Governance Glossary

The key terms around introducing an AI management system based on ISO/IEC 42001.

All
EU AI Act
ISO 42001 & governance
AI technology
Cloud & sovereignty

EU AI Act

EU AI Act (AI Regulation): The EU regulation (Reg. 2024/1689) that regulates AI systems by their risk – the first comprehensive AI regulation worldwide. It applies in stages and imposes obligations according to risk class.
Risk classes: The AI Act divides AI into four tiers: prohibited (Art. 5), high-risk (via Annex I or III, Art. 6), limited risk (transparency obligation, Art. 50) and minimal risk. The obligations follow from the classification.
High-risk AI (Art. 6, Annex I & III): An AI system is high-risk via two routes (Art. 6): the Annex I route – it is a safety component of a product, or itself a product under the EU harmonisation legislation in Annex I (e.g. machinery, medical devices), and requires third-party conformity assessment; or the Annex III route – it falls into an area listed there (e.g. employment, education, critical infrastructure, creditworthiness, law enforcement). Consequence: strict obligations such as risk management, technical documentation and human oversight. Exception (Art. 6(3)): Annex III systems without significant risk may be exempt – but profiling always remains high-risk.
Annex III (high-risk areas): The list of stand-alone high-risk applications in the AI Act: biometrics, critical infrastructure, education, employment, access to essential (including private) services – incl. creditworthiness and insurance –, law enforcement, migration/border control, and justice and democratic processes.
Provider: Whoever develops an AI system and places it on the market under their own name. Carries the main obligations of the AI Act (conformity, documentation, reporting).
Deployer: Whoever uses an AI system under their own responsibility. Must, among other things, ensure human oversight and comply with the provider’s instructions.
GPAI (General-Purpose AI): General-purpose AI models, such as large language models. Providers of such foundation models are subject to their own transparency and documentation obligations.
Art. 50 – Transparency obligation: People must be able to recognise that they are interacting with AI or seeing AI-generated content (labelling obligation) – e.g. an AI announcement at the start of a call or a note on a chatbot.
Prohibited practices (Art. 5): AI applications the AI Act prohibits – such as social scoring by the state or manipulative systems that deliberately exploit weaknesses.
Conformity assessment: The verification procedure by which – especially for high-risk AI – it is demonstrated before market launch that the requirements of the AI Act are met.
AI literacy (Art. 4): Providers and deployers are expected to foster sufficient AI literacy among their staff – a basic understanding of the opportunities, risks and correct handling of AI. The duty has applied since February 2025. In July 2026 the Digital Omnibus changed the standard from “ensure” to “support and promote”: the requirement remains, the degree of obligation is softer. Independently of this, an AIMS under ISO/IEC 42001 requires competence and awareness in clauses 7.2 and 7.3 – there the evidence is still expected.
Fundamental-rights impact assessment (FRIA, Art. 27): Certain deployers of high-risk AI must assess the impact on the fundamental rights of affected persons before use (Fundamental Rights Impact Assessment).
Post-market monitoring (Art. 72): Providers of high-risk AI must actively monitor their system after placing it on the market and systematically evaluate findings.
Serious incidents (Art. 73): Providers must report serious incidents and malfunctions of their AI to the authorities – within defined deadlines.
CE marking & declaration of conformity: With the EU declaration of conformity and CE marking, the provider confirms that a high-risk AI system meets the requirements and may be placed on the market.

