AI glossary.
Words that often come up when organisations talk about AI. Explained briefly and plainly.
By theme
Basics
Security and regulation
- Access control
- AI literacy
- Anonymisation
- CLOUD Act
- Data classification
- Data leakage (exfiltration)
- Data processor
- Data protection impact assessment (DPIA)
- Deepfake and voice cloning
- DORA
- EU AI Act
- EU-US Data Privacy Framework
- Explainable AI
- Extraterritorial law
- FISA Section 702
- Four-eyes principle
- GDPR and AI
- High-risk AI
- Least privilege
- Multi-factor authentication (MFA)
- NIS2
- Prompt injection
- Pseudonymisation
- Red teaming
- SBOM and AI-BOM
- Schrems II
- Shadow AI
- Single sign-on (SSO)
- Supply chain attack
- Third-country transfer
Operations
A–Z
A
- Access control Access control decides who may see which information, and in an AI system it decides which documents an answer may build on.
- AI AI, artificial intelligence, means computer systems doing tasks that normally need human judgement, such as understanding language or finding patterns in data.
- AI agent An AI agent is an AI system that carries out a multi-step task on its own, for example by searching, using other systems and making small decisions on the way.
- AI assistant An AI assistant is an AI tool that answers questions and helps with text in a dialogue with the user.
- AI literacy AI literacy is the knowledge needed to use AI in an informed way, and the EU AI Act requires organisations to work on it.
- AI policy and AI governance An AI policy describes how an organisation may use AI, and AI governance is the work with roles, decisions and follow-up that makes sure the policy is followed.
- Air gap and offline An air-gapped system has no connection at all to the internet or other outside networks, and offline AI is AI that works without an internet connection.
- Anonymisation Anonymisation is processing data so that no person can be identified any longer, directly or indirectly, with no way back.
- Audit log An audit log is a chronological record of who did what in a system and when, kept so that it can be reviewed afterwards.
B
C
- Chatbot A chatbot is a program that holds a conversation in text, for example to answer common questions on a website.
- CLOUD Act The CLOUD Act is a US law from 2018 under which US providers may have to disclose data they control, even when that data is stored outside the United States.
- Context window The context window is the amount of text a language model can take into account at once, measured in tokens.
D
- Data classification Data classification, often called information classification, means sorting information by how much protection it needs, so the right safeguards can be chosen.
- Data leakage (exfiltration) Data leakage is when information leaves the organisation or reaches people who should not have it, by mistake or through a deliberate act.
- Data processor A data processor is someone who processes personal data on behalf of another organisation and on its instructions.
- Data protection impact assessment (DPIA) A data protection impact assessment, DPIA, is an analysis of risks to the people concerned required before processing likely to involve high risk begins.
- Data sovereignty Data sovereignty is about an organisation keeping control of its data, including which laws apply to it and who can gain access to it.
- Deep learning Deep learning is machine learning with neural networks in many layers, able to learn complex patterns in text, images and sound.
- Deepfake and voice cloning A deepfake is image, audio or video content created or manipulated with AI so that it resembles a real person or event and may be taken as genuine.
- DORA DORA is the EU regulation on digital operational resilience for the financial sector, which has applied since 17 January 2025.
E
- Embedding An embedding is a long series of numbers that describes what a piece of text means, so that texts with similar content end up close to each other.
- EU AI Act The EU AI Act is the EU's law on artificial intelligence, which regulates AI systems according to how much risk their use involves.
- EU-US Data Privacy Framework The EU-US Data Privacy Framework is a European Commission decision that allows personal data to be transferred to US organisations that have signed up to it.
- Explainable AI Explainable AI is methods and systems that make it possible to understand why an AI arrived at a particular result.
- Extraterritorial law Extraterritorial law is law that a country applies to people, companies or data beyond its own borders.
F
- Fine-tuning Fine-tuning is when an existing AI model is trained further on your own examples to change how it answers.
