AI & Business Transformation Glossary

Plain-English definitions of the terms we use across AI strategy, agents, automation, data, integration, and governance. Each entry is a single self-contained answer — designed to cite directly from search and AI assistants.

Strategy

AI Transformation
AI transformation is the redesign of an organization's processes, roles, and decision-making so that AI becomes how the organization works, not a tool the organization owns. It typically takes 6–18 months and addresses culture, process, and people in addition to technology.

Related: AI Readiness Assessment, AI Strategy, The Remolda Cycle

AI Readiness Assessment
An AI readiness assessment is a structured evaluation of an organization's data quality, process maturity, leadership commitment, technical infrastructure, talent, and risk tolerance to determine where AI will produce ROI and where it will fail.

Related: AI Transformation, AI Strategy

AI Strategy
An AI strategy is a written plan that identifies which workflows AI will replace or augment, what business outcomes that will produce, what investment is required, and what governance and risk controls apply. It is owned by the C-suite, not the IT department.

Related: AI Transformation, AI ROI

AI ROI
AI ROI is the measurable business outcome (revenue, cost reduction, cycle time, error rate, customer satisfaction) attributable to an AI deployment, divided by the total cost of that deployment over a defined period — typically 12–36 months.

Related: AI Strategy, Total Cost of AI

The Remolda Cycle
The Remolda Cycle is a five-phase methodology for AI business transformation: Audit (2–4 weeks readiness assessment), Strategy (4–8 weeks operating-model design), Implement (3–12 months wave-based deployment), Empower (parallel competency building), and Evolve (continuous optimization).

Related: AI Transformation, AI Readiness Assessment

Foundation Model
A foundation model is a large AI model trained on broad, general-purpose data that can be adapted to many downstream tasks through prompting, fine-tuning, or RAG. Examples include GPT-4, Claude, and Gemini. For enterprises, the choice of foundation model determines capability ceiling, data-handling guarantees, compliance posture, and per-token cost.

Related: LLM (Large Language Model), Fine-Tuning, RAG (Retrieval-Augmented Generation)

AI Maturity Model
An AI maturity model is a five-level framework that classifies organizations by how systematically they develop, deploy, and govern AI: Level 1 (ad hoc experimentation), Level 2 (isolated pilots), Level 3 (repeatable processes), Level 4 (managed and measured), Level 5 (optimizing and self-improving). Most enterprises beginning AI transformation sit at Level 1 or 2.

Related: AI Readiness Assessment, AI Transformation

Total Cost of AI
Total cost of AI (TCAI) is the full cost of an AI deployment over its operating lifetime, including inference fees, model fine-tuning, monitoring infrastructure, data pipeline maintenance, process redesign, training the human workforce, and vendor markup on top of underlying model costs. TCAI routinely runs 3–5× the initial implementation quote.

Related: AI ROI, AI Strategy, Model Drift

AI Business Case
An AI business case is a structured document that quantifies the expected value of an AI initiative, the full investment required, the risks, and the decision criteria for proceeding. A credible AI business case includes baseline metrics, realistic ROI timeline (typically 12–36 months), TCAI breakdown, governance plan, and success KPIs with measurement methodology.

Related: AI ROI, Total Cost of AI, AI Strategy

Change Management (AI)
Change management in AI transformation is the structured approach to preparing, equipping, and supporting employees through the behavioral, role, and process changes that AI deployment requires. Research consistently shows that people-side change is responsible for 80% of AI transformation failures — not the technology.

Related: AI Transformation, AI Maturity Model

Technology Adoption Lifecycle
The technology adoption lifecycle is the Everett Rogers model that classifies adopters of new technology into five groups: innovators (2.5%), early adopters (13.5%), early majority (34%), late majority (34%), and laggards (16%). The 'chasm' between early adopters and the early majority is the most common point of failure for enterprise AI deployments.

