AI & Business Transformation Glossary
Plain-English definitions of the terms we use across AI strategy, agents, automation, data, integration, and governance. Each entry is a single self-contained answer — designed to cite directly from search and AI assistants.
Strategy
- AI Transformation
- AI transformation is the redesign of an organization's processes, roles, and decision-making so that AI becomes how the organization works, not a tool the organization owns. It typically takes 6–18 months and addresses culture, process, and people in addition to technology.
- AI Readiness Assessment
- An AI readiness assessment is a structured evaluation of an organization's data quality, process maturity, leadership commitment, technical infrastructure, talent, and risk tolerance to determine where AI will produce ROI and where it will fail.
- AI Strategy
- An AI strategy is a written plan that identifies which workflows AI will replace or augment, what business outcomes that will produce, what investment is required, and what governance and risk controls apply. It is owned by the C-suite, not the IT department.
- AI ROI
- AI ROI is the measurable business outcome (revenue, cost reduction, cycle time, error rate, customer satisfaction) attributable to an AI deployment, divided by the total cost of that deployment over a defined period — typically 12–36 months.
- The Remolda Cycle
- The Remolda Cycle is a five-phase methodology for AI business transformation: Audit (2–4 weeks readiness assessment), Strategy (4–8 weeks operating-model design), Implement (3–12 months wave-based deployment), Empower (parallel competency building), and Evolve (continuous optimization).
- Foundation Model
- A foundation model is a large AI model trained on broad, general-purpose data that can be adapted to many downstream tasks through prompting, fine-tuning, or RAG. Examples include GPT-4, Claude, and Gemini. For enterprises, the choice of foundation model determines capability ceiling, data-handling guarantees, compliance posture, and per-token cost.
- AI Maturity Model
- An AI maturity model is a five-level framework that classifies organizations by how systematically they develop, deploy, and govern AI: Level 1 (ad hoc experimentation), Level 2 (isolated pilots), Level 3 (repeatable processes), Level 4 (managed and measured), Level 5 (optimizing and self-improving). Most enterprises beginning AI transformation sit at Level 1 or 2.
- Total Cost of AI
- Total cost of AI (TCAI) is the full cost of an AI deployment over its operating lifetime, including inference fees, model fine-tuning, monitoring infrastructure, data pipeline maintenance, process redesign, training the human workforce, and vendor markup on top of underlying model costs. TCAI routinely runs 3–5× the initial implementation quote.
- AI Business Case
- An AI business case is a structured document that quantifies the expected value of an AI initiative, the full investment required, the risks, and the decision criteria for proceeding. A credible AI business case includes baseline metrics, realistic ROI timeline (typically 12–36 months), TCAI breakdown, governance plan, and success KPIs with measurement methodology.
- Change Management (AI)
- Change management in AI transformation is the structured approach to preparing, equipping, and supporting employees through the behavioral, role, and process changes that AI deployment requires. Research consistently shows that people-side change is responsible for 80% of AI transformation failures — not the technology.
- Technology Adoption Lifecycle
- The technology adoption lifecycle is the Everett Rogers model that classifies adopters of new technology into five groups: innovators (2.5%), early adopters (13.5%), early majority (34%), late majority (34%), and laggards (16%). The 'chasm' between early adopters and the early majority is the most common point of failure for enterprise AI deployments.
Related: AI Readiness Assessment, AI Strategy, The Remolda Cycle
Related: AI Transformation, AI Strategy
Related: AI Transformation, AI ROI
Related: AI Strategy, Total Cost of AI
Related: AI Transformation, AI Readiness Assessment
Related: LLM (Large Language Model), Fine-Tuning, RAG (Retrieval-Augmented Generation)
Related: AI Readiness Assessment, AI Transformation
Related: AI ROI, AI Strategy, Model Drift
Related: AI ROI, Total Cost of AI, AI Strategy
Related: AI Transformation, AI Maturity Model
Related: Change Management (AI), AI Transformation, AI Maturity Model
Agents
- AI Agent
- An AI agent is a software system that takes a goal, plans a sequence of steps to reach it, executes those steps using tools (APIs, databases, browsers, code), and adapts when steps fail. Modern agents are typically powered by large language models and operate through tool-use loops.
