Lexicon

The AI governance lexicon

Plain-language definitions of the terms that recur across the EU AI Act, the GDPR and the frameworks that govern AI. GovCompass uses one consistent vocabulary across the knowledge base and the Academy.

A

accountability: The principle that a named human or organization answers for an AI system's outcomes, through ownership, documentation, audit trails and redress; never the system itself. The EU AI Act attaches obligations to the role rather than the technology, with provider duties in Article 16 and deployer duties in Article 26, supported by technical documentation (Article 11) and record-keeping (Article 12). See provider, deployer, record-keeping, responsible AI.
accountability scope: A dimension of an agent's autonomy: how far the consequences of its actions reach, from internal and reversible to customer-facing, hard to reverse, and legally weighty.
adversarial input: An input deliberately crafted to make an AI system produce a wrong or harmful output, often through changes a human would not notice. Adversarial inputs are a core attack type under the security and robustness pillar and a standard target of pre-release testing. See red teaming, prompt injection.
affected persons: The individuals or groups who are subject to or impacted by an AI system's outputs or decisions, and whose rights the governance regime aims to protect.
agent drift: The gradual divergence of an agent's behavior from its expected envelope over time, surfaced by behavioral monitoring and drift detection across the chain.
agentic AI: Systems where a model takes actions (calling tools, executing multi-step plans), amplifying both capability and every failure mode; governed with action allowlists, approvals and full logging.
agentic governance: Governing the actions an autonomous AI system takes, not just the decisions it makes; ensuring those actions can be contained, traced, and reversed.
agentic stack: The orchestrator, sub-agents, and tools that together perform an autonomous workflow. Under the EU AI Act it is classified and governed as one system, not as separate parts.
AI agent: A system that perceives its environment, decides and takes actions toward a goal (calling tools, executing plans). Autonomy of action demands allowlists, approval gates, sandboxing, logging and a kill switch.
AI governance: Governance extended for AI: the same organizational steering at the highest level, widened to cover what makes AI different (it works in probabilities rather than fixed rules, learns from data, and can act at a speed and scale no human reviewer can match). It inherits the existing governance structure and brings AI inside the disciplines the organization already runs, rather than creating a parallel system in a silo. It operates on two levels, design and execution. See governance, governance design, execution level, responsible AI.
AI incident: Any event where an AI system's outputs, actions or data handling caused or plausibly could cause harm, or materially deviated from validated behavior, including harmful outputs from a system that is technically working.
AI inventory: A register of all AI systems an organization builds, buys or embeds, with owners and risk tiers. It is the prerequisite for governing any of them.
AI life cycle: The looped stages of an AI system: design → data/development → validation → deployment → operation & monitoring → retirement, each with native controls and gated transitions.
AI literacy: Sufficient understanding of AI's workings, capabilities and risks for one's role, an explicit expectation for provider and deployer staff under the EU AI Act.
AI management system: The organizational structure, policies and processes for governing AI across its life cycle, as formalized in ISO/IEC 42001.
AI obligations: The duties the AI Act places on a party, which depend on its role in the value chain and the system's risk tier.
AI Office: The European Commission body that coordinates implementation of the EU AI Act and supervises general-purpose AI models. National market surveillance authorities enforce the Act for most AI systems; the AI Office is the central point for the general-purpose AI layer. See general-purpose AI, EU AI Act.
AI system: A machine-based system that, for explicit or implicit objectives, infers from input how to generate outputs (predictions, content, recommendations or decisions) that can influence physical or virtual environments. The OECD-style definition followed by the EU AI Act.
algorithm: The learning procedure (e.g. gradient descent, tree induction); running it on training data produces a model. Controls attach to models and systems, not algorithms in the abstract.
Annex III: The EU AI Act's list of high-risk use-case areas: biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, justice.
artifact: The concrete record that proves a control was carried out: a test report, an impact assessment, a monitoring log, a release sign-off. An artifact is the tangible form evidence takes, the thing an auditor reaches for to confirm that a control was not just designed but actually operated. Each stage of the AI life cycle produces its own anchor artifact. Distinct from evidence as a whole: evidence is the proof, an artifact is one piece of it. See evidence, life cycle.
authorized representative: A person established in the EU, appointed in writing by a non-EU provider to carry out the provider's obligations under the AI Act.
automated decision-making: Decisions based solely on automated processing with legal or similarly significant effects. GDPR Article 22 restricts them to three exception grounds, with human-intervention safeguards.
automation bias: The human tendency to over-trust automated outputs: accepting a system's recommendation without genuinely weighing the case, which hollows out human oversight.
autonomy level: The documented degree of autonomy a deployed agent is permitted, matched to its demonstrated reliability and the controls in place; raised deliberately, not by default.