Related: Change Management (AI), AI Transformation, AI Maturity Model

Agents

AI Agent
An AI agent is a software system that takes a goal, plans a sequence of steps to reach it, executes those steps using tools (APIs, databases, browsers, code), and adapts when steps fail. Modern agents are typically powered by large language models and operate through tool-use loops.

Related: Multi-Agent System, Tool Use, Agentic AI

Multi-Agent System
A multi-agent system is a coordinated set of specialized AI agents that each handle one part of a workflow and communicate through structured messages. Common patterns include planner/worker, supervisor/executor, and peer-to-peer collaboration.

Related: AI Agent, Agentic AI

Agentic AI
Agentic AI describes systems that pursue goals autonomously over multiple steps without per-step human approval. It contrasts with single-turn AI (one prompt, one response) and traditional automation (deterministic scripts).

Related: AI Agent, Multi-Agent System

Tool Use
Tool use is the capability of an AI model to call external functions — search APIs, databases, code interpreters, file systems, web browsers — as part of generating its response. Tool use is what turns a language model into an agent.

Related: AI Agent, Function Calling

Ambient AI Scribe
An ambient AI scribe is a system that records the patient encounter (with consent), transcribes the conversation, and produces a structured clinical note for clinician review. Modern scribes reach 70–85% acceptance without edit in primary care contexts and reclaim 1–2 hours per clinician per day. Scribes are the highest-ROI healthcare AI deployment in 2026 by a wide margin.

Related: EHR (Electronic Health Record), PHI (Protected Health Information)

Autonomous Agent
An autonomous agent is an AI system that pursues a goal end-to-end without human approval at each step, using tools to act on the world and adapting its plan as it receives feedback. Autonomous agents contrast with supervised agents, where a human reviews each action before it executes.

Related: AI Agent, Agentic AI, Agent Orchestration

Agent Orchestration
Agent orchestration is the coordination of multiple AI agents — assigning tasks, managing information flow between them, handling failures, and aggregating results into a final output. Common orchestration patterns include planner-executor, supervisor-worker, and event-driven pipelines.

Related: Multi-Agent System, Autonomous Agent, AI Agent

Chain of Thought
Chain of thought (CoT) is a prompting technique in which a language model is guided to produce intermediate reasoning steps before its final answer. CoT consistently improves accuracy on multi-step reasoning, arithmetic, and planning tasks by forcing the model to decompose problems rather than pattern-match to a surface answer.

Related: AI Agent, Agentic AI

Memory (AI)
AI memory refers to mechanisms that allow an agent to retain and retrieve information across steps or sessions. Short-term memory lives in the context window; long-term memory is externalized to vector databases, structured stores, or episodic logs that the agent queries at runtime.

Related: AI Agent, RAG (Retrieval-Augmented Generation), Vector Database, Context Window

Computer Use (AI)
Computer use is an AI capability that allows a model to control a computer directly — moving the cursor, clicking UI elements, typing, reading screen content, and navigating applications — without requiring an API. It enables agents to automate tasks in legacy software that exposes no machine-readable interface.

Related: Tool Use, RPA (Robotic Process Automation), AI Agent

Conversational AI
Conversational AI is a category of AI systems designed to conduct natural-language dialogues with humans — including chatbots, virtual assistants, and voice interfaces. Modern conversational AI uses large language models to understand intent, maintain dialogue context, and generate coherent multi-turn responses.

Related: AI Agent, Agentic AI, RAG (Retrieval-Augmented Generation), LLM (Large Language Model)

Automation

Workflow Automation
Workflow automation is the replacement of repetitive multi-step business processes with software that executes them deterministically, with optional human checkpoints at decision points. Modern AI-augmented automation adds judgement steps that previously required human review.

Related: RPA (Robotic Process Automation)

RPA (Robotic Process Automation)
RPA is a category of software that automates UI-driven and form-based business tasks by mimicking user actions in legacy applications. It's brittle to UI changes and is increasingly being replaced or augmented by API-first AI agents.

