Machine learning vs rules

By the end, you can

• Explain in plain language how a machine-learning system differs from a system built from explicit rules (AF-1).
• Identify at least two everyday tools that already rely on machine learning rather than a fixed rule list (AF-1).
• Explain why "the system learned this from data" is a claim about how a tool was built, not a promise that any one output is correct (AF-1).

Before you start

This is Module 1, Lesson 1 of the AI Foundations course. It assumes no technical background beyond ordinary use of a phone, browser, email client or workplace chat app — no code, no command line, and no prior study of AI. This lesson introduces four words the rest of the course leans on: **rule**, **data**, **pattern** and **model**. Every one of them is defined the first time it is used.

Two ways to build something that decides

Suppose you want a program that decides whether an email is spam. There are two very different ways to build it.

The first way is to write **rules**: explicit, human-written instructions such as "if the sender is unknown and the subject contains the word 'prize', mark it spam." A rule-based system only ever does what its rules say. That makes it predictable and easy to explain — but a spammer who learns the rules can usually write around them, and a person has to keep adding new rules by hand as tactics change.

The second way is **machine learning**. Instead of writing rules, you show the system a large number of examples — emails already labelled "spam" or "not spam" — and let an algorithm find the statistical **patterns** that tend to separate the two groups. The US National Institute of Standards and Technology (NIST) describes the result in general terms in its AI Risk Management Framework: an AI system is "an engineered or machine-based system that can, for a given set of objectives, generate outputs such as predictions, recommendations, or decisions influencing real or virtual environments." IBM's explainer is more specific about the learning step itself: machine learning is "the subset of artificial intelligence (AI) focused on algorithms that can 'learn' the patterns of training data and, subsequently, make accurate inferences about new data," doing so "without explicit, hard-coded instructions." The trained result — the thing that actually makes predictions on new emails — is usually called a **model**.

Neither approach is simply "better." A rule-based system is transparent: you can point to the exact line that caused a decision. A machine-learning system can adapt to patterns nobody explicitly wrote down, including patterns too complex or too fast-changing for a person to keep listing by hand — but exactly which pattern caused one specific decision is often hard to point to.

Where machine learning already sits in your day

Machine learning is not a future technology waiting to arrive. It is already inside ordinary tools.

Once you know to look for it, the same underlying idea — a system trained on examples rather than programmed with rules — turns out to sit behind a large share of the software already on your phone or in your browser.

• **Spam filtering.** Google Workspace describes Gmail's spam filters as using "machine learning powered by user feedback to catch spam and help us identify patterns in large data sets" — and notes that "our filters learn from user actions," such as a person marking a message as spam or as not-spam. The filter is not working through a fixed list of banned words; it is continually adjusting to patterns in what people report.
• **Search autocomplete.** When you start typing into a search box and it predicts the rest, that prediction is not a hand-curated list either. Google's own explanation of autocomplete says the predictions come from looking "at the real searches that happen on Google" and showing "common and trending ones relevant to the characters that are entered" — a pattern drawn from real usage, not a fixed suggestion list someone wrote in advance.

"Learned from data" is not the same as "reliably correct"

It is tempting to treat "the system learned this from data" as a stamp of reliability. It isn't one. A trained model reflects whatever patterns were actually present in its training data — including gaps, biases and mistakes in that data. A spam filter trained mostly on English-language spam may perform worse on spam in another language. A model can also encounter a new case that simply does not resemble anything in its training data, and still produce a confident-looking answer anyway.

That is not a flaw specific to one product. It is a structural consequence of how the "two ways to build something that decides" comparison plays out: a rule-based system fails by being too rigid; a machine-learning system fails by confidently misapplying a pattern that does not actually fit the new case. Holding both failure modes in mind — not just the machine-learning one — is the mental model the rest of this module builds on.

Accessibility notes

This lesson is text-first, with no images, audio, video or downloadable artifacts. The practice exercise's model answer sits behind a native disclosure control that is reachable and operable by keyboard and correctly announced by screen readers. The knowledge check uses native radio-button inputs with a visible question and options, and posts its result to a live status region so assistive technology announces the outcome without a page reload.

Sources and limits

This lesson synthesises the sources below into a practical learning model. It is not a security standard, legal advice or a guarantee that any particular agent design is safe.

1. Artificial Intelligence Risk Management Framework 1.0 — NIST AI Resource Center. Defines an AI system as an engineered or machine-based system that generates outputs such as predictions, recommendations or decisions for a given set of objectives.
2. What is Machine Learning? — IBM. Defines machine learning as algorithms that learn the patterns of training data and make predictions on new data, without explicit, hard-coded instructions.
3. An overview of Gmail's spam filters — Google Workspace. Describes Gmail's spam filtering as machine learning that identifies patterns in large data sets and learns from user feedback, rather than a fixed rule list.
4. How Google autocomplete predictions work — Google. Explains that autocomplete predictions come from patterns in real searches people have already made, not a hand-written list of suggestions.