B

bias: A systematic skew in data, model behavior, or outcomes that treats one group differently from another without justification. Bias usually enters through training data that reflects historical patterns. For high-risk AI systems, Article 10 of the EU AI Act requires examination of datasets for possible biases and measures to detect, prevent, and mitigate them. See fairness, proxy discrimination.
biometric categorization: Sorting people into categories such as ethnicity or political views from their biometric data; restricted or prohibited under the AI Act.
black box: Informal name for a system whose internal decision logic cannot be inspected or meaningfully explained.

C

CE marking: The mark affixed to products (including high-risk AI systems) indicating conformity with applicable EU requirements.
change management: Controlled handling of updates to models, data and configurations: every material change re-passes validation before redeployment.
codes of practice: Voluntary guidance under the AI Act, notably for general-purpose AI, that helps providers show compliance until harmonized standards exist.
complexity: The governance-challenging characteristic where risk lives in the interactions of many components, suppliers and environments that no one can reason about whole. The answer is system-level assessment and end-to-end testing.
conformity assessment: The pre-market process demonstrating a high-risk AI system meets the EU AI Act's requirements, leading to CE marking and registration.
continuous monitoring: Ongoing observation of a deployed system's performance, drift, fairness and usage against thresholds with named owners. It is the control that matches AI's speed and scale.
control: The concrete, testable measure that reduces a specific risk, and through that risk protects the principle behind it. Also called a risk management measure, risk response, or risk treatment. Always traceable to the risk it addresses: under EU AI Act Art. 9 every control must map back to a specific risk, and controls recorded separately from their risks is a recognized compliance failure. It works in one of three types: preventive, detective, or corrective. See risk, control types, evidence.
control activity: The concrete action or system rule that achieves a control objective, for example a limit check inside a payment tool that refuses amounts above a threshold. A register that records only objectives fills up with statements nobody can test. See control objective, enforcement point.
control objective: A statement of the outcome a control must achieve, such as "unauthorized payments must not be technically executable". It says what must be true rather than what must be built, which leaves room for more than one control activity to meet it. Keeping the objective separate from the activity is what keeps a control register testable. See control activity, enforcement point.
controller: Under Article 4(7) GDPR, the party that alone or jointly with others determines the purposes and means of the processing of personal data. The controller carries most GDPR obligations, including the duty to bind any processor by contract. In AI projects, the organization that decides why and how personal data is used for training or operation is typically the controller. See processor, GDPR.

D

data minimization: Processing only data that is adequate, relevant and necessary. In ML it is implemented through pseudonymization, feature selection, synthetic data and privacy-enhancing techniques.
data poisoning: An attack that corrupts training data so the model learns attacker-chosen behavior; a core adversarial-ML threat to the data pipeline.
datasheet: A document recording the provenance of a dataset: its sources, the rights under which it is used, its composition, and its known limitations. The anchor artifact of the data-and-develop stage, it makes the data behind a model traceable and is a precondition for assessing risks such as bias. See artifact, life cycle.
decision authority: A dimension of an agent's autonomy: how consequential the decisions it may make are, from recommending to a human to deciding and acting without review.
decision log: The recorded outcomes and reasoning of governance decisions (committee approvals, risk acceptances), building precedent, consistency and auditability.
declaration of conformity: The provider's signed statement that a high-risk AI system meets the AI Act's requirements, drawn up before the system is placed on the market.
decommissioning: Deliberate retirement of an AI system: turn-off plan, stakeholder communication, data and model disposition, record retention.
deepfake: AI-generated or manipulated audio, image or video that convincingly depicts real people or events that did not occur; subject to labeling duties under the EU AI Act's transparency tier.
deployer: An organization using an AI system under its own authority in its activities. It carries the operator duties: use per instructions, oversight, input relevance, monitoring, notices.
developer: The actor who technically builds and trains an AI model or system; in most laws this function is absorbed into the provider role.
Digital Omnibus: An EU amending package that adjusts parts of the EU AI Act, including the application dates for high-risk obligations. As of July 2026 it has been adopted by the European Parliament and the Council and awaits publication in the Official Journal; verify the current status and dates against the official text. See EU AI Act.
downstream provider: A provider that builds an AI system on top of another party's model, often a general-purpose model, and takes on obligations for the system it ships.
DPIA: Data Protection Impact Assessment: required before likely-high-risk processing (systematic profiling with significant effects, large-scale special categories, public monitoring); AI development triggers it constantly.
drift: The gradual divergence of an AI system's behavior or performance from its validated state after deployment, without any code change or error. Drift is silent by nature: nothing breaks, accuracy simply decays until someone measures it. Causes are worth separating: a shift in the mix of incoming cases, a change in the source material, a change in surrounding systems, or an update to the underlying model by its provider. See model drift, agent drift.

