Glossary

This glossary collects the vocabulary of AI Governance: European regulation, governance and assurance practice, the architecture profession, and the AI terms a governance reader needs. Where a term has a legal definition in Regulation (EU) 2024/1689 (the AI Act) or another instrument, the definition follows the legal text and names the article; where it is a working concept of this book, the definition points to the chapter that develops it.

A

Adversarial testing — Deliberate attempts to make a model or system fail, leak or misbehave through crafted inputs such as prompt injection or poisoned data. Article 55 of the AI Act requires it for general-purpose AI models with systemic risk; Chapter 19 shows why the conditions of such testing must themselves be governed.

Agent — A system in which a model directs its own sequence of tool calls towards a goal, within boundaries set by the architecture. The term names a control pattern, not a form of understanding; see Modes 3 and 5 in Chapter 2 and Principle 7 in Chapter 4.

Agentic work tool — Mode 3: an agent that runs a model in a loop with tools on a workstation, in a repository or in a sandbox, with a human delegating the task and reviewing the result. See Chapter 2.

AI Act — Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence. It classifies AI systems by risk, assigns obligations to providers, deployers, importers and distributors, and regulates general-purpose AI models separately.

AI Architecture — The discipline of designing, governing and operating AI systems as codified, evidence-producing architecture, extending Architecture as Code to systems whose central component is derived from data. AI Governance treats its governance side.

AI Decision Record (AIDR) — An Architecture Decision Record extended with intended purpose, risk classification, data sources, evaluation criteria, human oversight and retirement criteria. Chapter 9 places it at the intake gate.

AI gateway — A control point through which every model call passes, enforcing authentication, policy, rate limits, logging, cost attribution and routing.

AI inventory — The authoritative register of every AI system and model an organisation provides or deploys, with purpose, risk class, owner and lifecycle status. It underpins the registration duties of Article 49 of the AI Act.

AI literacy — The skills and understanding that allow staff to use AI with awareness of its opportunities and risks. Article 4 of the AI Act requires providers and deployers to take measures to support it.

AI management system — The policies, roles, processes and controls through which an organisation directs its use of AI, as specified in ISO/IEC 42001.

Algorithm register — A public catalogue in which a public authority describes the algorithmic systems it uses, their purpose, data and safeguards. Chapter 17 codifies an entry.

ALTAI — The European Commission High-Level Expert Group's Assessment List for Trustworthy Artificial Intelligence, a self-assessment questionnaire based on its seven requirements.

Ambient AI — Mode 0: AI that people meet without having chosen it, such as generated search summaries or features suppliers switch on in licensed software. See Chapter 2.

Annex III — The annex of the AI Act listing high-risk use cases, including biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration and justice.

Annex IV — The annex of the AI Act specifying the technical documentation required under Article 11. Chapter 11 generates it from the architecture repository.

Architecture as Code — The discipline, and the title of the first book in the series, in which architecture is expressed as executable, version-controlled artefacts.

Architecture Decision Record (ADR) — A short, structured record of the context, decision and consequences of a significant architectural choice.

Architecture repository — The version-controlled store of models, decision records, model cards, policies and evidence that is a system's single source of truth.

Autonomous production agent — Mode 5: an agent that acts on business systems without a human approving each step, within a mandate, limits and a stop path set by humans. See Chapter 2.

B

Bounded autonomy — The principle that an agent may act without approval only within declared limits on tools, data, budgets and escalation.

Built AI application — Mode 4: a system in which the organisation integrates a model into its own systems and owns the lifecycle, often becoming its provider under the AI Act. See Chapter 2.

C

CE marking — The mark a provider affixes to a high-risk AI system after a successful conformity assessment (Article 48); architecturally, the end of an evidence chain.

Concept drift — A change in the relationship between a model's inputs and what it predicts, so that accuracy falls although the inputs look unchanged. Compare data drift.

Confidential computing — Processing data inside hardware-isolated, attested environments that the infrastructure operator cannot read.

Conformity assessment — The process of demonstrating that a high-risk AI system meets the requirements of Chapter III, Section 2 of the AI Act (Article 43), through internal control or a notified body.

Conversational assistant — Mode 1: a general-purpose chat interface to a model, with nothing taking effect until a person acts on the output. See Chapter 2.

Cost envelope — What an organisation has decided it will spend on an AI system in a period, as distinct from the forecast, with soft and hard thresholds and a named budget owner (Chapter 16A).

Cyber Resilience Act — Regulation (EU) 2024/2847 on cybersecurity requirements for products with digital elements, including software with AI components.

D

Data Act — Regulation (EU) 2023/2854 on fair access to and use of data, including switching between data processing services.

Data contract — A version-controlled agreement between a data producer and its consumers fixing schema, quality, freshness, lawful basis and ownership.

Data drift — A change in the distribution of a model's input data compared with its training or validation data, detectable without labels. Compare concept drift.

