Glossary of common terms

Plain-English definitions, each tied to the regulation that uses the term so you can use the right word in the right room.

Core terms

• AI system — EU AI Act Art. 3(1): a machine-based system that infers from inputs how to generate outputs that influence environments. Rules-based scripts are out; LLM apps, ML classifiers and agentic systems are in.
• High-risk AI system — EU AI Act Annex III: HR screening, credit scoring, education access, critical infrastructure, law enforcement and similar. Triggers Arts 9–15 obligations.
• General-purpose AI (GPAI) model — EU AI Act Art. 3(63): models trained on broad data, capable of many tasks (GPT-4o, Claude 3.5, Gemini 1.5/2.0, Llama 3.x).
• Foundation model — informal industry term, largely synonymous with GPAI.
• Automated decision — GDPR Art. 22: a decision producing legal or similarly significant effects, taken without meaningful human involvement. Triggers a right to human review.
• Substantial modification — EU AI Act Art. 3(23): a change that affects compliance or intended purpose. Fine-tuning a high-risk model usually qualifies.
• Provider vs deployer — EU AI Act Arts 16 vs 26. If you put your name on the system, you are usually the provider; if you only use it, you are a deployer. Different obligations.
• Red-team — adversarial testing for safety, security and policy violations. OWASP LLM Top 10 2025 is the de facto checklist.
• Eval — automated test of model quality on a fixed dataset. Common harnesses: OpenAI Evals, HELM, lm-eval-harness, Giskard.
• DLP for AI — data-loss prevention applied to prompts and outputs. Microsoft Purview, Netskope GenAI, Zscaler GenAI Protection are the leaders.

Do this Monday

Run a search-and-replace on your AI policy: replace "algorithm" with "AI system" wherever Art. 3(1) applies. Reviewers notice.