ISO/IEC 42001 & governance

ISO/IEC 42001 (AIMS): The international standard for an AI management system: it defines how an organisation governs, documents and continuously improves AI responsibly. Certifiable – Deepwraite®’s core field.
AIMS (AI Management System): The living management system for AI: roles, policies, risks, controls and evidence across an organisation’s entire use of AI – not a document, but a process.
AI coordinator (KIK): The central operational role in the AIMS: coordinates set-up and operation, maintains the documentation, manages risks and approvals (ISO/IEC 42001, Clause 5.3).
AISIA (AI System Impact Assessment): The assessment of an AI system’s impact on people, groups and fundamental rights (ISO/IEC 42001, Clause 6.1.4) – the AI-specific complement to classic risk assessment.
SoA (Statement of Applicability): The statement of applicability: which of the controls from Annex A apply – and, with justification, why individual ones do not.
Annex A controls: The catalogue of 38 controls in ISO/IEC 42001, from which an organisation selects and implements the ones suited to it.
Risk register / AI risk assessment: The structured recording and treatment of AI risks: likelihood of occurrence, impact, measure and accepted residual risk.
Guardrail: A technical or organisational guardrail that keeps an AI system on safe tracks – e.g. input filters, prompt hardening or tests against prompt injection.
Human-in-the-Loop (HiTL): The human stays in control: AI outputs are reviewed and approved, not adopted blindly. A core principle of responsible AI.
Business Judgment Rule (BJR): Liability safe harbour for company directors: a business decision made on an adequate basis of information, in good faith and without conflict of interest is protected (§ 93(1) sentence 2 AktG; recognised accordingly for GmbH managing directors). In a dispute, management has to prove that it acted with due care. An AIMS provides and documents the information basis for AI decisions. Whether it was adequate in a given case is a legal question.
ISO/IEC 27001 (distinction): The standard for information security (ISMS) – not to be confused with ISO/IEC 42001 (AI). Rule of thumb: security is not the same as AI conformity.
PDCA cycle: Plan – Do – Check – Act: the cycle of continuous improvement on which every management system – including ISO/IEC 42001 – is built.
Internal audit (Clause 9.2): The regular, independent check of whether the AIMS works as planned and meets the requirements.
Management review (Clause 9.3): The periodic assessment of the AIMS by leadership – the basis for decisions on resources, objectives and improvement.
NC/CAPA (Clause 10.2): Handling non-conformities (Clause 10.2 “Nonconformity and corrective action”): analyse the cause, initiate and document corrective actions. “CAPA” is the common industry shorthand; prevention itself is covered by the standard through risk-based thinking (Clause 6).
Impartiality / independence: Whoever builds or advises on an AIMS may not also impartially audit or certify it – build and assessment must stay separate (Clause 9.2; ISO/IEC 17021).
Maturity model (maturity check): An assessment of how far an organisation’s AI governance has developed – from a first overview to a certification-ready AIMS.

AI technology

LLM (Large Language Model): A large AI language model that understands and generates text – the “brain” of modern AI assistants.
Token: The text chunks a model breaks language into. Performance and cost are calculated in tokens.
Prompt: The instruction or question to the AI. Rule of thumb: quality in = quality out.
RAG (Retrieval-Augmented Generation): Before answering, the AI looks things up in stored documents and cites sources – the basis for reliable knowledge assistants.
Tool/Function calling: The AI triggers real actions during the dialogue – e.g. booking an appointment or calling an interface.
STT / TTS: Speech-to-text (the “ear”: speech → text) and text-to-speech (the “mouth”: text → speech) – the building blocks of a voice agent.
Voice Clone: An artificially reproduced, recognisable voice. Subject to the AI labelling obligation (Art. 50 AI Act).
Latency: The delay between input and response. On the phone, a conversation feels unnatural beyond ~800 ms.
Model Serving: A ready-made service that provides an AI model via an interface – use it without training your own.
Hallucination: When an AI model makes plausible-sounding but false or invented statements – the reason human review (HiTL) remains necessary.
Fine-Tuning: The targeted re-training of a model with your own data to sharpen it for a specific task.
Embedding / vector database: Texts are translated into number vectors and stored in a vector database – the basis for RAG to find matching sources.
Context window: The amount of text a model can keep “in view” at once. When it is full, older content drops out.
Agent / Agentic AI: An AI that plans and acts autonomously in multiple steps – using tools, taking intermediate steps, pursuing a goal (e.g. a phone or website agent).
Bias: Systematic imbalances in data or model that can lead to unfair outcomes – a core topic of AI fairness and governance.

Cloud & sovereignty

On-Prem / IaaS / PaaS / SaaS: Operating models from “everything yourself” to “just use it”: on-premises (your own house) → IaaS (rented hardware) → PaaS (platform) → SaaS (ready-made software). The closer to SaaS, the less effort – but the more data at the provider.
Sovereign cloud: Operation, control and data verifiably located in the EU/DE, without access by non-European laws (e.g. STACKIT).
Data sovereignty / data residency: Sovereignty means: you decide over your data. Residency means: where it physically sits. Both are decisive for governance and GDPR.
Data processing agreement (Art. 28 GDPR): The data processing agreement with every service provider in the data path – mandatory as soon as personal data is processed.
No-retention / no training: The provider does not store inputs and does not use them for model training – an important building block of data sovereignty.
BSI C5: A German audit catalogue for cloud security. Important, but: security is not the same as AI Act conformity – governance comes on top.
GDPR / personal data: The EU General Data Protection Regulation protects personal data. AI governance and data protection are closely intertwined – e.g. in legal basis, purpose limitation and data-subject rights.
Third-country transfer / SCC: If data is processed outside the EU, a suitable basis is needed – e.g. Standard Contractual Clauses (SCC). Without it, the transfer is legally precarious.
Encryption (at rest / in transit): Data is secured – in storage (at rest) and in transit. Basic protection for confidentiality and data sovereignty.

No term found. Try a different spelling?