AI Governance and Privacy Glossary

Acceptable use policy

A written policy that tells staff which AI tools they may use, for what purposes, and with what data.

Adverse action notice

A notice explaining why a credit application was denied or terms were changed, required under the Equal Credit Opportunity Act and Fair Credit Reporting Act.

AI agent

An AI system that can take actions, such as updating records or sending messages, rather than only answering questions.

AI governance

The policies, roles, processes, and controls an organization uses to make sure its AI is used responsibly, lawfully, and as intended.

AI impact assessment

A documented review of how an AI system affects people and decisions, what could go wrong, and which controls reduce the risk.

AI management system

The set of policies, roles, and processes ISO/IEC 42001 requires an organization to establish for governing AI.

AI register

An inventory of the AI systems an organization uses, with owners, purposes, data, risk tiers, and controls for each.

Algorithmic bias

Systematic differences in an AI system’s outcomes for different groups of people that are not justified by legitimate factors.

Annex A controls

The AI-specific controls listed in ISO/IEC 42001 that an organization selects and documents in its Statement of Applicability.

Automated decision-making technology

Technology that makes or substantially influences decisions about people, such as approvals for credit, jobs, or housing.

Business associate agreement

A HIPAA-required contract with any vendor that creates, receives, or stores protected health information for a covered entity.

Data mapping

Documenting what personal data an organization collects, where it is stored, how it is used, and who receives it.

Data protection assessment

A documented review of the privacy risks of processing personal data, required by several state privacy laws for higher-risk processing.

Deployer

Under the EU AI Act and some state laws, an organization that uses an AI system in its operations, as opposed to the provider that developed it.

Disparate impact

A practice that appears neutral but disproportionately affects a protected group, which can violate anti-discrimination laws.

EU AI Act

The European Union’s regulation classifying AI systems by risk and setting obligations for providers and deployers, phased in over several years.

Explainability

The ability to describe in understandable terms how an AI system reached a particular output or decision.

Fractional officer

A senior executive, such as a chief privacy or AI officer, who serves an organization part-time on a retainer.

Hallucination

Output from a generative AI system that sounds confident but is false or unsupported.

Human in the loop

A design in which a person reviews or approves AI outputs before they take effect.

ISO/IEC 42001

The international standard for AI management systems, published in 2023, which organizations can be certified against.

Model drift

A decline in an AI model’s accuracy over time as real-world data changes from the data it was trained on.

NIST AI Risk Management Framework

A voluntary U.S. framework from the National Institute of Standards and Technology organized around four functions: Govern, Map, Measure, and Manage.

Personal information

Information that identifies, relates to, or could reasonably be linked to a particular person, as defined by the applicable privacy law.

Prompt injection

An attack that hides instructions in content an AI system reads, causing it to ignore its rules or reveal information.

Protected health information

Health information held by a HIPAA covered entity or business associate that identifies a person.

Red teaming

Adversarial testing in which testers try to make an AI system fail, leak data, or produce harmful output.

Risk tier

A classification, such as high, medium, or low, that determines how much review and control an AI use requires.

Shadow AI

AI tools that staff use without the organization’s knowledge or approval.

Statement of Applicability

The ISO/IEC 42001 document listing which Annex A controls an organization applies and why any are excluded.

Training data

The data used to build or adjust an AI model, which determines much of how the model behaves.

Vendor AI features

AI capabilities a software vendor adds to an existing product, often turned on without a new contract.

This page is general information for planning purposes. Laws and guidance change, so confirm current requirements before acting. It is not legal advice. For legal advice about your organization, consult a licensed attorney.