Related: Workflow Automation

Intelligent Document Processing
Intelligent document processing (IDP) is the automated extraction of structured data from unstructured or semi-structured documents — invoices, contracts, clinical notes — using OCR, NLP, and large language models, then routing the data to downstream systems.

Related: OCR (Optical Character Recognition), Workflow Automation

Prior Authorization
Prior authorization is the insurer requirement that a clinician obtain approval before delivering certain services or medications. AI automates prior auth in three places: payer-side review (matching submissions to medical-necessity criteria), provider-side drafting (compiling the supporting documentation), and appeals drafting (composing the response when an authorization is denied). Provider-side and appeals workflows are seeing 40–70% cycle-time reduction in 2026 deployments.

Related: Intelligent Document Processing, Workflow Automation

Sanctions Screening
Sanctions screening is the regulator-mandated check of customers, transactions, and counterparties against OFAC, UN, EU, and UK sanctions lists. AI in sanctions screening reduces false positives by 40–70% over rule-based name-matching by handling transliteration, alias resolution, and contextual disambiguation. Pure-AI sanctions screening is not regulator-acceptable; AI overlays a rule-based safety floor.

Related: AI Compliance, Fraud Detection (AI)

Fraud Detection (AI)
AI fraud detection uses ensemble models — rule-based screens, classical machine learning, and large language models — each catching what the previous layer missed. Frontier LLMs add value primarily on novel fraud patterns expressed in natural language: social engineering, account takeover dialogues, fake document narratives. Pure-LLM fraud detection is rare in production; ensembles are the norm and the right architecture for 2026.

Related: Sanctions Screening, Model Risk Management (MRM)

Hyperautomation
Hyperautomation is the Gartner-coined strategy of applying AI, machine learning, RPA, process mining, and low-code tools together to automate every business process that can be automated, at enterprise scale. It treats automation as a discipline rather than a project.

Related: RPA (Robotic Process Automation), Workflow Automation, Process Mining

Process Mining
Process mining is the automated discovery of actual business process flows from event log data in ERP, CRM, and ticketing systems. It reveals how processes really run — including deviations, bottlenecks, and rework loops — making it the most reliable way to identify automation candidates before committing to implementation.

Related: Workflow Automation, Hyperautomation, RPA (Robotic Process Automation)

Digital Twin
A digital twin is a virtual simulation of a physical asset, system, or business process that runs in parallel with the real system and is continuously updated with live data. In AI automation contexts, digital twins are used to test process changes, train reinforcement learning agents, and predict the downstream effects of automation before live deployment.

Related: Workflow Automation, Process Mining

OCR (Optical Character Recognition)
OCR is the technology that converts images of printed or handwritten text into machine-readable characters. In AI document pipelines, OCR is the first stage of intelligent document processing — extracting raw text from scanned invoices, contracts, and forms before NLP and LLM layers classify, extract, and route the content.

Related: Intelligent Document Processing, Workflow Automation

Robotic Process Automation (RPA)
Robotic Process Automation (RPA) is software that automates rule-based, repetitive tasks by mimicking user interactions with desktop applications, web browsers, and legacy systems — clicking, typing, copying data between screens. RPA is widely deployed in finance, HR, and operations for processes that have no API and resist code-level integration.

Related: Workflow Automation, Intelligent Document Processing, Computer Use (AI), Hyperautomation

Event-Driven Automation
Event-driven automation is an architecture in which business processes are triggered by real-time events — a form submitted, a payment received, a threshold crossed, a message received — rather than by scheduled batch jobs or manual initiation. AI agents integrated into event-driven pipelines can respond to events with judgment, not just deterministic actions.

Related: Workflow Automation, Event Streaming, Webhook, AI Agent

Low-Code AI Platform
A low-code AI platform lets non-developers build AI-powered workflows through visual interfaces — drag-and-drop connectors, pre-built AI actions, and template libraries — without writing application code. Examples include Microsoft Power Automate with Copilot, n8n, Make, and Zapier AI.