E

emotion recognition: An AI system that infers a person's emotions from biometric data; its use in workplaces and education is restricted under the AI Act.
enforcement point: The place where a rule is applied in code or configuration rather than described in text, so that breaking it does not depend on a system choosing to comply. In access control the equivalent is the policy enforcement point. For an AI agent the candidates are the tool, the policy engine, the permissions, and the orchestration; the prompt is not one of them. See guardrail, policy engine, control objective.
escalation trigger: A rule that hands a high-consequence action to a human before it executes. The corrective control that keeps human oversight meaningful once per-action review is impossible.
ethics board: A deliberative body (sometimes with external members) for the should-we questions that compliance checklists cannot answer, used where stakes warrant.
EU AI Act: Regulation (EU) 2024/1689, the European Union's law on artificial intelligence. It takes a risk-based approach: prohibited practices, requirements for high-risk AI systems, transparency obligations for specific uses, and a separate regime for general-purpose AI models. Obligations are divided between providers and deployers. See general-purpose AI, conformity assessment.
evaluation set: A fixed collection of test scenarios with predetermined desired behavior, used to measure the behavior of a model or agent repeatably. It is the agent equivalent of a regression test, and it produces a score against a threshold rather than a pass or fail, because the behavior it measures is probabilistic. See drift, override rate.
evidence: The concrete proof that a control is designed, implemented, and working: a test report, an audit trail, an impact assessment, a monitoring log. Each link in the governance chain produces an artifact, and together they are what an organization hands to its own board, a regulator, a customer, or an affected person to show, not say, that a system is governed. Its absence is itself the failure: a risk register without test results, or a mitigation claimed without validation, is a governance gap, not a paperwork one. The closing link of the governance chain. See control, governance.
execution level: The operational tier of AI governance: risk assessments, control testing, monitoring, and the evidence they produce. Where governance design decides what good looks like, the execution level shows whether the organization meets it in practice. See governance design, evidence.
explainability: The ability to give a meaningful reason for a specific output of an AI system to the people it affects. It is distinct from transparency, which is disclosure that and how AI is used.

F

fairness: The responsible-AI principle that systems should not create or reinforce unjust discrimination; operationalized through bias testing, representative data and per-group thresholds. It has multiple, mutually incompatible mathematical definitions. Under the EU AI Act, providers of high-risk AI systems must examine their data sets for possible biases (Article 10), and several discriminatory uses are prohibited outright (Article 5). See bias, proxy discrimination, high-risk AI system, responsible AI.
feedback loop: A dynamic where a system's own outputs influence its future training data, amplifying initial patterns, for example investigating only flagged claims, then learning from those investigations.
fine-tuning: Further training of an existing model on your own data to adapt its behavior. This makes you responsible for the modification, potentially up to provider level.
foundation model: A model trained on broad data at scale that can be adapted to many downstream tasks; called a general-purpose AI model in EU AI Act terminology.
FRIA: Fundamental Rights Impact Assessment: required of public bodies and certain private deployers before using some high-risk AI systems under the EU AI Act.
frontier model: A general-purpose model at the leading edge of capability, often the focus of systemic-risk concerns.
fundamental rights impact assessment: An assessment that certain deployers of high-risk AI must perform to identify and mitigate the system's risks to people's fundamental rights.

