AI governance glossary

Plain-English definitions of the terms used in AI governance, compliance and risk management, with links to the laws and standards they come from. Last reviewed 3 October 2026. General information, not legal advice.

A

AI assurance: AI assurance is the set of activities that give stakeholders justified confidence that an AI system behaves as claimed and meets stated requirements. It combines testing, review, documentation and independent checks, including audits, and produces evidence that can be examined by people outside the team that built or runs the system.
AI compliance: AI compliance is the state of meeting the legal, regulatory and contractual requirements that apply to how an organisation builds, buys or uses AI, and being able to show it. It is narrower than AI governance and depends on the organisation's own practices and evidence, not on software alone.
AI governance: AI governance is the set of policies, roles, processes and controls an organisation uses to direct and oversee how AI is developed, bought and used, so that it is lawful, safe and accountable. It covers inventory, risk, oversight, evidence and decisions across the whole AI lifecycle.
AI incident: An AI incident is an event in which the development, deployment or use of an AI system causes, or nearly causes, harm or a breach of obligations, such as a harmful output, a discriminatory decision, a data leak or a safety failure. Organisations log incidents, investigate causes and track corrective actions.
AI literacy: AI literacy is the skills, knowledge and understanding that let people use and oversee AI systems sensibly and be aware of their opportunities and risks. Under the EU AI Act, providers and deployers must take measures to give their staff and others operating AI on their behalf a sufficient level of it.
AI management system (AIMS): An AI management system is the set of interrelated policies, objectives, processes and responsibilities an organisation uses to manage AI responsibly across its lifecycle. ISO/IEC 42001 specifies requirements for establishing, implementing, maintaining and continually improving one, using a plan-do-check-act approach.
AI Office: The AI Office is the European Commission function responsible for helping implement, monitor and supervise the EU AI Act, in particular for general-purpose AI models, and for contributing to AI governance at Union level. It works alongside national authorities in the Member States.
AI risk assessment: An AI risk assessment is a structured review that identifies how a specific AI system could cause harm, estimates the likelihood and severity, evaluates whether the risk is acceptable and records the measures to reduce it. It looks at people affected, data, context and foreseeable misuse as well as the model.
AI risk management: AI risk management is the continuous process of identifying, assessing, treating, monitoring and communicating risks that arise from AI systems throughout their lifecycle. It adapts general risk management to AI-specific issues such as bias, drift, opacity and misuse, and links decisions to documented evidence.
AI system: An AI system is a machine-based system that operates with some degree of autonomy and, from the input it receives, infers how to generate outputs such as predictions, content, recommendations or decisions that can influence physical or virtual environments. This is the approach taken by the EU AI Act and the OECD.
AI system inventory (AI registry): An AI system inventory, also called an AI registry, is a maintained list of the AI systems an organisation builds, buys or uses, with an owner, purpose, vendor, data, risk level and lifecycle status for each. It is the foundation for classification, controls, oversight and reporting.
Approval and decision record: An approval and decision record is a durable entry showing who approved, rejected or conditioned an AI-related decision, when, on what information and with what reasoning. It makes governance decisions traceable, so they can be reviewed by auditors, regulators and later owners.
Automated decision-making (GDPR Art. 22): Automated decision-making under GDPR Article 22 refers to decisions based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect a person. Individuals have a right not to be subject to such decisions, subject to limited exceptions with safeguards.

B

Bias and fairness: In AI, bias is a systematic error or skew that leads a system to treat people or groups differently in unjustified ways, while fairness is the goal of avoiding that. Bias can arise from data, design choices or the context of use, and fairness can be defined and measured in several competing ways.

C

CE marking (AI context): In the EU AI Act, the CE marking is the mark a provider affixes to a high-risk AI system to show it conforms with the Act's requirements for such systems and any other applicable Union harmonisation law. For software-only systems, a digital CE marking is used.
Conformity assessment: Conformity assessment is the process of demonstrating that a high-risk AI system meets the requirements the EU AI Act sets for such systems. Depending on the system, the provider uses internal control or involves a notified body, and the result supports the declaration of conformity and CE marking.
Continuous assurance: Continuous assurance is the practice of checking controls and AI system behaviour on an ongoing basis, rather than only at approval or audit time, so that problems are detected and evidenced between formal reviews. It relies on scheduled tests, monitoring signals and refreshed evidence.
Control (in governance): In governance, a control is a specific measure, process or technical safeguard that reduces a risk or meets a requirement, such as mandatory human review before a decision, access restrictions or bias testing before release. Each control should have an owner, a way to test it and linked evidence.

