Glossary

Every underlined term on this site has a glossary entry — open a stage page, hover any dotted-underline word, and you'll see the short definition. This page is the full alphabetical index for searching.

A

Agentic AI: An AI system that takes actions in the world via tools, not just produces predictions or text — e.g. sends emails, places orders, modifies files.
AI governance: The set of policies, processes, controls, and organisational roles that an entity uses to develop, deploy, and operate artificial-intelligence systems in line with its legal obligations, ethical commitments, and risk appetite.
AI literacy: Under EU AI Act Article 4, the obligation on providers and deployers to ensure relevant staff have skills, knowledge, and understanding to make informed deployment decisions.
AI policy: The internal binding document that names what an organisation will and won't do with AI, who owns which controls, and what is explicitly off-limits.
AI system: A machine-based system designed to operate with varying levels of autonomy and that may produce outputs (predictions, recommendations, decisions, content) influencing physical or virtual environments — the EU AI Act's working definition.
AIMS: AI Management System — the certifiable management-system standard defined by ISO/IEC 42001 for governing AI lifecycle risks across an organisation.
Annex III: The annex of the EU AI Act that enumerates the eight categories of high-risk use-cases (biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration/asylum, judicial process).
Automated decision-making: Decision-making based solely on automated processing, including profiling, producing legal or similarly significant effects on data subjects. Triggers GDPR Article 22 obligations.

B

Benchmark: A standardised test dataset and scoring methodology used to compare AI models on a defined task.
Bias evaluation: Systematic measurement of performance variance across protected attributes (sex, race, age, disability) as a fairness control.

C

CE marking: The conformity mark that high-risk AI systems placed on the EU market must bear after a successful conformity assessment.
Citation: In an AI context, a reference linking a generated answer to a source document or chunk; in this site, every regulatory citation is a `<RegQuote>`.
Conformity assessment: The process of verifying that an AI system meets the requirements of the relevant regulation. For high-risk EU AI Act systems, performed by the provider before market placement.
Conformity assessment file: The Annex IV documentation bundle a provider of a high-risk EU AI Act system must maintain — design, data, validation, monitoring, change log.

D

Data controller: Under GDPR, the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data.
Data processor: Under GDPR, a natural or legal person which processes personal data on behalf of the controller.
Datasheet: A structured document describing a dataset's composition, collection process, recommended uses, and known limitations.
Deployer: A natural or legal person using an AI system under its authority, except where the AI system is used in the course of personal non-professional activity.
Distributor: Any natural or legal person in the supply chain, other than the provider or importer, that makes an AI system available on the EU market.
Documentation: The collection of artefacts (model cards, datasheets, evaluation reports, change logs, conformity-assessment files) that evidences an AI governance programme.
DPIA: Data Protection Impact Assessment — a process under UK / EU GDPR for identifying and mitigating data-protection risks of processing operations, almost always required for AI systems.
Drift: The gradual divergence of an AI system's production behaviour from its evaluated behaviour, typically driven by input-distribution change.

E

Embedding: A dense vector representation of a piece of text, image, or other input, learned by a model so that similar inputs map to similar vectors.
Evaluation: Systematic measurement of an AI system's performance against declared criteria; for governance, the recurring evidence trail of accuracy, robustness, and fairness.

F

Fine-tuning: Adapting a pre-trained model to a downstream task by further training on a smaller domain-specific dataset.
Foundation model: A large model trained on broad data that can be adapted to many downstream tasks. The EU AI Act regulates a subset as general-purpose AI (GPAI) models.
Foundation model card: A model card specifically for a general-purpose AI model, including training-data summary and energy-use information required by EU AI Act Annex XI.

G

GDPR: The EU General Data Protection Regulation (2016/679) — the principal data-protection regime applicable to personal data processed by AI systems in the EU and the UK (UK GDPR).
General-purpose AI: An AI model that displays significant generality and is capable of competently performing a wide range of distinct tasks. Triggers Chapter V obligations under the EU AI Act.
GPAI provider: Under EU AI Act Article 53, a provider of a general-purpose AI model — distinct from a provider of an AI system, with its own obligations chapter.
Guardrails: Runtime constraints applied to an AI system's inputs or outputs to enforce safety, format, or policy properties.