G

GDPR: Regulation (EU) 2016/679, the General Data Protection Regulation, the EU's law on the processing of personal data. It applies to AI wherever personal data enters training, inputs, outputs, or logs, and it operates alongside the EU AI Act rather than being replaced by it. See controller, processor, lawful basis, DPIA.
general-purpose AI: A model trained on broad data that can be adapted to many downstream tasks; the AI Act sets specific obligations for it, with extra duties when it poses systemic risk.
general-purpose AI model: EU AI Act term for a model displaying significant generality and capable of many distinct tasks, typically integrated into downstream systems; carries its own obligation set, with extra duties for models posing systemic risk.
generative AI: AI systems that produce new content (text, images, audio, code) rather than only classifying or predicting. Large language models are the prominent example.
goal hijacking: An attack that redirects an agent's objective so it pursues a goal you did not set. Prompt injection combined with autonomy: it changes what the agent does, not just what it says.
governance: The system through which an organization steers itself: corporate governance, risk management, compliance, lines of accountability, risk appetite, and the operating model. It exists across everything the organization does, before and beyond AI. AI governance is this same system extended for AI. See AI governance, governance design, execution level.
governance chain: The traceable line by which a single pillar is held for a single system: principle, then the harm that would breach it, then the risk that harm carries, then the control that reduces the risk (preventive, detective, or corrective), then the residual risk judged against appetite, proven with evidence. The chain is what makes responsible AI accountable rather than aspirational, and what lets an organization move a principle from a policy statement to a working control it can point to. See principle, harm, risk, control, residual risk, evidence.
governance design: The design tier of AI governance: policy, roles, organizational structure, and risk appetite. Governance design sets the boundaries within which AI systems may operate; the execution level tests whether reality stays inside them. See execution level, risk appetite.
guardrail: A barrier meant to stop unwanted behavior of an AI system. The distinction that decides its value is where it lives: a guardrail written into the prompt is a request the model can weigh incorrectly or be manipulated out of, while a guardrail in code or configuration is an enforcement. The word is also used in the market for output filters, schema validation, classifiers, and policy engines, so the layer it sits in is worth naming. See enforcement point, policy engine, prompt injection.

H

hallucination: Fluent but false content produced by a generative model: statistically plausible output mistaken for fact. A design property to manage, not a bug to patch away.
harm: Harm is the concrete damage an AI system causes or can cause: to a person, a group, an organization, or society. A risk is that same damage seen in advance, weighed by likelihood and severity; a harm that has occurred is remedied rather than managed.
harmonized standard: A European standard developed on request of the European Commission. Under Article 40 of the EU AI Act, compliance with harmonized standards published in the Official Journal gives a presumption of conformity with the requirements those standards cover. Harmonized standards for the AI Act are still in development. See conformity assessment, EU AI Act.
high-risk AI system: An AI system that falls under the EU AI Act's strictest requirements, following Article 6. There are two routes in: a system that is a product or safety component covered by the Union harmonization legislation in Annex I and subject to third-party conformity assessment, or a system used in one of the areas listed in Annex III, such as employment, education, or access to essential services. Article 6(3) contains a filter: an Annex III system is not high-risk if it does not pose a significant risk of harm to health, safety, or fundamental rights, although a system that profiles natural persons is always high-risk. See EU AI Act, Annex III, conformity assessment.
human oversight: Designed-in human ability to monitor, intervene in, override or shut down an AI system. It is meaningful only when the human has authority, information and time to act. One of the seven pillars of responsible AI, and under the EU AI Act a requirement for high-risk AI systems: Article 14 requires that those systems are designed so natural persons can effectively oversee them. Oversight that exists on paper but amounts to confirming in practice does not meet that bar. See override rate, automation bias, high-risk AI system, fairness, safety and reliability, privacy, security and robustness, transparency and explainability, accountability, responsible AI. In the IAPP AIGP body of knowledge, this principle appears as human-centricity, with human oversight as one of its elements.
human-centricity: The principle that AI should serve people: augmenting judgment, respecting autonomy and dignity, with oversight and contestation proportionate to the stakes.
human-in-the-loop: Oversight configuration where a human approves or decides each case the system recommends. It fits high-stakes individual decisions and is meaningful only with authority, information and time.
human-on-the-loop: Oversight configuration where humans monitor operation and intervene by exception. It fits high-volume systems where per-case review is impossible.