D

Data protection impact assessment (DPIA): A data protection impact assessment is a documented analysis of how a planned processing of personal data could affect individuals' rights and freedoms, and how those risks will be reduced. The GDPR requires one where processing is likely to result in a high risk, which can include AI uses.
Deployer: Under the EU AI Act, a deployer is a person or organisation that uses an AI system under its own authority in a professional capacity. A company using a purchased recruitment tool is a deployer; the company that built and supplied the tool is the provider.

E

Evidence (in governance): In governance, evidence is the recorded material that shows a control exists and operates, or that a decision or assessment was carried out, such as a signed policy, test results, logs, a completed assessment or a review record. Good evidence is dated, attributable and linked to the control or obligation it supports.
Explainability vs interpretability: Interpretability is how far a person can understand how a model produces its outputs from its structure, while explainability is the ability to give understandable reasons for a specific output, often after the fact using separate techniques. The terms are used loosely and sometimes interchangeably.

F

Foundation model: A foundation model is a large AI model trained on broad data, typically at scale, that can be adapted to many downstream tasks, such as a large language model. The term is common in research and policy; the EU AI Act uses the related legal concept of a general-purpose AI model.
Fundamental rights impact assessment (FRIA): A fundamental rights impact assessment is an assessment, required by the EU AI Act for certain deployers of high-risk AI systems, of how the system could affect people's fundamental rights before it is first used. It covers intended use, affected groups, likely harms, human oversight and mitigation.

G

General-purpose AI model (GPAI): A general-purpose AI model is an AI model that shows significant generality and can competently perform a wide range of distinct tasks, whichever way it is placed on the market, and can be integrated into many downstream systems. Large language models are the usual example.

H

High-risk AI system: Under the EU AI Act, a high-risk AI system is one that is either a safety component of a product covered by listed EU product legislation, or falls within a use case listed in Annex III, such as employment, education or essential services. It must meet strict requirements before and after market placement.
Human oversight: Human oversight means designing and operating an AI system so that people can understand its outputs, monitor it, intervene and, where needed, override or stop it. The aim is to prevent or reduce risks to health, safety and fundamental rights, and to counter over-reliance on automated outputs.

I

ISO/IEC 23894: ISO/IEC 23894:2023 is an international standard giving guidance on risk management for organisations that develop, deploy or use AI. It adapts the ISO 31000 risk management process to AI, covering context, assessment, treatment, monitoring and recording. It is guidance, not a certifiable requirements standard.
ISO/IEC 42001: ISO/IEC 42001:2023 is the international standard that specifies requirements for establishing, implementing, maintaining and continually improving an AI management system within an organisation. It applies to any organisation that provides or uses AI-based products or services, and organisations can be certified against it by accredited bodies.

M

Model drift: Model drift is the degradation or change in an AI model's performance over time because the data or real-world conditions it faces differ from those it was trained on. It includes data drift, where inputs change, and concept drift, where the relationship between inputs and outcomes changes.

N

NIST AI RMF: The NIST AI Risk Management Framework is a voluntary framework from the US National Institute of Standards and Technology to help organisations manage AI risks and build trustworthiness considerations into the design, development, use and evaluation of AI systems. Version 1.0 was released on 26 January 2023.
NIST AI RMF core functions: The NIST AI RMF core functions are Govern, Map, Measure and Manage. Govern builds the culture, accountability and policies for AI risk; Map establishes context and identifies risks; Measure analyses and tracks them; Manage prioritises and acts on them. Govern applies across the other three.
Notified body: A notified body is an independent conformity assessment body that a Member State has designated and notified to the European Commission to carry out third-party conformity assessment under EU law. Under the EU AI Act, it assesses certain high-risk AI systems and their providers' quality management systems.

P

Post-market monitoring: Post-market monitoring is the systematic collection and analysis of data on how a high-risk AI system performs after it is placed on the market, so providers can detect problems and take corrective action. The EU AI Act requires providers to run a system and plan proportionate to the AI technology and risks.
Prohibited AI practices: Prohibited AI practices are uses of AI that the EU AI Act bans because they pose unacceptable risk, such as harmful manipulation, exploiting vulnerabilities, social scoring, untargeted scraping of facial images, and emotion recognition in workplaces and schools, with narrow exceptions. Article 5 lists them.
Provider: Under the EU AI Act, a provider is a person or organisation that develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark, whether for payment or free. Providers carry most obligations for high-risk systems.