- Multi-Agent System
- A multi-agent system is a coordinated set of specialized AI agents that each handle one part of a workflow and communicate through structured messages. Common patterns include planner/worker, supervisor/executor, and peer-to-peer collaboration.
- Agentic AI
- Agentic AI describes systems that pursue goals autonomously over multiple steps without per-step human approval. It contrasts with single-turn AI (one prompt, one response) and traditional automation (deterministic scripts).
- Tool Use
- Tool use is the capability of an AI model to call external functions — search APIs, databases, code interpreters, file systems, web browsers — as part of generating its response. Tool use is what turns a language model into an agent.
- Ambient AI Scribe
- An ambient AI scribe is a system that records the patient encounter (with consent), transcribes the conversation, and produces a structured clinical note for clinician review. Modern scribes reach 70–85% acceptance without edit in primary care contexts and reclaim 1–2 hours per clinician per day. Scribes are the highest-ROI healthcare AI deployment in 2026 by a wide margin.
- Autonomous Agent
- An autonomous agent is an AI system that pursues a goal end-to-end without human approval at each step, using tools to act on the world and adapting its plan as it receives feedback. Autonomous agents contrast with supervised agents, where a human reviews each action before it executes.
- Agent Orchestration
- Agent orchestration is the coordination of multiple AI agents — assigning tasks, managing information flow between them, handling failures, and aggregating results into a final output. Common orchestration patterns include planner-executor, supervisor-worker, and event-driven pipelines.
- Chain of Thought
- Chain of thought (CoT) is a prompting technique in which a language model is guided to produce intermediate reasoning steps before its final answer. CoT consistently improves accuracy on multi-step reasoning, arithmetic, and planning tasks by forcing the model to decompose problems rather than pattern-match to a surface answer.
- Memory (AI)
- AI memory refers to mechanisms that allow an agent to retain and retrieve information across steps or sessions. Short-term memory lives in the context window; long-term memory is externalized to vector databases, structured stores, or episodic logs that the agent queries at runtime.
- Computer Use (AI)
- Computer use is an AI capability that allows a model to control a computer directly — moving the cursor, clicking UI elements, typing, reading screen content, and navigating applications — without requiring an API. It enables agents to automate tasks in legacy software that exposes no machine-readable interface.
- Conversational AI
- Conversational AI is a category of AI systems designed to conduct natural-language dialogues with humans — including chatbots, virtual assistants, and voice interfaces. Modern conversational AI uses large language models to understand intent, maintain dialogue context, and generate coherent multi-turn responses.
Related: Multi-Agent System, Tool Use, Agentic AI
Related: AI Agent, Agentic AI
Related: AI Agent, Multi-Agent System
Related: AI Agent, Function Calling
Related: EHR (Electronic Health Record), PHI (Protected Health Information)
Related: AI Agent, Agentic AI, Agent Orchestration
Related: Multi-Agent System, Autonomous Agent, AI Agent
Related: AI Agent, Agentic AI
Related: AI Agent, RAG (Retrieval-Augmented Generation), Vector Database, Context Window
Related: Tool Use, RPA (Robotic Process Automation), AI Agent
Related: AI Agent, Agentic AI, RAG (Retrieval-Augmented Generation), LLM (Large Language Model)
Automation
- Workflow Automation
- Workflow automation is the replacement of repetitive multi-step business processes with software that executes them deterministically, with optional human checkpoints at decision points. Modern AI-augmented automation adds judgement steps that previously required human review.
- RPA (Robotic Process Automation)
- RPA is a category of software that automates UI-driven and form-based business tasks by mimicking user actions in legacy applications. It's brittle to UI changes and is increasingly being replaced or augmented by API-first AI agents.
