The terms that keep coming up on an enterprise AI programme, defined in plain English. Written for boards, security teams, and builders alike.
An AI system that plans and executes multi-step actions by calling external tools, rather than producing a single response to a single prompt.
Agents pair a language model with function-calling capability and run in a loop: read the goal, choose a tool, read the result, decide what to do next. The trade-off is capability against cascading failure risk, which is why blast-radius design matters so much at the agent layer.
A design pattern in which the AI decides what to do next, not the human.
The model selects tools, reads intermediate results, and chooses further actions in a loop until a goal is reached or a budget is exhausted. Agentic AI shifts the governance conversation from prompt review to scope review: what is the agent allowed to touch, and how reversible are its actions?
The scope of systems, data, and external actions an agentic AI can affect when something goes wrong.
Minimising blast radius is the core of safe agent design: narrow tool scopes, reversible actions, human-in-the-loop on high-impact steps, and hard limits on cost, time, and out-of-scope domains. It is our preferred framing for discussing agent risk with a security or compliance audience.
The European Union regulation that classifies AI systems by risk tier and imposes obligations on providers and deployers.
Whether a system is high-risk depends on its use or the product it sits in, not on the sector: the use cases listed in Annex III (for example recruitment, credit scoring, access to education) or AI in products covered by Annex I. Prohibited practices have applied since 2 February 2025 and the rules for general-purpose AI models since 2 August 2025. The high-risk requirements (risk management, documentation, human oversight, post-market monitoring) apply from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I products, after the Digital Omnibus (Regulation (EU) 2026/1744) deferred them. Fines reach up to 7% of worldwide annual turnover for prohibited practices.
A structured review of an organisation’s AI usage, risks, and controls.
Typically covers inventory (what is in use), data flows, vendor posture, and compliance gaps against frameworks such as the EU AI Act, ISO/IEC 42001, or the NIST AI Risk Management Framework. Output is usually a scored report with prioritised remediation steps.
The set of policies, roles, and review processes that decide what AI can be used, by whom, on which data, and under which controls.
Governance is the bridge between ad-hoc AI adoption and a managed programme with auditability. Good governance is boring on purpose: clear ownership, versioned policies, repeatable reviews, evidence trails.
A measure of whether an organisation has the data quality, infrastructure, skills, and governance needed to deploy AI safely and repeatably.
Low readiness is the root cause of most failed AI pilots: the model is not the problem, the operating environment is. Readiness assessments score across dimensions (data, infra, process, people, risk) rather than giving a single number.
A structured evaluation of likelihood and impact for harms linked to an AI system (bias, data leakage, over-reliance, hallucination, third-party exposure).
Outputs feed into mitigation plans, vendor decisions, and compliance documentation. In regulated sectors the assessment is itself an audit artefact, not a private internal document.
The degree to which an AI system’s behaviour matches the intent of its operators and the expectations of its users.
Alignment breaks down through prompt injection, distribution shift, or goal mis-specification. Production alignment is an operational problem as much as a research one: monitoring, evaluation, and rollback pathways matter more than clever prompts.
A decision about someone produced solely by automated processing, without meaningful human involvement.
GDPR Article 22 restricts it where the decision has legal or similarly significant effects, such as hiring, credit or access to a service, and gives the individual rights to explanation and human review. A human who rubber-stamps the model’s output does not make it non-automated; the review has to be capable of changing the outcome.
The pattern where employees use personal AI tools (ChatGPT, Claude, Gemini, and others) on work data without IT approval.
BYOAI is the usage pattern behind most Shadow AI inventories. The data exposure risk is real, but heavy-handed bans typically drive the behaviour underground rather than stopping it; sanctioned alternatives work better.
GDPR’s two roles: the controller decides why and how personal data is processed, the processor acts on the controller’s instructions.
Your organisation is usually the controller for data your staff put into an AI tool. On business plans the vendor normally acts as your processor under a DPA; on consumer or personal plans, the typical shadow-AI case, the vendor usually sets its own terms, acts as a controller in its own right, and has no DPA with you. The distinction also bites when a vendor reserves the right to use your inputs for its own model training, because it is then acting as a controller for its own purposes and the contract needs to say so.
Tooling that inspects content leaving the organisation and blocks or flags it when it matches a sensitive pattern, such as card numbers, health data or source code.
Most DLP was written before generative AI and watches email, file shares and managed endpoints. It frequently does not see text pasted into a browser-based AI chat, which is the exact path that matters here. "We have DLP" and "our DLP covers AI tools" are different statements, and only the second reduces risk.