Related: Workflow Automation, Robotic Process Automation (RPA), Event-Driven Automation

Data

RAG (Retrieval-Augmented Generation)
RAG is a pattern in which an AI model retrieves relevant documents from a knowledge base at query time and uses them as additional context to generate its response. It reduces hallucinations and lets the model cite sources without retraining.

Related: Fine-Tuning, Vector Database, Embedding

Fine-Tuning
Fine-tuning is the process of training an existing AI model on additional task-specific data so its weights adapt to a narrower domain. It improves performance on specialized tasks but costs more upfront than RAG and locks the knowledge into model weights.

Related: RAG (Retrieval-Augmented Generation)

Embedding
An embedding is a fixed-length vector of numbers that represents the semantic meaning of a piece of text (or image, audio). Embeddings allow systems to find conceptually similar content via vector distance, which is the core mechanic of RAG and semantic search.

Related: RAG (Retrieval-Augmented Generation), Vector Database

Vector Database
A vector database is a database optimized for storing embeddings and answering similarity queries ("give me the 10 most similar items to this one"). Common implementations include Pinecone, Weaviate, pgvector, and Qdrant.

Related: Embedding, RAG (Retrieval-Augmented Generation)

Hallucination
A hallucination is when an AI model generates text that is fluent, confident, and factually wrong. Causes include training-data gaps, outdated information, ambiguous prompts, and absence of retrieval. Mitigation patterns include RAG, citation requirements, and constrained generation.

Related: RAG (Retrieval-Augmented Generation), Grounding

Grounding
Grounding is the practice of constraining an AI model's output to verifiable sources — typically by requiring it to cite specific documents, database rows, or tool results. Grounding is the most reliable defense against hallucinations.

Related: RAG (Retrieval-Augmented Generation), Hallucination

LLM (Large Language Model)
A large language model (LLM) is a neural network trained on broad text corpora that can generate, summarize, translate, classify, and reason about natural language. Modern frontier LLMs include Claude, GPT, Gemini, and open-weight families like Llama and Mistral.

Related: Fine-Tuning, RAG (Retrieval-Augmented Generation)

Inference
Inference is the process of running a trained AI model to produce outputs from inputs. Inference cost dominates the operating budget of most LLM deployments and scales with input length, output length, and model size.

Related: LLM (Large Language Model), AI ROI

Context Window
A context window is the maximum amount of text (measured in tokens) that an AI model can process in a single inference call. Modern frontier models support 200K–1M tokens, but effective recall and reasoning quality often degrade well before that limit.

Related: LLM (Large Language Model), RAG (Retrieval-Augmented Generation)

Token
A token is the unit of text an AI model processes — roughly ¾ of an English word on average. Models charge by input + output tokens, so prompt length and response length both drive cost.

Related: Context Window, Inference

Synthetic Data
Synthetic data is AI-generated data that statistically mimics a real dataset without containing actual personal records. It is used to train and evaluate AI models when real data is scarce, sensitive, or legally restricted — particularly in healthcare and financial services.

Related: Fine-Tuning, Data Residency, AI Risk

MLOps
MLOps (Machine Learning Operations) is the set of practices that operationalize ML and AI models in production — covering CI/CD pipelines for model updates, automated testing, performance monitoring, data versioning, and rollback procedures. MLOps applies to both traditional ML models and LLM-based systems.

Related: Model Drift, Fine-Tuning, Inference

Model Drift
Model drift is the degradation of an AI model's accuracy over time as the real-world data distribution it is applied to shifts away from the distribution it was trained on. Drift is detected through statistical monitoring of model outputs and business KPIs, and corrected by retraining or retrieval-layer updates.

Related: MLOps, Fine-Tuning, Hallucination

Embedding (AI)
An embedding is a dense numerical vector that represents the semantic content of a piece of text, image, or audio in a continuous vector space. Items with similar meaning have vectors that are close together, enabling similarity search, clustering, and classification without hand-crafted features.

