Glossary

This glossary collects the vocabulary of AI Platform and Security; governance terms used only in AI Governance are defined there. Legal definitions follow the instrument and name the article; working concepts point to the chapter that develops them.

A

Adversarial testing — Deliberate attempts to make a model or system fail, leak, or misbehave through crafted inputs such as prompt injection or poisoned data. Article 55 of the AI Act requires it for general-purpose AI models with systemic risk.

Agent — A system in which a model directs its own sequence of tool calls towards a goal, within boundaries set by the architecture. The term names a control pattern, not a form of understanding (Chapter 11).

Agentic work tool — Mode 3 of the usage modes: an agent that runs a model in a loop with tools on a workstation, in a repository, or in a cloud sandbox. See Chapter 2.

AI Act — Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence. It classifies AI systems by risk and assigns obligations by role.

AI Architecture — The discipline of designing, governing, and operating AI systems as codified, evidence-producing architecture, extending Architecture as Code to systems whose central component is derived from data.

AI Decision Record (AIDR) — An Architecture Decision Record extended with intended purpose, risk classification, data sources, evaluation criteria, human oversight, and retirement criteria (Chapter 5).

AI gateway — A control point through which every model call passes, enforcing authentication, policy, rate limits, logging, cost attribution, and routing.

AI inventory — The authoritative register of every AI system and model an organisation provides or deploys, with purpose, risk class, owner, and lifecycle status.

AI literacy — Under Article 3(56) of the AI Act, the skills, knowledge and understanding that allow providers, deployers and affected persons to make an informed deployment of AI systems and to gain awareness of their opportunities and risks (1, European Union, 2024). Article 4, as replaced by Regulation (EU) 2026/1744, requires providers and deployers to take measures to support the AI literacy of their staff (23, European Union, 2026).

AI management system — The policies, roles, processes, and controls through which an organisation directs its use of AI, as specified in ISO/IEC 42001 (AI Governance, Chapter 9).

Algorithm register — A public catalogue in which a public authority describes the algorithmic systems it uses, their purpose, data, and safeguards; the Dutch national register is the best-known example.

Ambient AI — Mode 0 of the usage modes: AI that people meet without choosing it, such as features suppliers switch on in licensed software. See Chapter 2.

Annex III — The annex of the AI Act listing high-risk use cases, such as employment, essential services, and law enforcement.

Annex IV — The annex of the AI Act specifying the technical documentation a provider of a high-risk AI system must draw up under Article 11.

Architecture as Code — The discipline, and the title of Book 1 of The Transformed Architecture, that expresses architecture as executable, version-controlled artefacts.

Architecture Decision Record (ADR) — A short document capturing the context, decision, and consequences of a significant architectural choice.

Architecture repository — The version-controlled store of models, decision records, policies, and evidence that is the single source of truth for a system.

Autonomous production agent — Mode 5 of the usage modes: an agent that acts on business systems without a human approving each step, within a mandate, limits, and a stop path set by humans. See Chapter 2.

B

Bounded autonomy — The principle that an agent may act without approval only within declared limits: permitted tools, data scopes, budgets, and escalation rules.

Built AI application — Mode 4 of the usage modes: a system in which the organisation integrates a model into its own systems and owns the full lifecycle, often becoming its provider under the AI Act. See Chapter 2.

C

Concept drift — A change in the relationship between a model's inputs and what it predicts, so that an accurate model becomes inaccurate although the inputs look unchanged. Compare data drift.

Confidential computing — Processing data inside hardware-isolated, attested execution environments that the infrastructure operator cannot read.

Conformity assessment — The process of demonstrating that a high-risk AI system meets the requirements of Chapter III, Section 2 of the AI Act (Article 43), through internal control or a notified body.

Context window — The maximum number of tokens a model can process in one request, including output; a hard constraint and a cost driver.

Conversational assistant — Mode 1 of the usage modes: a general-purpose chat interface into which the human brings context and from which nothing takes effect until a person acts. See Chapter 2.

Cyber Resilience Act — Regulation (EU) 2024/2847 on cybersecurity requirements for products with digital elements, including software with AI components.

D

Data Act — Regulation (EU) 2023/2854 on fair access to and use of data, including switching between data processing services.

Data contract — A version-controlled agreement between a data producer and its consumers fixing schema, quality thresholds, freshness, lawful basis, and ownership.

Data drift — A change in the distribution of a model's input data compared with its training or validation data. It is detectable without labels.

Data Governance Act — Regulation (EU) 2022/868 on data intermediation services, data altruism, and the re-use of protected public-sector data.

