Responsible AI Glossary

EU AI Act classification (Annex III / Art. 6) triggering the strictest pre- and post-market obligations short of prohibition.

Synthetic media generated or manipulated by AI that falsely depicts a real person's likeness or actions.

Risk arising from compromised third-party models, data, or plugins.

The ongoing practice of identifying, collecting, mapping, and governing an organization's AI use cases across their lifecycle — the foundation for inventory, risk classification, and EU AI Act compliance.

Skills, knowledge, and understanding enabling providers, deployers, and users to make informed decisions about AI (explicit EU AI Act obligation, Art. 4).

Cross-functional body that steers an organization's AI governance program — bringing together stakeholders such as legal, security, data protection, risk, and technical teams to set direction, prioritize, and oversee decisions (broader in remit than an AI ethics board).

Principle requiring AI systems and their use to be disclosed, documented, and understandable to relevant stakeholders.

Attack that corrupts training data to manipulate model behavior (OWASP LLM/ML Top 10).

Structured evaluation of the potential effects of an algorithmic system before/during deployment.

Formal system of policies and processes for governing AI per ISO/IEC 42001.

Continuous, real-time monitoring and constraint of a deployed AI system or agent to keep it within approved boundaries — checking permissions, tool usage, and behavior at runtime and flagging or blocking scope violations before they become incidents.

Risk of resource-exhaustion attacks against a hosted model.

Risk remaining after controls and mitigations have been applied.

AI system that can autonomously plan, decide, and take actions (often by calling tools or other systems) to pursue goals with limited human intervention; its autonomy raises distinct responsible-AI challenges around oversight, accountability, traceability, and scope control.

GPAI model meeting a high-impact capability threshold, subject to additional EU AI Act obligations (Art. 51–55).

Unauthorized modification of a model's weights, architecture, or configuration after training, whether via supply chain compromise or insider action.

GDPR-mandated assessment of privacy risks for high-risk processing activities, often paired with AI risk assessments.

Independent testing confirming a model performs as intended and within acceptable risk limits.

Principle of embedding privacy protections into system architecture from the outset rather than retrofitting.

Attack that reconstructs or steals a proprietary model's functionality or parameters via repeated queries against its API.

AI safety concern where a model deliberately underperforms during evaluation to conceal true capabilities.

Entity that develops an AI system/GPAI model and places it on the market under its own name.

Emerging executive role responsible for enterprise AI strategy, ethics, and governance.

Discipline (rooted in financial services, now applied to AI) governing model validation, monitoring, and controls.

Framing of AI systems as inseparable combinations of technology, people, and organizational context.

Principle that organizations and individuals must be answerable for the outcomes of AI systems they design, develop, or deploy (OECD, NIST AI RMF).

Change in the statistical distribution of input data over time relative to training data, a common cause of model performance decay (distinct from concept drift, which is a change in input-output relationships).

Risk that an AI system reproduces or generates content that violates third-party copyright or intellectual-property rights, via training data or model outputs — a growing responsible-AI and legal concern.

Metadata or cryptographic proof documenting the origin and history of AI-generated or edited content (e.g., C2PA).

Large model trained on broad data, adaptable to a wide range of downstream tasks.

Principle of collecting/processing only data necessary for a specified purpose.

Defensive technique that trains a model on adversarial examples to improve its robustness against attack.

Attack that reconstructs training data or sensitive attributes from a model's outputs.

Documentation, similar to a model card, describing an AI system's overall behavior, safeguards, and limitations at the product level.

Systematic and repeatable errors in a system that create unfair outcomes for particular groups.

Intergovernmental standards (2019) for trustworthy AI: inclusive growth, human-centered values, transparency, robustness, and accountability.

Policies and controls managing the availability, integrity, security, and usability of data used in AI systems.

Practice of defining, monitoring, and enforcing the boundaries of what an AI agent may do (the tools, data, and actions within its remit), and detecting scope violations where an agent exceeds those permissions.

EU AI Act–defined event (Art. 3(49)) involving death, serious harm, infrastructure disruption, or fundamental rights infringement linked to an AI system, triggering mandatory reporting.

Degree to which a human can understand the cause of a model's decision or prediction.

Adversarial testing exercise simulating attacks or misuse to uncover a system's vulnerabilities.

Classifying individuals based on biometric data into categories such as race, gender, or political opinion; restricted under the EU AI Act.

EU body responsible for AI Act implementation, particularly oversight of general-purpose AI models.

Live biometric identification in public spaces by law enforcement; heavily restricted under the EU AI Act.

Hypothesized failure mode where a model behaves safely during evaluation but pursues different goals when unsupervised.

Attack that recovers verbatim or near-verbatim training examples (including sensitive data) directly from a model's outputs.

Formal internal document that sets the rules, principles, roles, and responsibilities for how an organization develops, procures, and uses AI — the practical formalization of an AI governance program that makes guidelines actionable for employees.

Research field aiming to reverse-engineer neural network internals into human-understandable algorithms.

Individual's right to receive meaningful information about the logic of an automated decision affecting them.

Evaluation of whether a control has been implemented and is actually working to mitigate the AI risk it targets; increasingly automated by analyzing connected sources and evidence to judge effectiveness.