Q

Quality management system: In the EU AI Act, a quality management system is a documented set of policies, procedures and instructions that a provider of high-risk AI systems must keep to ensure compliance across the system's lifecycle, covering design, development, testing, data management, risk management, monitoring and incident reporting.

R

Red teaming: Red teaming for AI is a structured, adversarial test in which people deliberately try to make a system fail, misbehave or be misused, in order to find vulnerabilities, harmful outputs and weak safeguards before real users or attackers do. It is common for generative AI and agents.
Regulatory sandbox: An AI regulatory sandbox is a controlled framework set up by a competent authority that lets providers develop, train, test and validate innovative AI systems for a limited time under regulatory supervision, often before market placement. It aims to improve legal certainty and support innovation, especially for smaller firms.
Responsible AI: Responsible AI is an organisation's commitment and practice to develop and use AI in line with ethical principles such as fairness, transparency, accountability, privacy and safety. AI ethics supplies the values; responsible AI turns them into policies, processes and controls, and trustworthy AI describes the intended result.

S

Serious incident: Under the EU AI Act, a serious incident is an incident or malfunction of an AI system that directly or indirectly leads to death or serious harm to health, serious and irreversible disruption of critical infrastructure, an infringement of fundamental-rights obligations, or serious harm to property or the environment.
Shadow AI: Shadow AI is the use of AI tools, models or features by employees or teams without the knowledge or approval of the organisation's IT, security or governance functions. Examples include pasting company data into a public chatbot or enabling an AI feature in a SaaS product without review.

T

Technical documentation: Technical documentation is the file a provider of a high-risk AI system must create and keep up to date to show the system meets the EU AI Act's requirements. It describes the system, its design, data, testing, risk management and monitoring plan, and is available to authorities on request.
Third-party (vendor) AI risk: Third-party AI risk is the risk that arises when an organisation relies on AI built or operated by suppliers, such as software vendors, model providers and AI features embedded in tools. It covers data exposure, reliability, legal obligations, hidden subcontractors and limited visibility into how the AI works.
Transparency obligations: Transparency obligations are legal duties to tell people when they are dealing with AI or AI-generated content. Under Article 50 of the EU AI Act they include informing people they are interacting with an AI system, marking synthetic content, and disclosing deepfakes and emotion recognition or biometric categorisation.

AI governance glossary

A

AI assurance: AI assurance is the set of activities that give stakeholders justified confidence that an AI system behaves as claimed and meets stated requirements. It combines testing, review, documentation and independent checks, including audits, and produces evidence that can be examined by people outside the team that built or runs the system.
AI compliance: AI compliance is the state of meeting the legal, regulatory and contractual requirements that apply to how an organisation builds, buys or uses AI, and being able to show it. It is narrower than AI governance and depends on the organisation's own practices and evidence, not on software alone.
AI governance: AI governance is the set of policies, roles, processes and controls an organisation uses to direct and oversee how AI is developed, bought and used, so that it is lawful, safe and accountable. It covers inventory, risk, oversight, evidence and decisions across the whole AI lifecycle.
AI incident: An AI incident is an event in which the development, deployment or use of an AI system causes, or nearly causes, harm or a breach of obligations, such as a harmful output, a discriminatory decision, a data leak or a safety failure. Organisations log incidents, investigate causes and track corrective actions.
AI literacy: AI literacy is the skills, knowledge and understanding that let people use and oversee AI systems sensibly and be aware of their opportunities and risks. Under the EU AI Act, providers and deployers must take measures to give their staff and others operating AI on their behalf a sufficient level of it.
AI management system (AIMS): An AI management system is the set of interrelated policies, objectives, processes and responsibilities an organisation uses to manage AI responsibly across its lifecycle. ISO/IEC 42001 specifies requirements for establishing, implementing, maintaining and continually improving one, using a plan-do-check-act approach.
AI Office: The AI Office is the European Commission function responsible for helping implement, monitor and supervise the EU AI Act, in particular for general-purpose AI models, and for contributing to AI governance at Union level. It works alongside national authorities in the Member States.
AI risk assessment: An AI risk assessment is a structured review that identifies how a specific AI system could cause harm, estimates the likelihood and severity, evaluates whether the risk is acceptable and records the measures to reduce it. It looks at people affected, data, context and foreseeable misuse as well as the model.
AI risk management: AI risk management is the continuous process of identifying, assessing, treating, monitoring and communicating risks that arise from AI systems throughout their lifecycle. It adapts general risk management to AI-specific issues such as bias, drift, opacity and misuse, and links decisions to documented evidence.
AI system: An AI system is a machine-based system that operates with some degree of autonomy and, from the input it receives, infers how to generate outputs such as predictions, content, recommendations or decisions that can influence physical or virtual environments. This is the approach taken by the EU AI Act and the OECD.
AI system inventory (AI registry): An AI system inventory, also called an AI registry, is a maintained list of the AI systems an organisation builds, buys or uses, with an owner, purpose, vendor, data, risk level and lifecycle status for each. It is the foundation for classification, controls, oversight and reporting.
Approval and decision record: An approval and decision record is a durable entry showing who approved, rejected or conditioned an AI-related decision, when, on what information and with what reasoning. It makes governance decisions traceable, so they can be reviewed by auditors, regulators and later owners.
Automated decision-making (GDPR Art. 22): Automated decision-making under GDPR Article 22 refers to decisions based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect a person. Individuals have a right not to be subject to such decisions, subject to limited exceptions with safeguards.