Related: Embedding, Vector Database, RAG (Retrieval-Augmented Generation), Semantic Search

Data Lake
A data lake is a centralized repository that stores structured, semi-structured, and unstructured data in its raw format at any scale. Unlike a data warehouse, a data lake imposes no schema at write time — structure is applied when data is read. Data lakes are the storage foundation for AI training pipelines and large-scale analytics.

Related: Feature Engineering, Data Mesh, Fine-Tuning, Synthetic Data

Feature Engineering
Feature engineering is the process of transforming raw data into the input representations that machine learning models use to make predictions. It includes selecting relevant variables, creating derived features, handling missing values, encoding categoricals, and scaling numerical inputs.

Related: MLOps, Fine-Tuning, Data Lake, Synthetic Data

Data Mesh
Data mesh is an organizational and architectural approach to data management that distributes data ownership to the business domains that produce it, rather than centralizing all data in a single platform team. Each domain owns, documents, and serves its data as a product — a 'data product' — accessible to other domains through a self-serve infrastructure.

Related: Data Lake, Feature Engineering, MLOps

Real-Time Analytics
Real-time analytics is the processing and analysis of data as it is generated — within milliseconds to seconds of an event occurring — to produce insights or trigger actions immediately. It contrasts with batch analytics, which processes accumulated data on a schedule (hourly, nightly).

Related: Event Streaming, Event-Driven Automation, Fraud Detection (AI)

Multimodal AI
Multimodal AI refers to AI systems that process and generate multiple types of data — text, images, audio, video, and structured data — within a single model or integrated pipeline. Frontier multimodal models (Claude, GPT-4o, Gemini) can analyze documents with charts, interpret medical images, transcribe audio, and reason across modalities simultaneously.

Related: LLM (Large Language Model), Intelligent Document Processing, Ambient AI Scribe, RAG (Retrieval-Augmented Generation)

AI Hallucination
AI hallucination is the generation of plausible-sounding but factually incorrect, fabricated, or unverifiable content by a language model. Hallucinations occur because LLMs predict statistically likely token sequences rather than retrieving verified facts — they have no internal 'truth checker.'

Related: Hallucination, Grounding, RAG (Retrieval-Augmented Generation), Responsible AI

Grounding (AI)
Grounding in AI refers to tethering a model's outputs to verifiable, real-world sources — retrieved documents, database records, structured data, or tool results — rather than allowing it to generate from parametric memory alone. Grounded systems cite their sources and are auditable.

Related: Grounding, RAG (Retrieval-Augmented Generation), Hallucination, AI Hallucination

Temperature (AI Parameter)
Temperature is a numerical parameter (typically 0–2) that controls the randomness of an AI model's output. At temperature 0, the model deterministically selects the highest-probability token at each step, producing consistent, conservative outputs. At higher temperatures, lower-probability tokens are sampled more often, producing more varied and creative — but potentially less accurate — outputs.

Related: LLM (Large Language Model), Inference, Hallucination, Fine-Tuning

Integration

LLM Integration
LLM integration is the work of embedding a large language model into existing business systems — CRM, ERP, ticketing, document repositories — so that AI capabilities are accessible from the tools employees already use, with proper authentication, audit logging, and data isolation.

Related: , RAG (Retrieval-Augmented Generation)

Model Context Protocol (MCP)
Model Context Protocol (MCP) is an open standard for connecting AI assistants to data sources and tools. An MCP server exposes resources and operations; an MCP client (the AI model) discovers and uses them through a well-defined JSON-RPC interface.

Related: Tool Use, AI Agent

Function Calling
Function calling is the mechanism by which a language model returns a structured request to invoke a developer-defined function rather than a free-form text response. It is the lowest-level primitive for tool use and the building block of agents.

Related: Tool Use, AI Agent

EHR (Electronic Health Record)
An EHR (Electronic Health Record) is the digital system that stores patient records — Epic, Cerner (Oracle Health), Meditech, Allscripts being the dominant vendors. AI integrations with EHRs use the FHIR API standard for read access and dedicated SDKs (Epic's Hyperdrive, Cerner's CernerWorks) for write access. EHR integration is the slowest phase of healthcare AI deployment, often 2–4 months of work for a single workflow.

