AI Governance Glossary: Key Terms for Responsible and Enterprise AI
Artificial intelligence is moving from isolated experiments into core business processes, customer experiences, decision-making systems, software products, and enterprise operations. As adoption expands, organizations need more than AI models and technical controls. They need a common vocabulary for understanding AI risk, accountability, compliance, transparency, security, data, model management, and responsible use.
This AI Governance Glossary provides a practical reference to the terminology used across enterprise AI governance, responsible AI, AI risk management, AI compliance, model governance, AI security, data governance, and generative AI.
The glossary is designed for executives, boards, AI governance committees, risk professionals, compliance teams, technology leaders, data professionals, project managers, product teams, developers, auditors, and anyone involved in the design, procurement, deployment, or oversight of AI systems.
Important: AI terminology is not always standardized. NIST notes that many AI terms can have multiple meanings depending on their context and source. This glossary therefore provides enterprise-oriented explanations rather than claiming that every definition represents a single universally accepted legal or technical definition.
1. AI Governance Fundamentals
1. Artificial Intelligence (AI)
Artificial intelligence refers broadly to machine-based systems that can perform tasks associated with capabilities such as perception, reasoning, learning, prediction, generation, decision support, or interaction.
From a governance perspective, AI should be considered more than a software component. An AI system operates within a wider socio-technical environment involving data, models, people, processes, infrastructure, users, and organizational decisions.
Governance relevance: Organizations should identify where AI is being used, who owns it, what decisions it influences, and what risks it creates.
2. AI Governance
AI governance is the framework of policies, decision rights, roles, processes, controls, standards, and oversight mechanisms used to direct and control the development, acquisition, deployment, use, and retirement of AI systems.
Effective AI governance connects technology decisions with organizational objectives, risk appetite, regulatory requirements, ethical considerations, security requirements, and business accountability.
Governance relevance: AI governance establishes who can make AI-related decisions and under what conditions.
3. AI Governance Framework
An AI governance framework is the structured architecture an organization uses to govern AI.
It typically includes:
Governance bodies
Policies
Standards
Risk processes
Approval gates
Roles and responsibilities
AI inventories
Documentation requirements
Monitoring
Audit mechanisms
Incident management
Training
Reporting
Frameworks such as the NIST AI Risk Management Framework provide organizations with approaches for incorporating trustworthiness considerations throughout AI design, development, deployment, use, and evaluation.
4. AI Governance Board
An AI Governance Board is a senior cross-functional body responsible for oversight of an organization's AI strategy, risk posture, policies, and major AI decisions.
Membership may include representatives from:
Executive leadership
Technology
Data
Cybersecurity
Legal
Compliance
Risk
Privacy
Procurement
Human resources
Business functions
Governance relevance: The board provides escalation and decision-making authority for material AI risks and high-impact use cases.
5. AI Governance Committee
An AI Governance Committee is a formal group responsible for implementing and operating AI governance processes.
Unlike a senior governance board, a committee may focus more heavily on operational matters such as AI assessments, use-case approvals, policy exceptions, risk reviews, and monitoring.
6. AI Policy
An AI policy establishes an organization's high-level expectations and rules for the responsible use and management of artificial intelligence.
A comprehensive AI policy can address:
Approved AI use
Prohibited use
Data handling
Privacy
Security
Human oversight
Third-party AI
Generative AI
Documentation
Accountability
Incident reporting
7. AI Standard
An AI standard translates governance policy into specific requirements.
For example, a policy might state that AI systems must be appropriately monitored. An AI standard could specify minimum monitoring requirements, documentation, review frequency, escalation thresholds, and ownership.
8. AI Control
An AI control is a specific mechanism designed to prevent, detect, mitigate, or respond to an AI-related risk.
Examples include:
Human approval
Access restrictions
Model validation
Data-quality checks
Bias testing
Output filtering
Logging
Monitoring
Security testing
9. AI Accountability
AI accountability refers to the assignment of responsibility for decisions, actions, outcomes, and risks associated with an AI system.
Accountability requires identifiable owners rather than treating an AI model as responsible for its own decisions.
10. AI Responsibility
AI responsibility concerns the obligations of individuals and organizations involved in developing, providing, deploying, operating, or using AI systems.
It can encompass legal, ethical, operational, security, privacy, and business responsibilities.
11. Responsible AI
Responsible AI refers to the design, development, deployment, and use of AI in ways intended to manage risks and support appropriate outcomes for people, organizations, and society.