I

IMDA Model AI Governance Framework for Agentic AI: A governance framework for agentic AI published by Singapore's Infocomm Media Development Authority, first released in January 2026 and updated in June 2026. It decomposes agents into models, memory, tools, and actions, and states a preference for structural and rule-based controls over guardrails that live in the prompt layer. It is guidance, not law. See agentic AI, guardrail, least agency.
impact assessment: A structured evaluation, carried out in the plan-and-design stage, of the harms an AI system could cause and the risk those harms carry, before the system is built. The first place the governance chain is run, and the cheapest point in the life cycle to reduce risk. The anchor artifact of the planning stage; under the EU AI Act, a fundamental-rights impact assessment is required for certain high-risk deployers. See harm, risk, life cycle.
inference: The stage where a trained model produces outputs on new inputs, as opposed to the training stage where it learns its parameters.
internal audit: The third line of defense: independent assurance that AI assessments, controls and documentation actually operate, reporting to the board, never to the builders.
ISO/IEC 23894: The international guidance standard for AI risk management, published in 2023. It applies the general risk management principles of ISO 31000 to AI and is guidance, not a certifiable requirements standard. It complements the NIST AI RMF as a risk method within a broader management system. See NIST AI RMF, ISO/IEC 42001.
ISO/IEC 42001: The international requirements standard for AI management systems, published in 2023 and certifiable. It defines how an organization establishes, implements, maintains, and continually improves a management system for AI. Certification against ISO/IEC 42001 does not create a legal presumption of conformity with the EU AI Act. See AI management system, harmonized standard.

J

jailbreak: A prompt or technique that bypasses an AI system's safety guardrails to make it produce restricted output.

K

kill switch: The designed-in, rehearsed ability to suspend or deactivate an AI system quickly when containment requires it.

L

least agency: The principle, used in OWASP's agentic security work, that an agent should be granted the smallest set of capabilities and the least autonomy the task requires. Applied at architecture level it is a risk decision rather than a technical preference: less autonomy leaves more of the process enforceable in code. See OWASP, agentic AI, enforcement point.
least-privilege: Granting each agent only the access its task requires, with no shared credentials and scoped, time-bound permissions. A core preventive control for agentic security.
life cycle: The span of a single AI system from first intake to retirement, across which it must be governed. The horizontal axis of governance: where the governance chain holds one principle, the life cycle runs one system through time. Commonly drawn as six stages, plan and design, data and develop, verify and validate, deploy, operate and monitor, and retire, each with controls native to it and an anchor artifact. A loop rather than a line, because a system in production feeds new risk back into fresh assessment. See artifact, control, governance chain.

M

machine learning: The dominant approach to AI: algorithms that improve at a task by learning patterns from data rather than following rules a human wrote.
market surveillance authority: The national body that enforces the AI Act in a member state, with powers to investigate, order corrective action and apply penalties.
maturity model: A laddered description of governance capability (ad hoc → repeatable → defined → managed → optimizing) used to pitch recommendations at the next achievable rung.
MCP: An open standard for connecting AI applications to external tools and data sources in a uniform way. For governance it matters because a tool definition supplied through an MCP server is process knowledge the agent reads: whoever controls that definition influences the agent's behavior, which makes third-party tool sources a supply chain question. See agentic AI.
memory poisoning: The risk that polluted, outdated, or deliberately planted information retained by an AI agent carries into all later decisions. It is hard to trace afterward, because the influence is not visible in the individual case that goes wrong, which is why what an agent retains and for how long is a design decision rather than a technical detail. See agentic AI, drift.
model card: A structured document describing an AI model: its purpose, training data, performance across conditions, limitations, and intended use. A core deployment-stage artifact, it lets the people operating and overseeing a system understand what it does and where it should not be trusted. Part of the technical documentation an auditor expects for a high-risk system. See artifact, life cycle.
model drift: Degradation of model performance as the deployment environment shifts away from the training distribution; detected by monitoring, answered by revalidation and retraining.
multi-agent system: A system in which several agents interact, delegate, and pass outputs to one another to reach a goal, with no human checkpoint between each step.

N

natural person: A living human individual, as distinct from a legal person such as a company; the holder of data-protection and AI-Act rights.
NIST AI RMF: The AI Risk Management Framework of the US National Institute of Standards and Technology, published as version 1.0 in 2023. It is a voluntary framework built around four functions: govern, map, measure, and manage. In a layered setup, it serves as the risk method inside a management system such as ISO/IEC 42001. See ISO/IEC 42001, ISO/IEC 23894.
notified body: An independent conformity-assessment organization designated to verify that a high-risk AI system meets the AI Act before it reaches the market.

