Amidst the frequent discussions on artificial intelligence (AI) legislation, fundamental issues such as“what is AI”and the conceptual distinctions among“AI, AI foundation models, and AI systems”are rarely addressed systematically. Although these basic concepts seem to belong to the domain of technical terminology, they are in fact closely linked to how the obligations of legal subjects are formulated. This task is especially urgent given that the State Council’s 2026 Legislative Work Plan has explicitly called for accelerating comprehensive legislation to promote the healthy development of AI. Current approaches to distinguishing key entities, such as technology developers and service providers, are primarily oriented toward defining the scope of liable subjects; consequently, they fail to fully encompass the risk management and control across all business links that modern AI governance practices focus on. Taking targeted risk governance as the conceptual starting point, legislative texts should define two fundamental concepts: AI foundation models and AI systems. An“AI foundation model”should be defined as a computational model featuring massive parameters and complex algorithms, whereas an“AI system”should refer to an information system or application software composed of functional modules such as perception, planning, execution, and feedback optimization, which utilizes AI-related technologies. This conceptual definition and distinction not only reflect the component-to-system relationship between AI foundation models and AI systems at the technical level—

thereby enabling the identification, assessment, and control of risk sources at their respective stages—but also

allow for the tracing of obligated subjects based on technical architecture, facilitating the granular assignment of

specific obligations to various entities.

large AI models, AI systems, targeted risk governance, conceptual differentiation