- Intelligent Document Processing
- Intelligent document processing (IDP) is the automated extraction of structured data from unstructured or semi-structured documents — invoices, contracts, clinical notes — using OCR, NLP, and large language models, then routing the data to downstream systems.
- Sanctions Screening
- Sanctions screening is the regulator-mandated check of customers, transactions, and counterparties against OFAC, UN, EU, and UK sanctions lists. AI in sanctions screening reduces false positives by 40–70% over rule-based name-matching by handling transliteration, alias resolution, and contextual disambiguation. Pure-AI sanctions screening is not regulator-acceptable; AI overlays a rule-based safety floor.
- Fraud Detection (AI)
- AI fraud detection uses ensemble models — rule-based screens, classical machine learning, and large language models — each catching what the previous layer missed. Frontier LLMs add value primarily on novel fraud patterns expressed in natural language: social engineering, account takeover dialogues, fake document narratives. Pure-LLM fraud detection is rare in production; ensembles are the norm and the right architecture for 2026.
- Hyperautomation
- Hyperautomation is the Gartner-coined strategy of applying AI, machine learning, RPA, process mining, and low-code tools together to automate every business process that can be automated, at enterprise scale. It treats automation as a discipline rather than a project.
- Process Mining
- Process mining is the automated discovery of actual business process flows from event log data in ERP, CRM, and ticketing systems. It reveals how processes really run — including deviations, bottlenecks, and rework loops — making it the most reliable way to identify automation candidates before committing to implementation.
- Digital Twin
- A digital twin is a virtual simulation of a physical asset, system, or business process that runs in parallel with the real system and is continuously updated with live data. In AI automation contexts, digital twins are used to test process changes, train reinforcement learning agents, and predict the downstream effects of automation before live deployment.
- OCR (Optical Character Recognition)
- OCR is the technology that converts images of printed or handwritten text into machine-readable characters. In AI document pipelines, OCR is the first stage of intelligent document processing — extracting raw text from scanned invoices, contracts, and forms before NLP and LLM layers classify, extract, and route the content.
- Robotic Process Automation (RPA)
- Robotic Process Automation (RPA) is software that automates rule-based, repetitive tasks by mimicking user interactions with desktop applications, web browsers, and legacy systems — clicking, typing, copying data between screens. RPA is widely deployed in finance, HR, and operations for processes that have no API and resist code-level integration.
- Event-Driven Automation
- Event-driven automation is an architecture in which business processes are triggered by real-time events — a form submitted, a payment received, a threshold crossed, a message received — rather than by scheduled batch jobs or manual initiation. AI agents integrated into event-driven pipelines can respond to events with judgment, not just deterministic actions.
- Low-Code AI Platform
- A low-code AI platform lets non-developers build AI-powered workflows through visual interfaces — drag-and-drop connectors, pre-built AI actions, and template libraries — without writing application code. Examples include Microsoft Power Automate with Copilot, n8n, Make, and Zapier AI.
Related: RPA (Robotic Process Automation)
Related: Workflow Automation
Related: OCR (Optical Character Recognition), Workflow Automation
Related: AI Compliance, Fraud Detection (AI)
Related: RPA (Robotic Process Automation), Workflow Automation, Process Mining
Related: Workflow Automation, Hyperautomation, RPA (Robotic Process Automation)
Related: Workflow Automation, Process Mining
Related: Intelligent Document Processing, Workflow Automation
Related: Workflow Automation, Intelligent Document Processing, Computer Use (AI), Hyperautomation
Related: Workflow Automation, Event Streaming, Webhook, AI Agent
Related: Workflow Automation, Robotic Process Automation (RPA), Event-Driven Automation
Data
- RAG (Retrieval-Augmented Generation)
- RAG is a pattern in which an AI model retrieves relevant documents from a knowledge base at query time and uses them as additional context to generate its response. It reduces hallucinations and lets the model cite sources without retraining.