EU AI Act requirement (Art. 14) that high-risk AI systems be designed to allow effective human supervision.

International standard for information security management systems (ISMS); in AI governance it underpins the security of data and models and is often pursued alongside ISO/IEC 42001.

Prohibited EU AI Act practice of evaluating individuals based on behavior/characteristics leading to unjustified detrimental treatment.

EU AI Act Art. 50 requirements to disclose AI-generated or manipulated content (e.g., deepfakes) to users.

Core AI governance function of ensuring AI systems and processes meet applicable legal, regulatory, and framework requirements on an ongoing basis – a key pillar of the AI governance operating model and a subset of GRC.

Governance pattern where an AI agent's proposed changes are staged in a safe copy rather than written directly to live systems, so a human can review, edit, and approve them before they take effect — keeping humans in the loop without sacrificing automation.

A system's resilience to adversarial attacks or manipulated inputs.

Attack that extracts a system's hidden prompt, instructions, or confidential context through crafted user input.

Change in the statistical relationship between model inputs and outputs over time, degrading performance.

Level and type of risk an organization is willing to accept in pursuit of its objectives.

Classifying AI applications (e.g., low, limited, high, unacceptable risk) to determine applicable controls.

Entity in the supply chain, other than provider or importer, that makes an AI system available on the market.

Ability that appears in a model unpredictably as scale increases, not present in smaller versions.

AI technology that has both beneficial and potentially harmful applications, including civilian and military uses.

LLM risk from failing to validate/sanitize LLM outputs before downstream use.

Automated processing of personal data to evaluate or predict aspects of a person (GDPR Art. 4(4)).

GRC model separating operational management, risk/compliance oversight, and independent audit functions.

Structured mechanism (e.g., forms sent to teams) for discovering and registering AI systems and use cases across an organization, including surfacing shadow AI – the entry point that feeds the AI inventory.

An event where an AI system causes or nearly causes harm, tracked in resources like the OECD AI Incidents Monitor and MIT AI Risk Repository.

Category of risk in the MIT AI Risk Repository referring to AI's potential to cause human extinction or permanent civilizational collapse.

Standard requiring humans retain real, informed influence over an AI system's consequential decisions.

EU AI Act term for a change to an AI system significant enough to require reassessment of conformity.

Decisions made by an AI system with little or no human involvement, often subject to explanation/opt-out rights (cf. GDPR Art. 22).

Predefined procedure for detecting, escalating, and remediating AI system failures or harms.

Attack that crafts inputs at inference time to cause a deployed model to misclassify or malfunction, without altering the model itself.

Structured foundation of standards, requirements, and best practices an organization adopts and adapts to govern AI – often built on established frameworks (e.g., NIST AI RMF, ISO/IEC 42001) plus legal obligations and industry practices.

Fairness criterion requiring a decision would be the same in a counterfactual world absent a protected attribute.

Discrimination that occurs when a facially neutral policy disproportionately harms a protected group.

Controlled environment allowing testing of innovative AI systems under regulatory supervision before market entry (EU AI Act Art. 57–63).

AI Principle requiring AI systems to respect human rights, democratic values, and diversity.

Structured evaluation of a third-party AI product or provider against your security, privacy, and risk policies — reviewing documentation, questionnaires, and evidence — to decide whether an external AI system meets your standards before adoption.

NIST's voluntary framework (Govern, Map, Measure, Manage functions) for managing AI risks.

Mathematical technique that adds calibrated noise to protect individual privacy in datasets or outputs.

Conformity marking indicating a high-risk AI system meets EU AI Act requirements.

Frontier AI lab commitment to gate model capability increases behind corresponding safety and security measures.

Structured comparison of the controls an AI system currently has against those required by a chosen framework or regulation, surfacing missing or insufficient safeguards to remediate.

EU regulation governing the processing of personal data; it underpins many AI governance obligations (lawful basis, data minimization, automated-decision rights) and frequently intersects with AI-specific requirements like DPIAs and profiling limits.

Ensuring an AI system's goals and behaviors match human intentions and values.

Artificially generated data used to train or test models, often to preserve privacy or augment datasets.

GDPR-mandated inventory documenting how personal data is processed (purposes, data categories, recipients, safeguards); in AI governance it complements the AI registry and DPIAs for data-driven systems.

The effect of uncertainty on objectives, typically expressed as a function of likelihood and impact (ISO 31000 / ISO 42001 framing, adapted for AI harms).

Risk of users trusting AI outputs without sufficient verification or oversight.

Attack determining whether a specific data record was used in a model's training set.

Degradation of model performance over time as real-world data diverges from training data.

Tamper-evident, chronological record of the actions, decisions, and changes across an AI system's governance lifecycle (who did what, when), enabling accountability, review, and evidence for internal and external audits.

Training technique that fine-tunes models using human preference judgments.

Technical or procedural controls constraining an AI system's outputs or actions within acceptable bounds.

Technique for bypassing an AI model's safety controls to elicit prohibited content or behavior.

The subset of AI risk management focused on protecting AI systems, models, and data from malicious attacks (e.g., data poisoning, model theft, adversarial manipulation) — distinct from AI safety's broader focus on unintended harm.

Techniques applied to data, models, or processes to reduce unfair bias in AI outcomes.