Related: LLM Integration, PHI (Protected Health Information)

FHIR (Fast Healthcare Interoperability Resources)
FHIR (Fast Healthcare Interoperability Resources) is the HL7 standard for exchanging healthcare data through web APIs. Modern AI integrations with EHRs read patient data through FHIR endpoints, which return structured resources (Patient, Encounter, Observation, MedicationRequest) in JSON. FHIR is the default integration layer for healthcare AI in 2026 — deployments that hand-roll EHR integration outside FHIR are doing avoidable work.

Related: EHR (Electronic Health Record), LLM Integration

API Gateway (AI)
An AI API gateway is a proxy layer that sits between internal applications and external AI model APIs, enforcing rate limits, cost controls, authentication, PII redaction, audit logging, and fallback routing across multiple model providers. It is the standard enterprise pattern for managing AI API calls at scale.

Related: LLM Integration, Function Calling, AI Governance

Webhook
A webhook is an HTTP callback that a service sends to a URL of your choosing when a specific event occurs — a payment completes, a form is submitted, a ticket is updated. Webhooks are the standard mechanism for triggering AI automation pipelines from external platforms without polling.

Related: Event-Driven Automation, API Gateway (AI), Workflow Automation

API Rate Limiting
API rate limiting is the enforcement of maximum request rates on an API — typically measured in requests per minute, tokens per minute, or requests per day — to protect the provider's infrastructure and ensure fair allocation among customers. All major AI model APIs (Anthropic, OpenAI, Google) enforce rate limits that must be accounted for in production system design.

Related: API Gateway (AI), LLM Integration, Inference

Event Streaming
Event streaming is the continuous capture, transmission, and processing of event records in real time through a distributed log — Apache Kafka being the dominant platform. Each event (transaction completed, sensor reading, user action) is appended to a durable, ordered log that multiple consumers can read independently at their own pace.

Related: Event-Driven Automation, Real-Time Analytics, Webhook

Microservices Architecture
Microservices architecture structures an application as a collection of small, independently deployable services that each own a single business capability and communicate over lightweight APIs. It contrasts with monolithic architectures, where all functions share a single deployable unit.

Related: API Gateway (AI), LLM Integration, Event Streaming

Idempotency
Idempotency is the property of an operation that produces the same result whether it is executed once or multiple times. In AI automation systems, idempotent API calls and message handlers ensure that retries after network failures or timeouts do not cause duplicate actions — duplicate payments, duplicate records, or duplicate AI-triggered workflows.

Related: Webhook, API Rate Limiting, Workflow Automation, AI Agent

Governance

AI Governance
AI governance is the system of policies, controls, and accountabilities that determines what AI is allowed to do inside an organization, who approves AI deployments, how AI decisions are audited, and how risk is managed. It typically covers privacy, bias, security, and regulatory compliance.

Related: AI Ethics, AI Risk

AI Ethics
AI ethics is the practice of evaluating AI systems against principles like fairness, transparency, accountability, and harm reduction before deployment. In a business context, it includes review of training data sources, bias testing, explainability, and human-in-the-loop requirements.

Related: AI Governance, Responsible AI

Responsible AI
Responsible AI is an umbrella term for the operational practices that make AI deployments safe, fair, transparent, accountable, and aligned with human values — covering ethics, governance, security, privacy, and reliability across the full lifecycle.

Related: AI Ethics, AI Governance

AI Risk
AI risk is the set of categorized hazards a deployment introduces — including hallucination, bias, data leakage, prompt injection, regulatory non-compliance, vendor lock-in, and unintended automation of harm. Each category needs its own mitigation in a deployed system.

Related: AI Governance, Prompt Injection

Prompt Injection
Prompt injection is a class of attack where adversarial text inside a user query, tool result, or external document overrides the AI system's instructions. Defenses include strict input/output sanitization, separation of trusted and untrusted text, and structured tool boundaries.