The contract required by GDPR Article 28 whenever one organisation processes personal data on another’s behalf, setting out what the processor may do with it.
For AI tools this is the document that decides whether a vendor may train on your inputs, where it may store them, which sub-processors it may use, and what happens on deletion. A consumer subscription almost never comes with one: the same product under a Team or Enterprise plan usually does. "We pay for it" is not the same as "we have a DPA".
The physical or legal jurisdiction in which data is stored and processed.
European customers often require EU residency in their contracts. GDPR itself does not require data to stay in the EU: it regulates transfers outside the EEA (Chapter V). Residency clauses should cover logs, embeddings, and backups, not just primary records.
Related
AI-generated or manipulated image, audio or video that resembles real people, places or events and would falsely appear authentic, as the EU AI Act defines it.
For enterprises the sharpest risk is impersonation: a cloned voice or a live video of an executive asking for an urgent payment, or a generated identity document at onboarding. Detection helps, but the reliable control is process: confirmation on a known, separate channel and approvals a single call cannot bypass. The AI Act also requires those who use AI to generate deepfakes to disclose that the content is artificial.
The EU regulation on ICT risk in financial services, Regulation (EU) 2022/2554, applying since 17 January 2025 to banks, insurers, investment firms, payment institutions and other financial entities.
DORA covers ICT risk management, incident reporting, resilience testing and the management of ICT third-party providers, including a register of information listing every contractual arrangement with them. AI APIs, copilots and model platforms are ICT services, so they belong in that register and in the exit planning, however they were bought.
A GDPR-mandated analysis for processing that is likely to produce high risks to the rights of data subjects.
AI systems handling personal data typically trigger a DPIA. A good DPIA documents purpose, legal basis, risks, safeguards, and the residual risk the organisation is willing to carry.
Related
A numeric vector representation of text, produced by a model, such that similar meanings sit close together in vector space.
Embeddings power semantic search, retrieval-augmented generation, clustering, and classification. Choice of embedding model affects retrieval quality as much as any other component of a RAG pipeline.
A curated collection of inputs and expected behaviours used to score an AI system.
Good evals catch regressions across model updates, prompt changes, and data drift. Bad evals lull teams into confidence: they are narrow, stale, or measure the wrong thing. Treat the eval set as product code, not a quality-assurance afterthought.
Further training of a pre-trained model on a smaller, task-specific dataset to specialise its behaviour.
Often used for tone, format, or proprietary terminology, and rarely the right tool for injecting new factual knowledge (use RAG for that). Fine-tuned weights are an operational asset: version, evaluate, and back them up.
The EU General Data Protection Regulation, the primary legal framework governing personal data in Europe.
GDPR constrains AI training, inference on personal data, cross-border transfers, and subject rights (access, erasure, portability). AI features routinely trigger DPIAs and contractual data-residency requirements.
The EU AI Act’s term for a model trained on broad data that can perform a wide range of distinct tasks and is built into many downstream systems, such as the large language models behind today’s assistants.
Obligations for providers of these models have applied since 2 August 2025: technical documentation, information for downstream providers, a copyright policy and a summary of the training content, with further duties for models that pose systemic risk. Most organisations are downstream: building on such a model does not make you its provider, but substantially modifying one can, and the AI system you build on it carries its own obligations.
A curated, validated, version-controlled knowledge base used for retrieval or evaluation.
Unlike an open crawl, a golden corpus has known provenance, expert sign-off, and immutable snapshots that make reports reproducible. 01 pins each AI Diagnostic report to a hash-identified snapshot of its corpus, so the same inputs reliably produce the same findings and wording.
Related
Programmatic checks wrapped around an LLM to block prohibited content, reject out-of-scope requests, or enforce format.
Guardrails are necessary but insufficient. They catch the obvious cases; they do not substitute for careful prompt design, retrieval hygiene, monitoring, or evaluation.
Content generated by an LLM that is fluent and plausible but unsupported by fact.
Retrieval, citation, and constrained decoding reduce hallucination rate, but rarely to zero. Any audit or compliance workflow built on an LLM must assume a non-zero rate and design review steps accordingly.
Related
A retrieval strategy that combines dense vector search (embeddings) with sparse lexical search (BM25 or similar), then fuses the results.
Hybrid retrieval outperforms either method alone for enterprise documents that mix jargon, acronyms, and prose. Fusion is usually Reciprocal Rank Fusion, followed by a cross-encoder reranker for final ordering.
The documented procedure for detecting, containing and reporting a security or data incident, including who decides and who must be told.