- Fine-Tuning
- Fine-tuning is the process of training an existing AI model on additional task-specific data so its weights adapt to a narrower domain. It improves performance on specialized tasks but costs more upfront than RAG and locks the knowledge into model weights.
- Embedding
- An embedding is a fixed-length vector of numbers that represents the semantic meaning of a piece of text (or image, audio). Embeddings allow systems to find conceptually similar content via vector distance, which is the core mechanic of RAG and semantic search.
- Vector Database
- A vector database is a database optimized for storing embeddings and answering similarity queries ("give me the 10 most similar items to this one"). Common implementations include Pinecone, Weaviate, pgvector, and Qdrant.
- Hallucination
- A hallucination is when an AI model generates text that is fluent, confident, and factually wrong. Causes include training-data gaps, outdated information, ambiguous prompts, and absence of retrieval. Mitigation patterns include RAG, citation requirements, and constrained generation.
- Grounding
- Grounding is the practice of constraining an AI model's output to verifiable sources — typically by requiring it to cite specific documents, database rows, or tool results. Grounding is the most reliable defense against hallucinations.
- LLM (Large Language Model)
- A large language model (LLM) is a neural network trained on broad text corpora that can generate, summarize, translate, classify, and reason about natural language. Modern frontier LLMs include Claude, GPT, Gemini, and open-weight families like Llama and Mistral.
- Inference
- Inference is the process of running a trained AI model to produce outputs from inputs. Inference cost dominates the operating budget of most LLM deployments and scales with input length, output length, and model size.
- Context Window
- A context window is the maximum amount of text (measured in tokens) that an AI model can process in a single inference call. Modern frontier models support 200K–1M tokens, but effective recall and reasoning quality often degrade well before that limit.
- Token
- A token is the unit of text an AI model processes — roughly ¾ of an English word on average. Models charge by input + output tokens, so prompt length and response length both drive cost.
- Synthetic Data
- Synthetic data is AI-generated data that statistically mimics a real dataset without containing actual personal records. It is used to train and evaluate AI models when real data is scarce, sensitive, or legally restricted — particularly in healthcare and financial services.
- MLOps
- MLOps (Machine Learning Operations) is the set of practices that operationalize ML and AI models in production — covering CI/CD pipelines for model updates, automated testing, performance monitoring, data versioning, and rollback procedures. MLOps applies to both traditional ML models and LLM-based systems.
- Model Drift
- Model drift is the degradation of an AI model's accuracy over time as the real-world data distribution it is applied to shifts away from the distribution it was trained on. Drift is detected through statistical monitoring of model outputs and business KPIs, and corrected by retraining or retrieval-layer updates.
- Embedding (AI)
- An embedding is a dense numerical vector that represents the semantic content of a piece of text, image, or audio in a continuous vector space. Items with similar meaning have vectors that are close together, enabling similarity search, clustering, and classification without hand-crafted features.
- Data Lake
- A data lake is a centralized repository that stores structured, semi-structured, and unstructured data in its raw format at any scale. Unlike a data warehouse, a data lake imposes no schema at write time — structure is applied when data is read. Data lakes are the storage foundation for AI training pipelines and large-scale analytics.
- Feature Engineering
- Feature engineering is the process of transforming raw data into the input representations that machine learning models use to make predictions. It includes selecting relevant variables, creating derived features, handling missing values, encoding categoricals, and scaling numerical inputs.
- Data Mesh
- Data mesh is an organizational and architectural approach to data management that distributes data ownership to the business domains that produce it, rather than centralizing all data in a single platform team. Each domain owns, documents, and serves its data as a product — a 'data product' — accessible to other domains through a self-serve infrastructure.
- Real-Time Analytics
- Real-time analytics is the processing and analysis of data as it is generated — within milliseconds to seconds of an event occurring — to produce insights or trigger actions immediately. It contrasts with batch analytics, which processes accumulated data on a schedule (hourly, nightly).