H

Hallucination: An LLM output that is fluent and plausible but factually incorrect, with the model expressing high confidence regardless.
High-risk: Under the EU AI Act, an AI system falling under Annex I (safety component) or Annex III (use-case) — triggering the heaviest provider obligations.
Holdout: A portion of labelled data deliberately excluded from training, reserved for unbiased evaluation of the trained model.
Human oversight: The obligation under EU AI Act Article 14 to design high-risk AI systems so they can be effectively overseen by a competent natural person during use.

K

Kill switch: A pre-built mechanism to immediately halt an AI system's operation. Operationalisation of the EU AI Act Article 14(4)(e) "stop the system" obligation.

L

Lawful basis: The legal ground under GDPR Article 6 for processing personal data. AI workloads typically rely on consent, contract, legitimate interests, or legal obligation.
Limited risk: Under the EU AI Act, AI systems triggering transparency obligations only (chatbots, deepfakes, emotion recognition disclosure).

M

MITRE ATLAS: Adversarial Threat Landscape for Artificial-Intelligence Systems — MITRE's knowledge base of adversarial-ML tactics, techniques, and case studies.
Model card: A short structured document describing an AI model's intended use, performance characteristics, limitations, and evaluation results.

N

Notified body: A designated third-party organisation that conducts conformity assessments for certain high-risk AI systems before market placement.
Notified body assessment: Third-party conformity assessment by a notified body required for certain high-risk EU AI Act systems before market placement.

O

OWASP LLM Top 10: The OWASP Foundation's catalogue of the top 10 most critical security risks for applications using large language models.

P

Post-market monitoring: Under EU AI Act Article 72, the obligation to actively and systematically collect, document, and analyse data on a high-risk AI system's performance after deployment.
Privacy by design: A development principle (and GDPR Article 25 obligation) requiring privacy and data-protection to be considered from the start of system design.
Profiling: Any form of automated processing of personal data evaluating personal aspects relating to a natural person.
Prompt engineering: The practice of crafting input prompts to elicit desired behaviour from an LLM without modifying model weights.
Prompt injection: An attack class where untrusted input causes an LLM-backed system to deviate from its declared instructions, often listed as OWASP LLM01.
Provider: Under the EU AI Act, a natural or legal person that develops an AI system or has one developed and places it on the market under its own name or trademark.

R

RAG: Retrieval-Augmented Generation — an architecture pattern that retrieves relevant documents at inference time and provides them as context to an LLM.
Red-teaming: Adversarial testing of an AI system by a team simulating attackers or misusers to find failure modes before they become incidents.
Regulation: A binding legal instrument issued by a competent authority (e.g., the European Union, a national government, a state legislature) that imposes obligations on persons or organisations within its jurisdiction.
Right to explanation: The right of a data subject under GDPR Article 22 to obtain meaningful information about the logic of automated decisions that significantly affect them.
Risk management system: Under EU AI Act Article 9, a continuous iterative process throughout the AI system's lifecycle that identifies, evaluates, and mitigates risks.
Risk tier: A category that classifies an AI system by the level of regulatory obligation it triggers. The EU AI Act uses four tiers (unacceptable, high-risk, limited-risk, minimal-risk); other frameworks differ.

S

Serious incident: Under EU AI Act Article 73, any incident or malfunction directly or indirectly leading to death, serious damage to health, infringement of fundamental rights, or serious damage to property or environment.
Snapshot: A dated capture of a regulation, framework, or vendor policy stored as cleaned markdown, the substrate for diff and citation on this site.
Systemic risk: A risk specific to high-impact general-purpose AI models with capabilities matching or exceeding the most advanced models, as defined by EU AI Act Article 51.

T

Transparency obligation: Under EU AI Act Article 50, the obligation to inform natural persons when interacting with certain AI systems (chatbots, biometric categorisation, deepfakes).

U

Unacceptable risk: Under EU AI Act Article 5, prohibited AI practices including subliminal manipulation, social scoring, predictive policing based solely on profiling, and real-time biometric identification (with exceptions).

V

Vector database: A database optimised for storing and querying high-dimensional vector embeddings, commonly used in RAG pipelines.