AI adds failure modes a generic plan usually does not name: confidential material pasted into a consumer chat tool, a prompt-injection incident, a vendor breach affecting data you never catalogued. GDPR’s 72-hour notification clock runs regardless of whether the plan anticipated the scenario.
Related
Running a trained AI model on an input to produce an output.
Inference cost (latency, compute, API fees) dominates production budgets far more than training cost for most enterprise deployments. Cost-aware architecture (caching, batching, smaller models for easier tasks) often matters more than model choice.
The international standard for an information security management system. Organisations are certified against it by accredited certification bodies.
It certifies that a company runs a managed security process, not that any particular product is secure, and the certificate’s scope statement matters as much as its existence. Alongside SOC 2 it is the most common evidence a vendor offers. ISO/IEC 42001 is its newer counterpart for AI management systems specifically.
Related
The international standard for an AI management system, published in 2023, covering how an organisation governs the AI it builds or uses.
Where ISO 27001 covers information security, 42001 covers AI specifically: risk assessment, impact assessment, lifecycle controls and human oversight. Certification is still uncommon, so its presence is a strong positive signal and its absence says very little at this stage.
A deliberate prompt crafted to bypass an LLM’s safety training or an application’s guardrails.
Jailbreaks evolve continuously; defending solely at the prompt layer is a losing strategy. Layer defences across the stack: guardrails, tool scopes, least privilege, human review on high-impact actions.
One of GDPR’s six lawful bases for processing personal data, relied on where the processing is necessary for interests that are not overridden by the individual’s rights.
Several AI vendors cite legitimate interest as their basis for training models on data they hold. The EDPB (Opinion 28/2024) and the French regulator CNIL (recommendations of June 2025, which build on that opinion) accept it only where the processing is necessary and passes a balancing test backed by safeguards. Whether a given vendor meets those conditions for your data is a question for counsel rather than a settled matter.
A neural network trained on massive text corpora to predict the next token.
Modern LLMs (Claude, GPT, Gemini, Llama, Mistral, and others) power most enterprise AI features, from summarisation to agentic workflows. Model choice is increasingly about fit to task and data residency, rather than raw benchmark scores.
A proxy that sits between your applications and the model providers, so every model call passes through one point of control.
The gateway handles authentication, routing, rate limits, caching and logging, and meters spend by team and use case. It is also what makes switching providers practical: when a model is retired or a price changes, you change the route, not every application. Without one, AI costs and data flows are scattered across individual API keys.
An open protocol for connecting AI assistants and agents to tools and data sources through a standard interface, introduced by Anthropic in late 2024 and since adopted across the major AI platforms.
An MCP server exposes tools (send an e-mail, query a database, open a ticket) that any compatible agent can call. That makes integration cheap and access easy to over-grant: every server runs with real credentials, and its tool descriptions and returned content reach the model, so they can carry injected instructions. Treat each server as privileged code: scope its credentials to the task, separate read from write, and log every call.
The operational discipline of running machine learning systems in production: versioning, deployment, monitoring, retraining, rollback.
Distinct from classic DevOps because models degrade silently as data distributions drift. A working MLOps practice closes the loop between production signals, evaluation, and retraining.
A standardised summary of a model’s intended use, training data, evaluation results, known limitations, and ethical considerations.
The EU AI Act does not require model cards by name, but its technical documentation duties (Article 11 for high-risk systems, Article 53 for general-purpose AI models) cover much of the same ground, and procurement frameworks increasingly ask for them. A usable model card is short, specific, and honest about failure modes; vague marketing cards fail audits.
Related
The EU cybersecurity directive, Directive (EU) 2022/2555, setting risk-management and incident-reporting duties for essential and important entities in sectors such as energy, transport, banking, health, digital infrastructure and manufacturing.
NIS2 applies through national law, so scope details vary by Member State. Its core duties are the same everywhere: cybersecurity risk-management measures that include supply-chain security, an early warning within 24 hours of a significant incident, a notification within 72 hours and a final report within a month, with management bodies accountable for the measures. AI tools and their suppliers fall inside that supply chain.
A model whose trained weights are published for download, so it can run on your own infrastructure instead of through a provider’s API.
Open weights are not the same as open source: training data and code are often withheld, and licences can restrict use. Families such as Meta’s Llama, Mistral’s open models and Alibaba’s Qwen let data stay in your environment, at the price of running the hardware, the updates and the security yourself. Whether that beats an API depends on volume, data sensitivity and the team you have.
The Open Worldwide Application Security Project’s ranked list of the most impactful vulnerabilities in LLM-backed applications.
The baseline threat model any team deploying LLMs should have read. It defines the shared vocabulary between security, engineering, and procurement when discussing AI risk.