Related: AI Risk, AI Security

AI Compliance
AI compliance is the demonstrable conformance of AI deployments to applicable laws and standards — GDPR, PIPEDA, the EU AI Act, NIST AI RMF, ISO/IEC 42001, sector-specific rules in healthcare, finance, and government. Compliance is auditable, not aspirational.

Related: AI Governance

HIPAA
HIPAA (Health Insurance Portability and Accountability Act) is the US federal law governing protected health information (PHI). HIPAA-compliant AI deployments use BAA-covered model endpoints (AWS Bedrock, Azure OpenAI, Google Cloud Healthcare API), keep PHI in controlled storage, and produce audit logs of every model call. Off-the-shelf consumer ChatGPT or Gemini is not HIPAA-compliant.

Related: PIPEDA, AI Compliance, PHI (Protected Health Information)

PIPEDA
PIPEDA (Personal Information Protection and Electronic Documents Act) is Canada's federal private-sector privacy law. AI deployments handling personal information of Canadians must satisfy PIPEDA's consent, purpose, and accountability principles, and — for cross-border transfers — disclose foreign processing in the privacy policy. Provincial laws (Quebec Law 25, Alberta PIPA, BC PIPA) add stricter requirements in their jurisdictions.

Related: HIPAA, AI Compliance, Data Residency

PHI (Protected Health Information)
PHI (Protected Health Information) is any individually identifiable health data covered by HIPAA — diagnoses, treatments, billing, demographic identifiers tied to health context. AI deployments that process PHI must use BAA-covered infrastructure, scoped retrieval (the AI sees only PHI the user is authorized to see), and audit logging. Sending PHI to a non-BAA endpoint is a HIPAA violation regardless of intent.

Related: HIPAA, AI Compliance

BAA (Business Associate Agreement)
A BAA (Business Associate Agreement) is the HIPAA-required contract between a covered entity (hospital, insurer) and a third-party service provider that processes PHI. Cloud AI providers — AWS, Azure, Google Cloud, OpenAI Enterprise, Anthropic Enterprise — sign BAAs as part of healthcare-targeted offerings. No BAA, no HIPAA-compliant deployment.

Related: HIPAA, PHI (Protected Health Information)

Data Residency
Data residency is the requirement that data be stored and processed within a specific geographic jurisdiction. AI deployments meet residency requirements by selecting model-host regions (Azure OpenAI Canada Central, Bedrock EU, Vertex AI in Quebec) and by designing retrieval and storage to keep data in-region. Cross-border model calls require explicit regulatory approval that most institutions do not bother seeking when in-region capacity exists.

Related: PIPEDA, AI Compliance

Model Risk Management (MRM)
Model risk management (MRM) is the framework banks and insurers use to validate, monitor, and govern statistical and AI models that affect consequential decisions. Canadian OSFI Guideline E-23 and US Federal Reserve SR 11-7 are the dominant frameworks. AI deployments in regulated finance need an MRM-aligned validation report, ongoing performance monitoring, and clear human-in-the-loop boundaries before they touch any decision affecting consumer credit, insurance, or capital.

Related: AI Governance, AI Compliance

Suspicious Activity Report (SAR)
A Suspicious Activity Report (SAR) is the regulator-mandated filing financial institutions submit when transactions match patterns of money laundering, fraud, or sanctions evasion. AI in SAR workflows is used for transaction triage, narrative drafting, and false-positive reduction — but the filing decision and signature remain with a human compliance officer. Pure-AI SAR generation is not regulator-acceptable.

Related: AI Compliance, Fraud Detection (AI)

Privilege (Legal)
Legal privilege is the doctrine that protects confidential communications between a lawyer and client from compelled disclosure. AI in legal practice manages privilege risk through enterprise contracts that disclaim training and access (BAA-equivalent for legal), private-cloud or self-hosted deployments for the most sensitive matters, and engagement letters that disclose AI use to clients. Processing client communications through a non-disclaimed third-party model risks waiver arguments in some jurisdictions.