- Multimodal AI
- Multimodal AI refers to AI systems that process and generate multiple types of data — text, images, audio, video, and structured data — within a single model or integrated pipeline. Frontier multimodal models (Claude, GPT-4o, Gemini) can analyze documents with charts, interpret medical images, transcribe audio, and reason across modalities simultaneously.
- AI Hallucination
- AI hallucination is the generation of plausible-sounding but factually incorrect, fabricated, or unverifiable content by a language model. Hallucinations occur because LLMs predict statistically likely token sequences rather than retrieving verified facts — they have no internal 'truth checker.'
- Grounding (AI)
- Grounding in AI refers to tethering a model's outputs to verifiable, real-world sources — retrieved documents, database records, structured data, or tool results — rather than allowing it to generate from parametric memory alone. Grounded systems cite their sources and are auditable.
- Temperature (AI Parameter)
- Temperature is a numerical parameter (typically 0–2) that controls the randomness of an AI model's output. At temperature 0, the model deterministically selects the highest-probability token at each step, producing consistent, conservative outputs. At higher temperatures, lower-probability tokens are sampled more often, producing more varied and creative — but potentially less accurate — outputs.
Related: Fine-Tuning, Vector Database, Embedding
Related: RAG (Retrieval-Augmented Generation)
Related: RAG (Retrieval-Augmented Generation), Vector Database
Related: RAG (Retrieval-Augmented Generation), Hallucination
Related: LLM (Large Language Model), AI ROI
Related: LLM (Large Language Model), RAG (Retrieval-Augmented Generation)
Related: Context Window, Inference
Related: Fine-Tuning, Data Residency, AI Risk
Related: Model Drift, Fine-Tuning, Inference
Related: MLOps, Fine-Tuning, Hallucination
Related: Embedding, Vector Database, RAG (Retrieval-Augmented Generation), Semantic Search
Related: Feature Engineering, Data Mesh, Fine-Tuning, Synthetic Data
Related: MLOps, Fine-Tuning, Data Lake, Synthetic Data
Related: Data Lake, Feature Engineering, MLOps
Related: Event Streaming, Event-Driven Automation, Fraud Detection (AI)
Related: LLM (Large Language Model), Intelligent Document Processing, Ambient AI Scribe, RAG (Retrieval-Augmented Generation)
Related: Hallucination, Grounding, RAG (Retrieval-Augmented Generation), Responsible AI
Related: Grounding, RAG (Retrieval-Augmented Generation), Hallucination, AI Hallucination
Related: LLM (Large Language Model), Inference, Hallucination, Fine-Tuning
Integration
- LLM Integration
- LLM integration is the work of embedding a large language model into existing business systems — CRM, ERP, ticketing, document repositories — so that AI capabilities are accessible from the tools employees already use, with proper authentication, audit logging, and data isolation.
- Model Context Protocol (MCP)
- Model Context Protocol (MCP) is an open standard for connecting AI assistants to data sources and tools. An MCP server exposes resources and operations; an MCP client (the AI model) discovers and uses them through a well-defined JSON-RPC interface.
- Function Calling
- Function calling is the mechanism by which a language model returns a structured request to invoke a developer-defined function rather than a free-form text response. It is the lowest-level primitive for tool use and the building block of agents.
- EHR (Electronic Health Record)
- An EHR (Electronic Health Record) is the digital system that stores patient records — Epic, Cerner (Oracle Health), Meditech, Allscripts being the dominant vendors. AI integrations with EHRs use the FHIR API standard for read access and dedicated SDKs (Epic's Hyperdrive, Cerner's CernerWorks) for write access. EHR integration is the slowest phase of healthcare AI deployment, often 2–4 months of work for a single workflow.
- FHIR (Fast Healthcare Interoperability Resources)
- FHIR (Fast Healthcare Interoperability Resources) is the HL7 standard for exchanging healthcare data through web APIs. Modern AI integrations with EHRs read patient data through FHIR endpoints, which return structured resources (Patient, Encounter, Observation, MedicationRequest) in JSON. FHIR is the default integration layer for healthcare AI in 2026 — deployments that hand-roll EHR integration outside FHIR are doing avoidable work.