O

OECD AI Principles: The intergovernmental principles for trustworthy AI adopted by the OECD in 2019 and updated in 2024. They set value-based expectations such as transparency, accountability, and human-centered values, and have shaped later frameworks and legislation. See responsible AI.
orchestration: The fixed program code around an AI model that determines which steps run in which order, what is mandatory, and where a human is involved. Because it is conventional software, it behaves predictably and can carry enforceable controls, which is why process structure belongs there rather than in prompt text. See enforcement point, guardrail.
orchestrator: The agent that coordinates other agents and tools toward a combined goal. It is the integration point where stack-level accountability and classification sit.
over-reliance: Granting an agent more autonomy than its demonstrated reliability justifies, usually on the strength of a demo. The most common agentic governance failure.
override rate: The share of proposals from an AI system that a human reviewer changes or rejects, used as an indicator of whether human oversight is functioning. A structural zero is a reason to investigate rather than a reassurance, because it can mean the system performs well or that the reviewer has stopped examining. It is a signal, not a standalone quality measure. See human oversight, automation bias.
OWASP: The Open Worldwide Application Security Project, a nonprofit foundation that publishes open security guidance. Two of its outputs matter for AI governance: the OWASP Top 10 for LLM Applications, which lists prompt injection as its first entry, and the OWASP Top 10 for Agentic Applications, which covers the security risks specific to agents that use tools and act autonomously. See prompt injection, least agency, agentic AI.

P

pillar: A responsible-AI principle as something an organization actively holds rather than merely endorses: one of the seven pillars of responsible AI, one per principle. A pillar is held, not implemented, by naming the harms that would breach the principle, assessing their risk, and placing controls that reduce it. Distinct from agentic AI, which is not one of the seven but a condition that changes how all of them are governed. See principle, harm, risk, agentic AI.
pilot question: An unscored item (15 of the AIGP's 100) being trialed for future exams. It is indistinguishable from scored items, and a reason not to panic over any single question.
policy engine: A component that applies recorded rules automatically to every action, for example a requirement that payments above a threshold need separate approval. Because the rule sits outside the model, it cannot be ignored or reasoned around by the model. Recording those rules as machine-readable code, kept under version control like any other production code, is known as policy-as-code.
post-incident review: The structured learning step after containment: root cause, corrective actions with owners, and updates flowing back into assessments, registers, training and contracts.
post-market monitoring: Provider-side duty to systematically collect and act on experience from systems in use, the product-regulation half of continuous monitoring.
principle: One of the seven responsible-AI values a governed system should live up to (fairness, safety and reliability, privacy, security and robustness, transparency and explainability, accountability, human oversight). A principle is abstract: it states an outcome, not a lever you can pull. It becomes governable by naming the harm that would breach it, assessing the risk that harm carries, and placing controls against that risk. Held this way, a principle becomes a pillar. See pillar, harm, risk.
privacy: The principle that personal data used by or produced through an AI system stays within the purpose and the legal basis it was collected for. Three routes cause most of the trouble: personal data in training material that was never intended for it, model output that reproduces what the model retained, and purpose creep, where a system built for one use drifts into another the original basis never covered. The GDPR governs this in full, and the EU AI Act adds data governance duties for high-risk systems (Article 10). See DPIA, purpose limitation, responsible AI.
probabilistic system: A system whose outputs are statistical predictions with error rates: designed to be wrong some fraction of the time, which testing measures rather than eliminates.
process autonomy: A dimension of an agent's autonomy: how much of a multi-step process it runs without a human checkpoint, from a single step to an end-to-end workflow.
processor: Under Article 4(8) GDPR, the party that processes personal data on behalf of the controller. A processor acts under the controller's documented instructions, bound by an Article 28 contract. AI vendors that run models on customer data are often processors, though the split must be assessed per service. See controller, GDPR.
profiling: Automated processing of personal data to evaluate or predict aspects of a person, such as performance, behavior or location, as defined in the GDPR.
progressive autonomy: Granting an agent the least autonomy that lets it work, then widening its scope only as evidence of reliable behavior accumulates. Autonomy is earned, not configured.
prohibited practices: AI uses banned outright under the AI Act, such as social scoring, manipulative techniques and untargeted scraping of facial images.
prompt injection: Smuggling adversarial instructions into a generative system's input (directly or via retrieved content) to override its intended behavior. It is called indirect prompt injection when the instructions arrive through an intermediate source such as a document, an email, or a web page rather than from the user. Complete separation of instruction and data does not exist inside a language model, so resistance is a matter of limiting and detecting damage rather than preventing it.
proportionality: Matching the weight of governance to the risk of the use case (heavy gates for high stakes, a light touch for low stakes), which keeps controls credible and followed.
provenance: The documented origin and history of data or content, used to establish where it came from and whether it can be trusted or lawfully used.
provider: The actor who develops an AI system (or has it developed) and places it on the market or into service under its own name. It carries manufacturer-style duties: design controls, documentation, conformity.
proxy discrimination: Discrimination that persists after protected attributes are removed, because other variables (postcode, shopping patterns) stand in for them.
pseudonymisation: Replacing identifying fields so data can't be attributed to a person without separate information, a minimization and security technique that keeps data personal under GDPR.
purpose limitation: Personal data collected for one purpose may not be processed for incompatible others. This principle makes repurposing operational data into training data a legal question.