An attack in which input to an LLM, typed by a user or hidden in content the model reads, manipulates it into ignoring its instructions or exfiltrating data.
Direct (malicious user) and indirect (malicious content fetched by the model) variants both belong in the threat model. Indirect prompt injection in agentic systems is the category that keeps security teams awake.
AI systems trained, fine-tuned, or deployed on infrastructure the client owns, rather than via a third-party API.
Proprietary AI trades convenience for control over data, cost, latency, and vendor lock-in. The right choice depends on sensitivity of the data, inference volume, and how strategic the capability is to the business.
An architecture that fetches relevant documents from a knowledge base and supplies them to an LLM as context.
RAG grounds answers in sourced material and is the dominant pattern for enterprise AI over private data. A RAG system is only as good as its retrieval: bad chunks in, bad answers out.
A simple, robust method for combining ranked result lists from different retrievers, for example dense and sparse.
RRF is the workhorse fusion step in hybrid retrieval pipelines: no training required, no score calibration, and it reliably beats either retriever alone. A single hyper-parameter (k) controls how much the lower ranks contribute.
Related
The geographic region a vendor commits to store and process your data in, where that is configurable.
Two things are commonly conflated. Whether a vendor offers an EU region is a product question; whether your tenant is actually configured to use it is an account question, and the default is often not the one you would choose. Physical location also does not by itself settle lawful-access exposure where the parent company is outside the EU.
Related
The unsanctioned use of AI tools inside an organisation, typically through personal accounts, browser extensions, or embedded features of SaaS products.
Shadow AI is a common source of unreported data exposure. Inventory is the first step: you cannot govern what you cannot see. Our AI Diagnostic turns that inventory into a reproducible, indicator-level assessment.
Signing in to an application with the organisation’s central identity provider rather than a separate username and password held by the vendor.
SSO matters for AI governance less for convenience than for exit: it is what lets you see who has access and revoke it the day someone leaves. Without it, an account created with a work email on a personal card keeps working after offboarding, and nobody has a list. SSO is usually gated behind a vendor’s business tier.
An audit report assessing a service provider’s controls around security, availability, processing integrity, confidentiality, and privacy.
Widely requested by enterprise procurement when onboarding AI vendors. A Type II report (covering a period of operation) is materially stronger evidence than a Type I (point-in-time design review).
Related
A third party your vendor passes your data to in order to deliver its service, such as the cloud host it runs on or the model provider behind its features.
An AI product is often a thin layer over someone else’s model, so your data can reach a company you have never heard of and never contracted with. GDPR Article 28 requires these to be disclosed and authorised. A published, maintained sub-processor list is a reasonable proxy for a vendor that has thought about this; its absence is a gap rather than proof of a problem.
The instructions given to an LLM before user input, setting role, tone, constraints, and tool permissions.
Treat the system prompt as sensitive configuration: it defines behaviour and can be extracted by determined users. Version it, review it, and do not rely on it as a security control on its own.
Related
The process of splitting text into discrete units (tokens) that an LLM processes.
Tokenisation affects cost (most APIs price per token), context-window usage, and cross-language fairness: text in languages that tokenisers handle less efficiently, often those in non-Latin scripts or with rich morphology, typically takes more tokens for the same content. Also written as tokenization in US sources.
The capability that lets an LLM invoke structured functions (search, database queries, API calls) and read their outputs.
Tool use converts a chatbot into an agent and widens the security surface proportionally. Treat every tool registration as a permission grant and keep scopes as narrow as the task allows.
A database specialised in storing and searching high-dimensional embeddings.
Typical options include Qdrant, Weaviate, Pinecone, Milvus, and pgvector. Enterprise selection hinges on hybrid search support, metadata filtering, data residency, and operational maturity, not raw recall numbers.
Related
Dependence on a specific AI vendor’s proprietary model, APIs, or data formats such that switching is costly or impractical.
Common lock-in axes: fine-tuned weights, prompt libraries, evaluation pipelines, data egress fees, and embedded agent behaviours. Designing for portability from day one is cheaper than unwinding lock-in two years later.
A vendor setting under which prompts and outputs are processed and then discarded rather than stored, sometimes called zero data retention or ZDR.
Usually offered on API and enterprise tiers, often on request rather than by default, and frequently incompatible with features that need history. It is one of the few controls that meaningfully reduces exposure from staff pasting confidential material, so whether it is switched on, and whether that is documented, is worth establishing rather than assuming.
We keep this glossary short on purpose. If a term you care about is not here, tell us and we will add it.
Suggest a term