- API Gateway (AI)
- An AI API gateway is a proxy layer that sits between internal applications and external AI model APIs, enforcing rate limits, cost controls, authentication, PII redaction, audit logging, and fallback routing across multiple model providers. It is the standard enterprise pattern for managing AI API calls at scale.
- Semantic Search
- Semantic search is a retrieval approach that finds documents by meaning rather than keyword overlap. A query and all candidate documents are encoded as embeddings, and results are ranked by vector similarity — so a search for 'heart failure treatment' returns results about 'cardiac management protocols' even without exact keyword matches.
- Webhook
- A webhook is an HTTP callback that a service sends to a URL of your choosing when a specific event occurs — a payment completes, a form is submitted, a ticket is updated. Webhooks are the standard mechanism for triggering AI automation pipelines from external platforms without polling.
- API Rate Limiting
- API rate limiting is the enforcement of maximum request rates on an API — typically measured in requests per minute, tokens per minute, or requests per day — to protect the provider's infrastructure and ensure fair allocation among customers. All major AI model APIs (Anthropic, OpenAI, Google) enforce rate limits that must be accounted for in production system design.
- Event Streaming
- Event streaming is the continuous capture, transmission, and processing of event records in real time through a distributed log — Apache Kafka being the dominant platform. Each event (transaction completed, sensor reading, user action) is appended to a durable, ordered log that multiple consumers can read independently at their own pace.
- Microservices Architecture
- Microservices architecture structures an application as a collection of small, independently deployable services that each own a single business capability and communicate over lightweight APIs. It contrasts with monolithic architectures, where all functions share a single deployable unit.
- Idempotency
- Idempotency is the property of an operation that produces the same result whether it is executed once or multiple times. In AI automation systems, idempotent API calls and message handlers ensure that retries after network failures or timeouts do not cause duplicate actions — duplicate payments, duplicate records, or duplicate AI-triggered workflows.
Related: , RAG (Retrieval-Augmented Generation)
Related: LLM Integration, PHI (Protected Health Information)
Related: LLM Integration, Function Calling, AI Governance
Related: Embedding, Vector Database, RAG (Retrieval-Augmented Generation)
Related: Event-Driven Automation, API Gateway (AI), Workflow Automation
Related: API Gateway (AI), LLM Integration, Inference
Related: Event-Driven Automation, Real-Time Analytics, Webhook
Related: API Gateway (AI), LLM Integration, Event Streaming
Related: Webhook, API Rate Limiting, Workflow Automation, AI Agent
Governance
- AI Governance
- AI governance is the system of policies, controls, and accountabilities that determines what AI is allowed to do inside an organization, who approves AI deployments, how AI decisions are audited, and how risk is managed. It typically covers privacy, bias, security, and regulatory compliance.
- AI Ethics
- AI ethics is the practice of evaluating AI systems against principles like fairness, transparency, accountability, and harm reduction before deployment. In a business context, it includes review of training data sources, bias testing, explainability, and human-in-the-loop requirements.
- Responsible AI
- Responsible AI is an umbrella term for the operational practices that make AI deployments safe, fair, transparent, accountable, and aligned with human values — covering ethics, governance, security, privacy, and reliability across the full lifecycle.
- AI Risk
- AI risk is the set of categorized hazards a deployment introduces — including hallucination, bias, data leakage, prompt injection, regulatory non-compliance, vendor lock-in, and unintended automation of harm. Each category needs its own mitigation in a deployed system.
- Prompt Injection
- Prompt injection is a class of attack where adversarial text inside a user query, tool result, or external document overrides the AI system's instructions. Defenses include strict input/output sanitization, separation of trusted and untrusted text, and structured tool boundaries.