Data lineage — The recorded path of data from its origin through every transformation to its use in training, evaluation, or inference; the basis of reproducibility.

Data poisoning — An attack that manipulates training, fine-tuning, or retrieval data so that a model learns or retrieves attacker-chosen behaviour.

Data space — A federated arrangement in which organisations share data under common rules for identity, usage control, and interoperability without centralising it.

Datasheet — A structured description of a dataset's composition, collection, uses, and maintenance; the data counterpart of a model card.

Deployer — Under Article 3(4) of the AI Act, a natural or legal person, public authority, agency, or other body using an AI system under its authority, except for personal non-professional use.

Digital sovereignty — The ability of European organisations to control their data, infrastructure, and models without undue dependence on actors outside their jurisdiction.

DORA — Regulation (EU) 2022/2554 on digital operational resilience for the financial sector, covering ICT risk, incidents, testing, and third-party risk.

DPIA — A data protection impact assessment, required by Article 35 of the GDPR when processing is likely to result in a high risk to the rights and freedoms of natural persons.

E

Embedded workplace assistant — Mode 2 of the usage modes: an assistant inside the office suite that reads and acts on mail, documents, and chats with the user's own permissions. See Chapter 2.

Embedding — A numeric vector representing the meaning of an input, so that semantic similarity becomes measurable as distance.

Evaluation — The structured measurement of a model's or system's quality against defined criteria and datasets; this book reserves "testing" for software tests.

Evaluation gate — A pipeline stage that blocks promotion of a model, prompt, or configuration unless evaluation results meet declared thresholds.

Evidence as code — Generating, storing, and verifying compliance evidence automatically from pipelines and runtime systems, so that audit material is a by-product of delivery (AI Governance, Chapter 11).

F

Fairness metric — A measure of how a model's outcomes differ across groups, such as demographic parity; the choice is a recorded decision.

Feature store — A repository of curated model input variables that serves consistent values for training and inference. Compare vector index.

Fine-tuning — Adapting a pre-trained model through additional training on task-specific data. It changes the weights and therefore triggers re-evaluation.

FinOps — Financial accountability for variable cloud spend; for AI it covers token economics, accelerator capacity, and chargeback.

Foundation model — A large model trained on broad data that can be adapted to many tasks; the AI Act's term for this class is general-purpose AI model.

FRIA — A fundamental rights impact assessment, required by Article 27 of the AI Act before bodies governed by public law, private operators providing public services, and certain credit and insurance deployers use a high-risk AI system.

G

Gaia-X — A European initiative defining rules, labels, and federation services for trustworthy, interoperable data and cloud infrastructure.

GDPR — Regulation (EU) 2016/679, the General Data Protection Regulation.

General-purpose AI model — Under Article 3(63) of the AI Act, an AI model that displays significant generality, performs a wide range of distinct tasks, and can be integrated into a variety of downstream systems.

Golden dataset — A curated, versioned set of inputs with agreed expected outputs or rubrics, used as the stable reference for evaluation.

GPAI Code of Practice — The voluntary code under Article 56 of the AI Act that helps providers of general-purpose AI models demonstrate compliance with Articles 53 and 55.

Grounding — Constraining a model's output to verifiable source material, typically through retrieval and citation. It reduces, but does not eliminate, hallucination.

Guardrail — A control that constrains model inputs or outputs, versioned and tested like any other control.

H

Hallucination — Fluent, plausible model output that is fabricated or unsupported by any source.

High-risk AI system — An AI system classified as high-risk under Article 6 of the AI Act, either as a safety component of, or itself, a product covered by the Union harmonisation legislation in Annex I, or by falling within a use case listed in Annex III, and therefore subject to the requirements of Chapter III, Section 2.

Human oversight — The measures under Article 14 of the AI Act that allow natural persons to understand, monitor, interrupt, and override a high-risk AI system.

Human-in-the-loop, on-the-loop, in-command — Oversight patterns in which a person approves each decision, monitors and can intervene, or sets the boundaries of operation (AI Governance, Chapter 10).

I

Interoperable Europe Act — Regulation (EU) 2024/903 on public-sector interoperability across the Union.

ISO/IEC 42001 — The international standard for an AI management system.

L

Large language model (LLM) — A neural network trained on very large text corpora to generate language and, increasingly, other modalities.

LLM-as-a-judge — An evaluation technique in which a language model grades another model's output against a rubric; it must be calibrated against human judgement.