- FISA Section 702 FISA Section 702 is a US provision on intelligence gathering aimed at people outside the United States, carried out with the help of US communication providers.
- Four-eyes principle The four-eyes principle means that a sensitive change or action needs approval from two people.
G
H
- Hallucination A hallucination is when AI gives an answer that sounds credible but is wrong or made up.
- High-risk AI High-risk AI is AI systems that under the EU AI Act can significantly affect people's health, safety or rights, and therefore face stricter requirements.
- Human oversight Human oversight means that a person can follow, review and when needed stop or change what an AI system does.
I
K
L
- Language model (LLM) A language model, often called an LLM for large language model, is an AI model trained on large amounts of text to understand and write language.
- Least privilege Least privilege is the principle that a user, a system or an AI agent should have only the access the task requires.
- Local AI Local AI is AI that runs on the organisation's own computers or servers, so questions and documents do not need to be sent to an external service.
M
- Machine learning Machine learning is the part of AI where a system learns from examples in data instead of following rules someone has written by hand.
- MCP (Model Context Protocol) MCP, the Model Context Protocol, is an open protocol that describes how AI applications connect to tools, data and other systems.
- Multi-factor authentication (MFA) Multi-factor authentication means that a user proves who they are in more than one way, for example with a password and a code from an app on their phone.
- Multimodal AI Multimodal AI can handle several kinds of content, such as text, images and speech, and connect them in the same task.
N
O
- On-premises installation An on-premises installation means the software runs on the organisation's own servers or in its own environment instead of at the supplier.
- Open models Open models are AI models whose weights have been published, so that others can download them and run them in their own environment.
P
- Prompt A prompt is the question or instruction you give an AI service.
- Prompt engineering Prompt engineering is the craft of phrasing instructions to AI so that the answers become more accurate and useful.
- Prompt injection Prompt injection is an attack in which text that a language model reads makes it follow instructions that neither the user nor the system intended.
- Pseudonymisation Pseudonymisation is processing personal data so that it can no longer be linked to a specific person without additional information kept separately.
R
- RAG RAG, retrieval-augmented generation, is a method where AI first retrieves relevant passages from your documents and then writes the answer from those passages.
- Red teaming Red teaming is when a group deliberately attacks a system the way an adversary would, in order to find its weaknesses before anyone else does.
S
- Sandbox A sandbox is a confined environment in which software or AI can run without being able to affect other systems or data.
- SBOM and AI-BOM An SBOM is a machine-readable inventory of the components a piece of software is built from, and an AI-BOM is a similar inventory extended to models and data.
- Schrems II Schrems II is the 2020 EU Court of Justice ruling that annulled the Privacy Shield, the framework then used for transfers of personal data to the United States.
- Shadow AI Shadow AI is AI tools that staff use at work without the organisation having approved them or knowing about it.
- Single sign-on (SSO) Single sign-on means that a user signs in once and can then reach several systems with the same account.
- Source citation A source citation shows which document and section an AI answer builds on, so that the reader can check it.
- Speech recognition Speech recognition is AI that turns speech into text, for example when someone dictates a note.
- Supply chain attack A supply chain attack is one in which the attacker reaches the target through a supplier, a component or a tool the target already trusts.
- System prompt A system prompt is an instruction that applies in the background to every conversation with an AI service, steering tone, rules and what it should stick to.
T
- Third-country transfer A third-country transfer is when personal data is transferred to a country outside the EU and EEA, which is only allowed under certain conditions.
- Token A token is the smallest piece of text a language model reads and writes, often a short word or part of a longer word.
- Tool calling Tool calling is when a language model asks a program to carry out a function, such as searching a system, fetching a file or sending a message.
- Training data Training data is the data an AI model has learned from, such as text, images or sound.
- Transformer A transformer is a type of neural network that weighs how all the words in a text relate to each other, and it underlies most modern language models.
V
No terms match the search.