The words of compliance, explained plainly
41 terms from data protection, AI agent governance, cybersecurity and proof. Each is defined in one sentence, then explained — with what it concretely changes for an organization with no legal department.
Regulation
- EU AI ActThe EU AI Act sorts artificial intelligence systems by level of risk and imposes escalating obligations depending on the category a system falls into.
- GDPRThe GDPR is the European regulation governing the processing of personal data, and it applies as soon as an organization targets people located in the European Union.
- ISO/IEC 27001ISO/IEC 27001 is the international standard for information security management: it certifies that an organization manages its security risks through a documented process.
- ISO/IEC 42001ISO/IEC 42001 is the international standard defining an artificial intelligence management system — how an organization governs its AI systems in a documented, auditable way.
- Law 25 (Quebec)Law 25 is the Quebec statute governing how businesses and public bodies collect, use and disclose personal information.
- NIS2NIS2 is the European directive imposing cybersecurity measures and incident-notification duties on entities classed as essential or important.
- PIPEDAPIPEDA is Canada's federal private-sector privacy law, applying to commercial activity that crosses provincial or national borders.
- SOC 2SOC 2 is an attestation report produced by an independent accounting firm, describing a service company's controls and the auditor's opinion on their effectiveness.
Data protection
- Anonymisation and pseudonymisationAnonymisation makes re-identification reasonably impossible and takes the data outside the law; pseudonymisation merely replaces identifiers, and the data stays in scope.
- Automated decisionAn automated decision is a decision producing an effect on a person and taken without meaningful human involvement.
- ConsentConsent is the free, informed agreement given for specific purposes by which a person authorises the processing of their personal information.
- Cross-border transferA cross-border transfer is the disclosure of personal information to an organization located outside the jurisdiction where it was collected.
- Data breachA data breach is any access, use, disclosure or loss of personal information not authorised by law.
- Data minimisationData minimisation is the principle that an organization should collect only the information necessary for the purposes it has declared, and nothing more.
- Personal informationPersonal information is any information about a natural person that makes them identifiable, directly or indirectly.
- Privacy impact assessmentA privacy impact assessment is the analysis run before a project to identify the risks it creates for people's privacy and decide on the measures that reduce them.
- Privacy officerThe privacy officer is the person designated within an organization to oversee compliance with personal information rules and act as the contact point for individuals and the regulator.
- ProcessorA processor is an organization that handles personal information on behalf of another, under its instructions and without determining the purposes.
- Records of processingRecords of processing are the documented inventory of what an organization does with personal information: which data, for which purposes, kept how long, shared with whom.
- Sensitive dataSensitive data is personal information whose disclosure would expose the individual to serious harm, which earns it a stricter protection regime.
AI governance
- Agent autonomy levelThe autonomy level describes how far an agent may go without human validation, and it changes the decision an authority layer returns for the same action.
- AI agent governanceAI agent governance is the set of rules and mechanisms that determine what an autonomous agent is allowed to do, before it acts.
- AI audit trailAn agent's audit trail is the record of what it did, when, and on what basis, kept in a form that can be shown to a third party.
- AI guardrailA guardrail is a control that stops an AI system from producing or executing something unwanted, applied at the moment of execution.
- Algorithmic biasAlgorithmic bias is a systematic difference in treatment produced by an automated system to the detriment of a group of people.
- Algorithmic transparencyAlgorithmic transparency is the duty to tell a person they are interacting with an AI system, or that content was generated by one.
- Authority layerAn authority layer is the component that answers "is this agent allowed to take this action" and returns a reasoned decision, which the infrastructure then applies.
- Doubt thresholdThe doubt threshold is the confidence level below which a decision engine refuses to rule and escalates the question to a human rather than guessing.
- High-risk AI systemA high-risk AI system is one whose use may harm health, safety or fundamental rights, and which therefore carries the bulk of the regulatory obligations.
- Human in the loopHuman in the loop refers to the mechanism by which a person validates, corrects or refuses a decision produced by an automated system, before it takes effect.
Cybersecurity
- 3-2-1 backup ruleThe 3-2-1 rule recommends keeping three copies of your data, on two different media, with one of them off site.
- Encryption at rest and in transitEncryption in transit protects data while it moves across the network; encryption at rest protects it where it is stored.
- Least privilegeLeast privilege means granting each person, service or agent only the rights strictly needed for their task, and not one more.
- Multi-factor authenticationMulti-factor authentication requires at least two proofs of identity of different kinds to open a session: something you know, something you have, or something you are.
- Penetration testA penetration test is an authorised exercise in which specialists genuinely attempt to compromise a system, to discover what an attacker could do.
- RTO and RPORTO is the maximum acceptable downtime after an incident; RPO is how much data you accept losing, expressed as a span of time.
Proof and attestation
- Compliance attestationA compliance attestation is a dated document stating what an organization assessed, by what method, and within what limits — without claiming compliance in law.
- Digital signatureA digital signature lets anyone verify that a document genuinely comes from its issuer and has not been altered since, without having to trust whoever presents it.
- Hash chainA hash chain links each log entry to the previous one by a digest, so that altering an old entry visibly breaks everything that follows.
- Third-party timestampingThird-party timestamping has an independent authority attest that a document already existed at a given date.
- Third-party verificationThird-party verification is the ability, for whoever receives a document, to check its authenticity without going through the party that handed it over.