LoRA — Low-rank adaptation, a fine-tuning method that trains small adapter matrices that are easy to version and swap.

M

Management as Code — Expressing management artefacts such as portfolios and steering reports as version-controlled data consumed by pipelines, as introduced in Architecture as Code.

MITRE ATLAS — A knowledge base of adversary tactics and techniques against AI systems, modelled on MITRE ATT&CK.

Model card — A short document describing a model's intended use, training data, evaluation results, and limitations.

Model Context Protocol (MCP) — An open protocol that standardises how applications expose tools, resources, and prompts to models; Chapter 11 subjects MCP servers to the same permission discipline as any API.

Model registry — The versioned store of approved models with their lineage, evaluation results, approval status, and deployment history.

Model routing — Directing each request to the most appropriate model by task, data sensitivity, cost, and latency (Chapter 22).

N

NIS 2 — Directive (EU) 2022/2555 on a high common level of cybersecurity, imposing risk management and incident reporting duties on essential and important entities.

Notified body — A conformity assessment body designated under the AI Act to carry out third-party assessment of certain high-risk AI systems (Articles 28 to 39).

O

Open-weight model — A model whose trained parameters are published for download and local use. Open weights enable sovereign hosting but do not on their own satisfy the Open Source AI Definition.

OWASP Top 10 for LLM applications — The list of the most significant security risks to applications built on language models, including prompt injection and excessive agency.

P

Policy as code — Machine-readable governance rules that pipelines and runtimes evaluate automatically.

Post-market monitoring — The system a provider of a high-risk AI system must establish under Article 72 of the AI Act to collect and analyse performance data throughout the system's lifetime.

Prohibited practices — The AI uses banned by Article 5 of the AI Act, including harmful manipulation, social scoring, and most real-time remote biometric identification for law enforcement.

Prompt — The instruction text, examples, and retrieved context given to a model; configuration that is versioned, reviewed, and evaluated like code.

Prompt injection — An attack in which instructions embedded in user input (direct) or in retrieved content (indirect) cause a model to deviate from its intended behaviour.

Provider — Under Article 3(3) of the AI Act, a natural or legal person, public authority, agency, or other body that develops an AI system or general-purpose AI model, or has one developed, and places it on the market or puts it into service under its own name or trademark. A deployer that substantially modifies a high-risk system can become its provider (Article 25).

R

Red teaming — Structured adversarial evaluation in which a team attempts to make a system fail, leak, or misbehave.

Retrieval-augmented generation (RAG) — An architecture in which relevant documents are retrieved, typically from a vector index, and supplied to the model as context.

Risk register — The maintained list of identified risks with their assessment, owners, treatments, and status, kept as a version-controlled file.

S

Schrems II — The 2020 judgment of the Court of Justice of the European Union in Case C-311/18, which invalidated the EU–US Privacy Shield and required case-by-case assessment of third-country transfers.

Serious incident — Under Article 3(49) of the AI Act, an incident or malfunction leading to death or serious harm to health, serious and irreversible disruption of critical infrastructure, infringement of fundamental rights obligations, or serious harm to property or the environment; Article 73 sets the reporting duties.

Shadow AI — AI tools used within an organisation without the knowledge or approval of its governance functions.

Software Carbon Intensity (SCI) — The Green Software Foundation specification, standardised as ISO/IEC 21031, for the carbon emissions of software per functional unit (Chapter 22).

Synthetic data — Data generated by a model or simulation rather than collected. It eases privacy and scarcity constraints but inherits the generator's biases.

System card — Documentation of a compound AI system, covering models, retrieval, tools, guardrails, and oversight, rather than a single model (Chapter 5).

Systemic risk — Under Article 3(65) of the AI Act, a risk specific to the high-impact capabilities of general-purpose AI models with a significant effect on the Union market or on public health, safety, security, or fundamental rights; models above the compute threshold in Article 51 are presumed to carry it.

T

Tool use — The mechanism by which a model invokes external functions, APIs, or data sources, making it an actor subject to access control.

Transparency obligations — The duties in Article 50 of the AI Act to tell people when they interact with an AI system, to mark synthetic content, and to disclose deepfakes.

U

Usage mode — One of six architectural patterns for using large language models defined in Chapter 2: ambient AI, conversational assistants, embedded workplace assistants, agentic work tools, built AI applications, and autonomous production agents. See Chapter 2.

V

Vector index — A service that stores embeddings and answers nearest-neighbour queries; as the retrieval component of RAG it holds a copy of the organisation's content and is a data protection and security asset.