AI compliance glossary
18 terms buyers meet when evaluating AI compliance tools.
- EU AI Act
- The European Union regulation on artificial intelligence. It sorts AI systems by risk and sets obligations for providers and deployers, with the strictest rules for high-risk systems. Obligations apply in phases.
- High-risk AI system
- Under the EU AI Act, an AI system in a listed use area (such as employment or credit) or a safety component of a regulated product. High-risk systems carry duties such as risk management, documentation, and human oversight.
- Provider and deployer
- EU AI Act roles. A provider develops an AI system and places it on the market; a deployer uses an AI system under its own authority. Each role has different obligations.
- Conformity assessment
- The process of showing that a high-risk AI system meets EU AI Act requirements before it is placed on the market.
- ISO/IEC 42001
- An international, certifiable standard for an AI management system. An accredited certification body audits it.
- AIMS (AI management system)
- The policies, roles, processes, and controls an organization uses to manage AI responsibly, as defined by ISO/IEC 42001.
- Annex A controls (ISO/IEC 42001)
- The reference list of AI-specific control objectives and controls in ISO/IEC 42001 that an organization selects from.
- NIST AI RMF
- The voluntary AI Risk Management Framework from the US National Institute of Standards and Technology, organized into four functions: Govern, Map, Measure, and Manage.
- NYC Local Law 144
- A New York City law that requires an independent bias audit of an automated employment decision tool before use and every year after, with a published summary and notice to candidates.
- AEDT (automated employment decision tool)
- Under NYC Local Law 144, a computational tool that substantially assists or replaces discretionary decisions in hiring or promotion.
- Bias audit
- An independent statistical review of whether a tool produces different outcomes across groups, such as selection rates by sex and race or ethnicity.
- Impact ratio
- A group’s selection or scoring rate divided by the rate of the most selected group. NYC Local Law 144 bias audits report it.
- Colorado AI law (SB 24-205 / SB 26-189)
- Colorado’s law on AI and automated decision-making in consequential decisions. It was enacted in 2024 and rewritten in 2026; check the current text and effective date with counsel.
- AI impact assessment
- A documented review of how an AI system could affect people, groups, and society, and what controls reduce those effects. ISO/IEC 42001 and several laws call for one.
- AI inventory
- A register of the AI systems, models, agents, and third-party AI tools an organization builds or uses, with owners and risk levels. Most frameworks start here.
- Evidence automation
- Collecting proof that controls operate (configurations, logs, approvals) directly from connected systems instead of manual screenshots and uploads.
- SOC 2 Type II
- An independent auditor’s report on how a company’s security controls operated over a period.
- ISO/IEC 27001
- An international certification for an information security management system.