Data Governance Act — Regulation (EU) 2022/868 on data intermediation, data altruism and re-use of protected public-sector data.

Data lineage — The recorded path of data from origin through every transformation to its use, which makes reproducibility possible.

Data poisoning — An attack that manipulates training, fine-tuning or retrieval data so that a model learns or retrieves attacker-chosen behaviour.

Data space — A federated arrangement in which organisations share data under common rules without centralising it, such as the common European data spaces for health and mobility.

Datasheet — A structured description of a dataset's motivation, composition, collection, uses and maintenance, the data counterpart of a model card.

Deployer — Under Article 3(4) of the AI Act, a natural or legal person, public authority, agency or other body using an AI system under its authority, except for personal non-professional use.

Digital sovereignty — The ability of European organisations to control their data, infrastructure and models without undue dependence on actors outside their jurisdiction.

DORA — Regulation (EU) 2022/2554 on digital operational resilience for the financial sector, covering ICT risk, incident reporting, resilience testing and third-party risk.

DPIA — A data protection impact assessment under Article 35 of the GDPR, required when processing is likely to result in a high risk to people's rights; AI on personal data almost always triggers one.

E

Embedded workplace assistant — Mode 2: an assistant inside the office suite that reads and acts on mail, documents, calendars and chats with the user's own permissions. See Chapter 2.

Embedding — A numeric vector representing the meaning of an input, so that semantic similarity becomes measurable as distance.

Evaluation — The structured measurement of a model's or system's quality against defined criteria and datasets. This book reserves "testing" for software tests.

Evaluation gate — A pipeline stage that blocks promotion unless evaluation results meet declared thresholds.

Ethical Impact Assessment (EIA) — UNESCO's tool for judging an individual AI system against its Recommendation on the Ethics of Artificial Intelligence, before and during use.

Evidence as code — Generating, storing and verifying compliance evidence automatically from pipelines and runtime systems, so that audit material is a by-product of delivery (Chapter 11).

Explainability — The degree to which a model's or system's behaviour can be described in terms meaningful to a person. Article 13 of the AI Act requires transparency sufficient for deployers to interpret output.

F

Fairness metric — A measure of how outcomes differ across groups, such as demographic parity or equalised odds. The metrics conflict, so choosing one is a recorded decision.

Feature store — A managed repository of curated model inputs that serves consistent values for training and inference.

Fine-tuning — Adapting a pre-trained model by further training on task-specific data. It changes the weights and therefore triggers re-evaluation and, in some cases, provider obligations.

FinOps — The FinOps Foundation's framework for maximising the business value of technology through financial accountability shared by engineering, finance and business; Chapter 16A applies it to AI spending.

Foundation model — A large model trained on broad data and adaptable to many tasks; the AI Act's term is general-purpose AI model.

FRIA — A fundamental rights impact assessment, required by Article 27 of the AI Act before bodies governed by public law, private operators of public services and certain credit and insurance deployers use a high-risk AI system.

G

Gaia-X — A European initiative defining rules, labels and federation services for trustworthy data and cloud infrastructure.

GDPR — Regulation (EU) 2016/679, the General Data Protection Regulation, whose Articles 5, 6, 9 and 22 constrain every AI system that touches personal data.

General-purpose AI model — Under Article 3(63) of the AI Act, an AI model that displays significant generality, can perform a wide range of distinct tasks and can be integrated into a variety of downstream systems.

Golden dataset — A curated, versioned set of inputs with agreed expected outputs or rubrics, the stable reference for evaluation.

GPAI Code of Practice — The voluntary code under Article 56 of the AI Act that helps providers of general-purpose AI models demonstrate compliance with Articles 53 and 55.

Grounding — Constraining output to verifiable source material, typically through retrieval and citation. It reduces, but does not eliminate, hallucination.

Guardrail — A control that constrains model inputs or outputs, such as filters, classifiers or schema enforcement, kept in version control and tested like any other control.

H

Hallucination — Fluent, plausible output that is fabricated or unsupported by any source.

High-risk AI system — An AI system within Annex I or Annex III of the AI Act, subject to the requirements of Chapter III, Section 2.

Human oversight — The measures under Article 14 of the AI Act that allow people to understand, monitor, interrupt and override a high-risk AI system.

Human-in-the-loop, on-the-loop, in-command — Oversight patterns in which a person approves each decision, monitors and can intervene, or sets the system's boundaries (Chapter 10).

I

Interoperable Europe Act — Regulation (EU) 2024/903 on public-sector interoperability across the Union (Chapter 17).

Investment and value record — A version-controlled record beside a use case's portfolio entry naming the budget and benefit owners, cost envelope, unit of value and baseline, realised benefit, stop conditions and review cadence; every investment gate reads it (Chapter 16A).

ISO/IEC 23894 — The international standard giving guidance on AI risk management, aligned with ISO 31000 (Chapter 8).

ISO/IEC 42001 — The international standard for an AI management system (Chapter 9).