- AI Compliance
- AI compliance is the demonstrable conformance of AI deployments to applicable laws and standards — GDPR, PIPEDA, the EU AI Act, NIST AI RMF, ISO/IEC 42001, sector-specific rules in healthcare, finance, and government. Compliance is auditable, not aspirational.
- HIPAA
- HIPAA (Health Insurance Portability and Accountability Act) is the US federal law governing protected health information (PHI). HIPAA-compliant AI deployments use BAA-covered model endpoints (AWS Bedrock, Azure OpenAI, Google Cloud Healthcare API), keep PHI in controlled storage, and produce audit logs of every model call. Off-the-shelf consumer ChatGPT or Gemini is not HIPAA-compliant.
- PIPEDA
- PIPEDA (Personal Information Protection and Electronic Documents Act) is Canada's federal private-sector privacy law. AI deployments handling personal information of Canadians must satisfy PIPEDA's consent, purpose, and accountability principles, and — for cross-border transfers — disclose foreign processing in the privacy policy. Provincial laws (Quebec Law 25, Alberta PIPA, BC PIPA) add stricter requirements in their jurisdictions.
- PHI (Protected Health Information)
- PHI (Protected Health Information) is any individually identifiable health data covered by HIPAA — diagnoses, treatments, billing, demographic identifiers tied to health context. AI deployments that process PHI must use BAA-covered infrastructure, scoped retrieval (the AI sees only PHI the user is authorized to see), and audit logging. Sending PHI to a non-BAA endpoint is a HIPAA violation regardless of intent.
- BAA (Business Associate Agreement)
- A BAA (Business Associate Agreement) is the HIPAA-required contract between a covered entity (hospital, insurer) and a third-party service provider that processes PHI. Cloud AI providers — AWS, Azure, Google Cloud, OpenAI Enterprise, Anthropic Enterprise — sign BAAs as part of healthcare-targeted offerings. No BAA, no HIPAA-compliant deployment.
- Data Residency
- Data residency is the requirement that data be stored and processed within a specific geographic jurisdiction. AI deployments meet residency requirements by selecting model-host regions (Azure OpenAI Canada Central, Bedrock EU, Vertex AI in Quebec) and by designing retrieval and storage to keep data in-region. Cross-border model calls require explicit regulatory approval that most institutions do not bother seeking when in-region capacity exists.
- Model Risk Management (MRM)
- Model risk management (MRM) is the framework banks and insurers use to validate, monitor, and govern statistical and AI models that affect consequential decisions. Canadian OSFI Guideline E-23 and US Federal Reserve SR 11-7 are the dominant frameworks. AI deployments in regulated finance need an MRM-aligned validation report, ongoing performance monitoring, and clear human-in-the-loop boundaries before they touch any decision affecting consumer credit, insurance, or capital.
- Suspicious Activity Report (SAR)
- A Suspicious Activity Report (SAR) is the regulator-mandated filing financial institutions submit when transactions match patterns of money laundering, fraud, or sanctions evasion. AI in SAR workflows is used for transaction triage, narrative drafting, and false-positive reduction — but the filing decision and signature remain with a human compliance officer. Pure-AI SAR generation is not regulator-acceptable.
- Privilege (Legal)
- Legal privilege is the doctrine that protects confidential communications between a lawyer and client from compelled disclosure. AI in legal practice manages privilege risk through enterprise contracts that disclaim training and access (BAA-equivalent for legal), private-cloud or self-hosted deployments for the most sensitive matters, and engagement letters that disclose AI use to clients. Processing client communications through a non-disclaimed third-party model risks waiver arguments in some jurisdictions.
- FCRA / ECOA
- FCRA (Fair Credit Reporting Act) and ECOA (Equal Credit Opportunity Act) are US federal statutes governing credit reporting and lending decisions. AI in lending must produce explainable adverse-action notices that satisfy ECOA's 'specific reasons' requirement and FCRA's accuracy and dispute-handling rules. Black-box lending models without explainability layers do not pass regulator review and create class-action risk.