R

RAG: Retrieval-augmented generation: grounding a generative model's answers in documents retrieved at query time. It gives currency and source-traceability without changing the model, at the price of governing the retrieval corpus.
real-time remote biometric identification: Identifying people from biometric data live in publicly accessible spaces; its use by law enforcement is sharply restricted under the AI Act.
record-keeping: The EU AI Act obligation for high-risk AI systems to allow automatic recording of events over the system's lifetime, laid down in Article 12. Deployers must keep the logs under their control for a period appropriate to the system's purpose, at least six months, under Article 26(6). Logs are what make decisions reconstructable afterward. See evidence, human oversight.
red teaming: Adversarial testing that deliberately probes an AI system for failures, harmful outputs or security weaknesses, before and after release.
regulatory sandbox: A supervised scheme run by a regulator that lets organizations test an AI system under controlled conditions before full deployment.
release gate: A decision point in the verify-and-validate stage where a system is checked against defined acceptance thresholds and signed off before it can go live, by someone with the authority to refuse. A preventive control: a release gate that no one can refuse is not a gate. Its anchor artifact is the release sign-off, recording who approved deployment and on what basis. See control, control types, life cycle.
representativeness: How well training data reflects the population and conditions the system will face in deployment, the fitness-for-purpose core of AI data quality.
repurposing: Using an AI system for a purpose other than the one it was built and assessed for, which can change its risk classification and the obligations that apply.
residual risk: The risk that remains after controls have reduced it. No control reduces a risk to zero, and not every control is worth its cost, so a deliberate judgment is made: whether the cost of further control is justified by the reduction it would buy, and whether the remaining risk is acceptable against the organization's risk appetite. This is a design-level judgment, where execution reports back up and governance accepts the residual risk, calls for more control, or declines the use case. EU AI Act Art. 9(5) requires it to be judged acceptable per hazard and overall. See risk, control, risk appetite.
responsible AI: The set of principles an AI system should live up to: fairness, safety and reliability, privacy, security and robustness, transparency and explainability, accountability, and human oversight. Widely shared and sitting under the EU AI Act and the major frameworks. On their own the principles are statements of intent; the law turns them into duties that cannot be met unless they are carried inside the organization's governance, which is how responsible AI lands in governance rather than beside it. The seven principles are organized into seven pillars, one pillar per principle. See principle, pillar, governance. The seventh principle carries two names in practice: human oversight in the seven-pillar model, and human-centricity in the IAPP AIGP body of knowledge; the substance overlaps.
risk: In the EU AI Act's terms, the combination of the likelihood that a harm occurs and the severity of it if it does. The link between a principle (via the harm that would breach it) and a control (the measure that reduces it). Naming the harm and assessing its risk is required by Art. 9 before any mitigation measure is chosen. See harm, control, residual risk.
risk appetite: The level of risk an organization's leadership is willing to accept in pursuit of its objectives, set at the governance design level. It is the benchmark against which residual risk is judged acceptable or not, inherited from the organization's broader governance and applied to AI. A concept from enterprise risk management (COSO ERM) before it is an AI one. See residual risk, governance design.
risk register: The living record of an AI system's identified risks, ratings, responses, owners and review dates, kept current from design through retirement.
risk-based approach: Regulating or governing AI in proportion to the risk of the use case rather than the technology itself, the organizing principle of the EU AI Act and most frameworks.
robustness: A system's ability to perform reliably under realistic conditions including noise, edge cases and adversarial pressure, the engineering core of the safety-and-reliability principle.