L

Large language model (LLM) — A neural network trained on very large text corpora to generate language and, increasingly, other modalities.

LLM-as-a-judge — Evaluation in which one model grades another's output against a rubric; it must be calibrated against human judgement.

M

Management as Code — Expressing portfolios, objectives and steering reports as version-controlled data, introduced in Architecture as Code and applied to AI in Chapter 16.

MITRE ATLAS — A knowledge base of adversary tactics and techniques against AI systems, modelled on MITRE ATT&CK.

Model card — A short document describing a model's intended use, training data, evaluation results and limitations.

Model Context Protocol (MCP) — An open protocol that standardises how applications expose tools, resources and prompts to models; MCP servers need the same permission discipline as any API.

Model registry — The versioned store of approved models with their lineage, evaluation results, approval status and deployment history.

N

NIS 2 — Directive (EU) 2022/2555, which imposes cybersecurity risk management and incident reporting duties on essential and important entities.

Notified body — A conformity assessment body designated under the AI Act to assess certain high-risk AI systems (Articles 28 to 39).

O

Open-weight model — A model whose trained parameters are published for local use. Open weights enable sovereign hosting but do not on their own meet the Open Source AI Definition.

OWASP Top 10 for LLM applications — The Open Worldwide Application Security Project's list of the main security risks to applications built on language models.

P

Policy as code — Machine-readable governance rules that pipelines and runtimes evaluate automatically.

Post-market monitoring — The system a provider of a high-risk AI system must operate under Article 72 of the AI Act to analyse performance throughout the system's lifetime.

Prohibited practices — The AI uses banned by Article 5 of the AI Act, including harmful manipulation, social scoring and most real-time remote biometric identification for law enforcement.

Prompt — The instructions, examples and context given to a model; prompts are configuration, versioned and evaluated like code.

Prompt injection — An attack in which instructions in user input or in retrieved content cause a model to deviate from its intended behaviour.

Provider — Under Article 3(3) of the AI Act, a person or body that develops an AI system or general-purpose AI model, or has one developed, and places it on the market or puts it into service under its own name. A deployer that substantially modifies a high-risk system can become its provider (Article 25).

R

Readiness Assessment Methodology (RAM) — UNESCO's 2023 country-level instrument for assessing how prepared a state is to deploy AI ethically; it informs Chapter 5 and Appendix B.

Red teaming — Structured adversarial evaluation in which a team attempts to make a system fail, leak or misbehave and documents what it finds.

Retrieval-augmented generation (RAG) — An architecture that supplies retrieved documents to a model as context so that output is grounded in the organisation's own material.

Risk register — The maintained list of risks with assessment, owners, treatments and status, kept by Chapter 8 as a version-controlled file.

S

Schrems II — The 2020 judgment of the Court of Justice of the European Union in Case C-311/18, which invalidated the EU–US Privacy Shield.

Serious incident — Under Article 3(49) of the AI Act, an incident or malfunction leading to death or serious harm to health, serious and irreversible disruption of critical infrastructure, infringement of fundamental rights obligations, or serious harm to property or the environment. Article 73 sets the reporting duties.

Shadow AI — AI used without the knowledge or approval of governance functions; an anti-pattern in Chapter 20.

Software Carbon Intensity (SCI) — The Green Software Foundation's specification, standardised as ISO/IEC 21031, for software carbon emissions per functional unit.

Synthetic data — Data generated by a model or simulation rather than collected from the world; it inherits the generator's biases.

System card — Documentation of a compound AI system (models, retrieval, tools, guardrails and oversight) rather than a single model (Chapter 11).

Systemic risk — Under Article 3(65) of the AI Act, a risk specific to the high-impact capabilities of general-purpose AI models with a significant effect on the Union market or on public health, safety, security or fundamental rights.

T

Token economics — In the FinOps Foundation's usage, the metering and attribution of AI consumption in tokens, the unit providers bill for; unrelated to cryptocurrency (Chapter 16A).

Tool use — The mechanism by which a model invokes external functions or data sources, which makes it a subject of access control.

Transparency obligations — The duties in Article 50 of the AI Act to tell people when they interact with AI, mark synthetic content and disclose deepfakes.

U

UNESCO Recommendation on the Ethics of Artificial Intelligence — The first global standard on AI ethics, adopted in November 2021, implemented through the Readiness Assessment Methodology and the Ethical Impact Assessment.

Unit of value — The unit of service or outcome, such as a claim correctly routed, against which an AI system's cost and benefit are measured, with a baseline and a quality constraint (Chapter 16A).

Usage mode — One of the six patterns for using large language models defined in Chapter 2: ambient AI, conversational assistants, embedded workplace assistants, agentic work tools, built AI applications and autonomous production agents. See Chapter 2.

V

Vector index — A service that stores embeddings and answers nearest-neighbour queries; as a copy of the organisation's content, it is a data protection asset in its own right.