- AI Security
- AI security is the discipline of protecting AI systems from adversarial attacks, data poisoning, model theft, and misuse — and of preventing AI from being used as an attack vector against other systems. It extends traditional cybersecurity to cover the unique attack surface of machine learning models and LLM-based applications.
- EU AI Act
- The EU AI Act is the world's first comprehensive legal framework for artificial intelligence, adopted in 2024 and phased in through 2027. It classifies AI systems into four risk tiers — unacceptable, high, limited, and minimal — and imposes obligations (conformity assessments, transparency notices, human oversight) proportional to risk. High-risk systems in healthcare, finance, employment, and critical infrastructure face the strictest requirements.
- NIST AI RMF
- The NIST AI Risk Management Framework (AI RMF) is the US voluntary framework for managing AI risk, organized around four core functions: Govern (policies and culture), Map (context and risk identification), Measure (analysis and assessment), and Manage (prioritization and treatment). It is the dominant enterprise AI governance reference in North America.
- AI Bias
- AI bias is systematic error in an AI system's outputs that produces unfair treatment of individuals or groups, typically arising from biased training data, biased labels, or model architecture choices that proxy for protected attributes. Common types include historical bias, measurement bias, aggregation bias, and deployment-context mismatch.
- Explainable AI
- Explainable AI (XAI) is the set of methods and practices that make an AI system's predictions understandable to humans — identifying which inputs drove which outputs. XAI is required by regulators in lending (ECOA adverse-action notices), healthcare (clinical decision support validation), and under the EU AI Act for high-risk systems.
- AI Incident
- An AI incident is an event in which an AI system causes or contributes to harm — physical, financial, reputational, or discriminatory — or behaves in a materially unexpected way that could cause harm. Incident response for AI systems follows the same triage-contain-investigate-remediate pattern as cybersecurity incidents, with additional steps for model rollback and retraining.
- Zero Trust AI Security
- Zero Trust AI Security applies the zero-trust principle — never trust, always verify — to AI systems and the infrastructure they run on. Every request to an AI model, every tool call an agent makes, and every data access it performs is authenticated, authorized, and logged, regardless of whether it originates inside the network perimeter.
- AI Policy Framework
- An AI policy framework is the formal set of rules, standards, and processes that govern how an organization develops, procures, deploys, and retires AI systems. It translates high-level governance principles into operational requirements — covering acceptable use, data handling, bias testing, human oversight, and incident response.
- Model Card
- A model card is a standardized documentation artifact for an AI model that describes its intended use cases, performance characteristics across demographic groups, training data sources, known limitations, and ethical considerations. Model cards were introduced by Google in 2018 and are now an emerging governance standard for both public and internal AI deployments.
Related: AI Governance, Responsible AI
Related: AI Ethics, AI Governance
Related: AI Governance, Prompt Injection
Related: AI Risk, AI Security
Related: AI Governance
Related: PIPEDA, AI Compliance, PHI (Protected Health Information)
Related: HIPAA, AI Compliance, Data Residency
Related: HIPAA, AI Compliance
Related: HIPAA, PHI (Protected Health Information)
Related: PIPEDA, AI Compliance
Related: AI Governance, AI Compliance
Related: AI Compliance, Fraud Detection (AI)
Related: AI Governance, AI Compliance
Related: AI Governance, Model Risk Management (MRM)
Related: Prompt Injection, AI Governance, AI Risk
Related: AI Compliance, AI Governance, NIST AI RMF
Related: AI Governance, EU AI Act, Responsible AI
Related: AI Ethics, Responsible AI, Explainable AI, AI Governance
Related: AI Governance, AI Bias, Responsible AI, FCRA / ECOA
Related: AI Governance, AI Risk, Responsible AI, EU AI Act
Related: AI Security, Prompt Injection, AI Governance
Related: AI Governance, Responsible AI, NIST AI RMF, EU AI Act
Related: Explainable AI, AI Bias, AI Governance, Responsible AI
93 terms · Suggest a missing term →