Related: AI Governance, AI Compliance

FCRA / ECOA
FCRA (Fair Credit Reporting Act) and ECOA (Equal Credit Opportunity Act) are US federal statutes governing credit reporting and lending decisions. AI in lending must produce explainable adverse-action notices that satisfy ECOA's 'specific reasons' requirement and FCRA's accuracy and dispute-handling rules. Black-box lending models without explainability layers do not pass regulator review and create class-action risk.

Related: AI Governance, Model Risk Management (MRM)

AI Security
AI security is the discipline of protecting AI systems from adversarial attacks, data poisoning, model theft, and misuse — and of preventing AI from being used as an attack vector against other systems. It extends traditional cybersecurity to cover the unique attack surface of machine learning models and LLM-based applications.

Related: Prompt Injection, AI Governance, AI Risk

EU AI Act
The EU AI Act is the world's first comprehensive legal framework for artificial intelligence, adopted in 2024 and phased in through 2027. It classifies AI systems into four risk tiers — unacceptable, high, limited, and minimal — and imposes obligations (conformity assessments, transparency notices, human oversight) proportional to risk. High-risk systems in healthcare, finance, employment, and critical infrastructure face the strictest requirements.

Related: AI Compliance, AI Governance, NIST AI RMF

NIST AI RMF
The NIST AI Risk Management Framework (AI RMF) is the US voluntary framework for managing AI risk, organized around four core functions: Govern (policies and culture), Map (context and risk identification), Measure (analysis and assessment), and Manage (prioritization and treatment). It is the dominant enterprise AI governance reference in North America.

Related: AI Governance, EU AI Act, Responsible AI

AI Bias
AI bias is systematic error in an AI system's outputs that produces unfair treatment of individuals or groups, typically arising from biased training data, biased labels, or model architecture choices that proxy for protected attributes. Common types include historical bias, measurement bias, aggregation bias, and deployment-context mismatch.

Related: AI Ethics, Responsible AI, Explainable AI, AI Governance

Explainable AI
Explainable AI (XAI) is the set of methods and practices that make an AI system's predictions understandable to humans — identifying which inputs drove which outputs. XAI is required by regulators in lending (ECOA adverse-action notices), healthcare (clinical decision support validation), and under the EU AI Act for high-risk systems.

Related: AI Governance, AI Bias, Responsible AI, FCRA / ECOA

AI Incident
An AI incident is an event in which an AI system causes or contributes to harm — physical, financial, reputational, or discriminatory — or behaves in a materially unexpected way that could cause harm. Incident response for AI systems follows the same triage-contain-investigate-remediate pattern as cybersecurity incidents, with additional steps for model rollback and retraining.

Related: AI Governance, AI Risk, Responsible AI, EU AI Act

Zero Trust AI Security
Zero Trust AI Security applies the zero-trust principle — never trust, always verify — to AI systems and the infrastructure they run on. Every request to an AI model, every tool call an agent makes, and every data access it performs is authenticated, authorized, and logged, regardless of whether it originates inside the network perimeter.

Related: AI Security, Prompt Injection, AI Governance

AI Policy Framework
An AI policy framework is the formal set of rules, standards, and processes that govern how an organization develops, procures, deploys, and retires AI systems. It translates high-level governance principles into operational requirements — covering acceptable use, data handling, bias testing, human oversight, and incident response.

Related: AI Governance, Responsible AI, NIST AI RMF, EU AI Act

Model Card
A model card is a standardized documentation artifact for an AI model that describes its intended use cases, performance characteristics across demographic groups, training data sources, known limitations, and ethical considerations. Model cards were introduced by Google in 2018 and are now an emerging governance standard for both public and internal AI deployments.

Related: Explainable AI, AI Bias, AI Governance, Responsible AI

93 terms · Suggest a missing term →