.” Only the third is new, and only the third carries the fabrication risk this series spends the most time on.
The practical test to apply to any vendor claim of “AI-powered” is simple: ask whether the system is producing content that did not exist before, or sorting, scoring and matching content that already does. The answer changes what you should expect from it and what you should check before you rely on its output.
Canada's Office of the Privacy Commissioner draws a second, complementary line that has nothing to do with the rule-based/machine-learning/generative split above, and is just as useful for a business reader: “Developers and Providers” are “individuals or organizations that develop (including training) foundation models or generative AI systems, or that put such services onto the market… in short, those organizations that determine how a generative AI system operates,” while “Organizations using Generative AI” are those “using a generative AI system as part of their activities” without having built it. (OPC, generative AI principles) The vast majority of Canadian businesses sit in the second category, no matter which of the three technical layers above the tool they are using belongs to — a point the next article in this series builds on directly.
None of this says whether these systems are actually intelligent, and that is a separate, harder question this series avoids getting stuck on. For a business reader, the more useful move is to stop treating “is it intelligent” as the operative question and start asking “what category of system is this, and what does that category tend to get right and wrong” — which is exactly the question the rest of this series works through, starting with what people mean by an AI “model” specifically.
Related: what people mean by an AI “model”, why AI improved so fast after 2022, and, for the strategic question of where a generative system fits into a plan rather than a definition, the AI strategy & roadmapping hub.
Not in the sense this series uses. Both follow fixed rules a person wrote (if temperature is below X, turn on the furnace). No pattern was learned from data, and nothing was generated. That is ordinary automation, not AI.
No. Both are machine learning in the broad sense, but a spam filter classifies existing email into categories using patterns learned from labelled examples, while a generative system produces new text token by token. The Cyber Centre's own distinction — recognizing versus creating — is exactly this line.
Because the two categories fail differently. A misclassification is a bounded, usually visible error. A generative system can produce a fluent, wrong paragraph with no obvious seam, which is why verification steps matter more for generative tools than for classification tools.
This is one page in a plain-English series on how AI actually works and where it fits in a Canadian business.
