AI governance glossary
Key terms from this course, in plain English.
- Acceptable use policy (AUP)
- Rules for staff on which AI tools may be used, with what data, and how.
- AI governance
- The structures, policies, processes and controls that ensure AI is used in line with values, risk appetite and law.
- AI impact assessment (AIIA)
- An assessment of an AI system's potential impacts on individuals, groups and society (see ISO/IEC 42005).
- AI incident
- An event where an AI system causes or nearly causes harm, such as a harmful output, discriminatory outcome, data leak or malfunction.
- AI inventory
- A register of all AI systems an organisation develops, buys or uses, with owners, purposes and risk classifications.
- AI management system (AIMS)
- The organisational system of policies, objectives and processes for governing AI, specified by ISO/IEC 42001.
- AI Security Institute
- The UK government body that evaluates the safety and security of advanced AI models.
- Annex A (ISO/IEC 42001)
- Reference controls organisations select based on their AI risk assessment.
- Confabulation
- NIST's term for generative AI producing confidently stated but false content.
- DPIA
- Data Protection Impact Assessment, required under GDPR for high-risk processing of personal data.
- Federated governance
- A hub-and-spoke model where a central team sets standards and business-unit representatives handle routine reviews.
- FRIA
- Fundamental Rights Impact Assessment, required under the EU AI Act for certain deployers of high-risk AI.
- Generative AI Profile
- NIST AI 600-1 (July 2024), applying the AI RMF to generative AI and identifying twelve risks.
- ISO/IEC 23894
- International guidance on AI risk management.
- ISO/IEC 42001
- The international standard (2023) specifying requirements for a certifiable AI management system.
- ISO/IEC 42005
- The international standard (2025) on AI system impact assessment.
- NIST AI RMF
- The US National Institute of Standards and Technology's voluntary AI Risk Management Framework, structured around Govern, Map, Measure and Manage.
- Risk appetite
- The amount and type of risk an organisation is willing to accept in pursuit of its objectives.
- Risk tiering
- Classifying AI uses by risk level so governance is proportionate.
- Statement of Applicability
- An ISO management-system document recording which controls apply and why.
- Three lines model
- A governance model: first line owns risk, second line oversees and challenges, third line (internal audit) provides independent assurance.
- Vendor due diligence
- Assessing a supplier's AI for data use, testing, documentation, security, certifications and contractual commitments.