B

Bias and fairness: In AI, bias is a systematic error or skew that leads a system to treat people or groups differently in unjustified ways, while fairness is the goal of avoiding that. Bias can arise from data, design choices or the context of use, and fairness can be defined and measured in several competing ways.

C

CE marking (AI context): In the EU AI Act, the CE marking is the mark a provider affixes to a high-risk AI system to show it conforms with the Act's requirements for such systems and any other applicable Union harmonisation law. For software-only systems, a digital CE marking is used.
Conformity assessment: Conformity assessment is the process of demonstrating that a high-risk AI system meets the requirements the EU AI Act sets for such systems. Depending on the system, the provider uses internal control or involves a notified body, and the result supports the declaration of conformity and CE marking.
Continuous assurance: Continuous assurance is the practice of checking controls and AI system behaviour on an ongoing basis, rather than only at approval or audit time, so that problems are detected and evidenced between formal reviews. It relies on scheduled tests, monitoring signals and refreshed evidence.
Control (in governance): In governance, a control is a specific measure, process or technical safeguard that reduces a risk or meets a requirement, such as mandatory human review before a decision, access restrictions or bias testing before release. Each control should have an owner, a way to test it and linked evidence.

D

Data protection impact assessment (DPIA): A data protection impact assessment is a documented analysis of how a planned processing of personal data could affect individuals' rights and freedoms, and how those risks will be reduced. The GDPR requires one where processing is likely to result in a high risk, which can include AI uses.
Deployer: Under the EU AI Act, a deployer is a person or organisation that uses an AI system under its own authority in a professional capacity. A company using a purchased recruitment tool is a deployer; the company that built and supplied the tool is the provider.

E

Evidence (in governance): In governance, evidence is the recorded material that shows a control exists and operates, or that a decision or assessment was carried out, such as a signed policy, test results, logs, a completed assessment or a review record. Good evidence is dated, attributable and linked to the control or obligation it supports.
Explainability vs interpretability: Interpretability is how far a person can understand how a model produces its outputs from its structure, while explainability is the ability to give understandable reasons for a specific output, often after the fact using separate techniques. The terms are used loosely and sometimes interchangeably.

F

Foundation model: A foundation model is a large AI model trained on broad data, typically at scale, that can be adapted to many downstream tasks, such as a large language model. The term is common in research and policy; the EU AI Act uses the related legal concept of a general-purpose AI model.
Fundamental rights impact assessment (FRIA): A fundamental rights impact assessment is an assessment, required by the EU AI Act for certain deployers of high-risk AI systems, of how the system could affect people's fundamental rights before it is first used. It covers intended use, affected groups, likely harms, human oversight and mitigation.

G

General-purpose AI model (GPAI): A general-purpose AI model is an AI model that shows significant generality and can competently perform a wide range of distinct tasks, whichever way it is placed on the market, and can be integrated into many downstream systems. Large language models are the usual example.

H

High-risk AI system: Under the EU AI Act, a high-risk AI system is one that is either a safety component of a product covered by listed EU product legislation, or falls within a use case listed in Annex III, such as employment, education or essential services. It must meet strict requirements before and after market placement.
Human oversight: Human oversight means designing and operating an AI system so that people can understand its outputs, monitor it, intervene and, where needed, override or stop it. The aim is to prevent or reduce risks to health, safety and fundamental rights, and to counter over-reliance on automated outputs.