S

safety and reliability: The principle that an AI system performs as intended and fails in ways the organization can absorb. The characteristic AI failure is not a crash but decay: accuracy drops after deployment while nothing throws an error, so the organization keeps trusting numbers that are no longer true. Under the EU AI Act, high-risk AI systems must achieve an appropriate level of accuracy and robustness and perform consistently across their lifecycle (Article 15). See drift, evaluation set, high-risk AI system, responsible AI.
security and robustness: The principle that an AI system resists attack, manipulation and adversarial or unexpected input. The vectors include data poisoning, model extraction, membership inference and prompt injection; the controls are ML security testing and a hardened data-and-model pipeline. Under the EU AI Act, high-risk AI systems must be resilient against attempts to alter their use, outputs, or performance by exploiting vulnerabilities (Article 15). See prompt injection, adversarial input, guardrail, responsible AI.
serious incident: An AI incident causing (or nearly causing) death, serious harm to health, property, fundamental rights or infrastructure. It triggers regulatory reporting duties for high-risk systems.
shadow AI: AI tools adopted by staff or business units outside official channels and governance, the predictable product of processes that are too heavy or too slow.
social scoring: Evaluating people over time across contexts, with detrimental or disproportionate treatment as a result, a prohibited AI practice in the EU.
special-category data: GDPR Article 9 data (health, ethnicity, political opinions, religion, sexual orientation, biometrics for identification), processable only on narrow grounds. Inferring these traits creates them.
stakeholder mapping: Systematically identifying who is affected by a system (users, affected non-users, vulnerable groups, organization, society) and what each stands to gain or lose.
sub-agent: An agent invoked by another agent or an orchestrator to carry out part of a task. Its actions still inherit the obligations of the stack it belongs to.
substantial modification: A change to a deployed AI system that materially alters its function or purpose, capable of shifting provider obligations onto the modifier.
supply chain: The layered chain behind an AI product (foundation models, datasets, labeling services, integrators), each layer adding risk the buyer never contracted for directly.
systemic risk: EU AI Act category for the most capable general-purpose models (presumed above a training-compute threshold), triggering extra duties: evaluations, adversarial testing, incident reporting, cybersecurity.

T

technical documentation: Records a provider must compile and keep for a high-risk AI system to demonstrate conformity, covering its design, data, testing, risk management and monitoring.
third-party risk: Risk inherited through vendors and their supply chains. For AI this means invisible training-data defects, layered model dependencies and silent updates.
three lines of defense: Accountability model: the first line owns and operates risk, the second line sets policy and challenges, the third line (internal audit) independently assures, adapted to AI governance organization-wide.
tool misuse: An agent calling a permitted tool in a way that produces an unintended real-world effect. Countered with scoped tool access and approval gates on high-consequence calls.
training data: The data used to fit an AI model's parameters; its quality, lawful rights and representativeness are central governance concerns.
training records: Evidence of who completed which training content version, when, with results, the artifact that makes training function as a compliance control.
transparency: Openness about the fact that AI is used and how it operates in general: disclosures, documentation, notices. Pairs with explainability, which addresses individual outcomes.
transparency and explainability: The principle that people can know an AI system is involved and can be told why it produced a given outcome. The failure is concrete rather than abstract: it arrives on the day a customer, a supervisor, or a court asks for the reasoning, and "the model decided" turns out to be the absence of an explanation rather than one. The EU AI Act separates the two directions: Article 13 requires high-risk systems to be transparent enough for the deployer to interpret and use their output, and Article 50 requires people to be informed when they interact with AI or receive AI-generated content. See model card, responsible AI.
trustworthy AI: An umbrella term for AI that is lawful, ethical and robust, used by the OECD and EU; the responsible-AI pillars operationalize it.

V

value chain: The sequence of actors from model development through provision to deployment and use, along which responsibilities and AI-Act obligations move.

Browse AI governance