I

ISO/IEC 23894: ISO/IEC 23894:2023 is an international standard giving guidance on risk management for organisations that develop, deploy or use AI. It adapts the ISO 31000 risk management process to AI, covering context, assessment, treatment, monitoring and recording. It is guidance, not a certifiable requirements standard.
ISO/IEC 42001: ISO/IEC 42001:2023 is the international standard that specifies requirements for establishing, implementing, maintaining and continually improving an AI management system within an organisation. It applies to any organisation that provides or uses AI-based products or services, and organisations can be certified against it by accredited bodies.

M

Model drift: Model drift is the degradation or change in an AI model's performance over time because the data or real-world conditions it faces differ from those it was trained on. It includes data drift, where inputs change, and concept drift, where the relationship between inputs and outcomes changes.

N

NIST AI RMF: The NIST AI Risk Management Framework is a voluntary framework from the US National Institute of Standards and Technology to help organisations manage AI risks and build trustworthiness considerations into the design, development, use and evaluation of AI systems. Version 1.0 was released on 26 January 2023.
NIST AI RMF core functions: The NIST AI RMF core functions are Govern, Map, Measure and Manage. Govern builds the culture, accountability and policies for AI risk; Map establishes context and identifies risks; Measure analyses and tracks them; Manage prioritises and acts on them. Govern applies across the other three.
Notified body: A notified body is an independent conformity assessment body that a Member State has designated and notified to the European Commission to carry out third-party conformity assessment under EU law. Under the EU AI Act, it assesses certain high-risk AI systems and their providers' quality management systems.

P

Post-market monitoring: Post-market monitoring is the systematic collection and analysis of data on how a high-risk AI system performs after it is placed on the market, so providers can detect problems and take corrective action. The EU AI Act requires providers to run a system and plan proportionate to the AI technology and risks.
Prohibited AI practices: Prohibited AI practices are uses of AI that the EU AI Act bans because they pose unacceptable risk, such as harmful manipulation, exploiting vulnerabilities, social scoring, untargeted scraping of facial images, and emotion recognition in workplaces and schools, with narrow exceptions. Article 5 lists them.
Provider: Under the EU AI Act, a provider is a person or organisation that develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark, whether for payment or free. Providers carry most obligations for high-risk systems.

Q

Quality management system: In the EU AI Act, a quality management system is a documented set of policies, procedures and instructions that a provider of high-risk AI systems must keep to ensure compliance across the system's lifecycle, covering design, development, testing, data management, risk management, monitoring and incident reporting.

R

Red teaming: Red teaming for AI is a structured, adversarial test in which people deliberately try to make a system fail, misbehave or be misused, in order to find vulnerabilities, harmful outputs and weak safeguards before real users or attackers do. It is common for generative AI and agents.
Regulatory sandbox: An AI regulatory sandbox is a controlled framework set up by a competent authority that lets providers develop, train, test and validate innovative AI systems for a limited time under regulatory supervision, often before market placement. It aims to improve legal certainty and support innovation, especially for smaller firms.
Responsible AI: Responsible AI is an organisation's commitment and practice to develop and use AI in line with ethical principles such as fairness, transparency, accountability, privacy and safety. AI ethics supplies the values; responsible AI turns them into policies, processes and controls, and trustworthy AI describes the intended result.

S

Serious incident: Under the EU AI Act, a serious incident is an incident or malfunction of an AI system that directly or indirectly leads to death or serious harm to health, serious and irreversible disruption of critical infrastructure, an infringement of fundamental-rights obligations, or serious harm to property or the environment.
Shadow AI: Shadow AI is the use of AI tools, models or features by employees or teams without the knowledge or approval of the organisation's IT, security or governance functions. Examples include pasting company data into a public chatbot or enabling an AI feature in a SaaS product without review.

T

Technical documentation: Technical documentation is the file a provider of a high-risk AI system must create and keep up to date to show the system meets the EU AI Act's requirements. It describes the system, its design, data, testing, risk management and monitoring plan, and is available to authorities on request.
Third-party (vendor) AI risk: Third-party AI risk is the risk that arises when an organisation relies on AI built or operated by suppliers, such as software vendors, model providers and AI features embedded in tools. It covers data exposure, reliability, legal obligations, hidden subcontractors and limited visibility into how the AI works.
Transparency obligations: Transparency obligations are legal duties to tell people when they are dealing with AI or AI-generated content. Under Article 50 of the EU AI Act they include informing people they are interacting with an AI system, marking synthetic content, and disclosing deepfakes and emotion recognition or biometric categorisation.