Responsible AI commonly incorporates concepts such as fairness, transparency, accountability, safety, privacy, security, reliability, and human oversight.
NIST's AI RMF identifies characteristics including validity and reliability, safety, security and resilience, accountability and transparency, explainability and interpretability, privacy enhancement, and fairness with harmful bias managed. (NIST Publications)
12. Trustworthy AI
Trustworthy AI describes AI systems that demonstrate relevant characteristics such as reliability, safety, security, transparency, explainability, privacy protection, and fairness.
Trustworthiness is contextual. Different systems may require different balances between these characteristics depending on their intended use and potential consequences.
2. AI Risk Management
13. AI Risk
AI risk is the possibility that an AI system, its development process, deployment environment, or use could produce harmful, undesirable, unlawful, unreliable, or otherwise unacceptable consequences.
AI risks can include:
Operational risk
Cybersecurity risk
Privacy risk
Model risk
Compliance risk
Financial risk
Reputational risk
Safety risk
Bias-related risk
Intellectual-property risk
14. AI Risk Management
AI risk management is the structured process of identifying, assessing, treating, monitoring, and communicating risks associated with AI.
The NIST AI RMF is specifically designed to help organizations manage AI risks and promote trustworthy and responsible AI. (NIST)
15. AI Risk Management Framework (AI RMF)
The AI Risk Management Framework is a NIST framework designed to help organizations manage risks associated with AI.
Its core functions are:
Govern
Map
Measure
Manage
The framework is voluntary and intended to be flexible across sectors and organizational contexts. NIST is currently revising AI RMF 1.0, while additional profiles address specific AI contexts. (NIST)
16. Risk Assessment
An AI risk assessment evaluates potential risks associated with an AI system before or during deployment.
A robust assessment considers:
Intended use
Users
Affected parties
Data
Model
Outputs
Failure modes
Security
Privacy
Regulatory obligations
Business impact
17. Risk Appetite
AI risk appetite defines the level and type of AI risk an organization is willing to accept in pursuit of its objectives.
A financial institution, healthcare organization, and advertising company may have very different risk appetites for particular AI applications.
18. Risk Tolerance
Risk tolerance defines the acceptable variation around an organization's risk objectives.
For AI, tolerance levels can be expressed through measurable thresholds such as error rates, security findings, data-quality thresholds, or incident severity.
19. Risk Treatment
Risk treatment is the process of deciding how an identified AI risk will be addressed.
Common approaches include:
Avoiding the use case
Reducing the risk
Transferring certain risks
Accepting the risk
Implementing additional controls
20. Residual Risk
Residual risk is the risk remaining after controls and mitigation measures have been implemented.
AI governance should distinguish between inherent risk and residual risk because a system may remain material-risk even after controls are applied.
21. Inherent Risk
Inherent risk is the level of risk associated with an AI system before considering mitigating controls.
It helps organizations understand the underlying risk characteristics of a use case.
22. AI Impact Assessment
An AI impact assessment evaluates the potential consequences of an AI system for individuals, groups, organizations, or society.
Depending on context, it may examine:
Rights
Privacy
Safety
Discrimination
Economic effects
Security
Access to services
Human autonomy
23. High-Risk AI
High-risk AI generally refers to AI applications for which the potential consequences of errors, misuse, discrimination, or failure are considered significant.
The precise meaning varies between regulatory regimes. Organizations should therefore avoid treating "high risk" as a universal classification without identifying the applicable legal or regulatory framework.
3. AI Management Systems and Enterprise Standards
24. AI Management System (AIMS)
An AI Management System is an organizational management framework for establishing policies, objectives, processes, and controls relating to AI.
ISO/IEC 42001 specifies requirements for establishing, implementing, maintaining, and continually improving an AI Management System. (ISO)
25. ISO/IEC 42001
ISO/IEC 42001:2023 is an international standard for AI management systems.
It provides a structured management-system approach for organizations that develop, provide, or use AI systems and addresses areas including AI governance, risk management, responsible AI, and continual improvement. (ISO)
26. AI Management System Scope
The AIMS scope defines which organizational activities, locations, products, services, AI systems, and processes are covered by an AI management system.
A clearly defined scope prevents uncertainty about which AI activities fall within governance controls.
27. AI Governance Maturity
AI governance maturity describes how effectively an organization has developed and operationalized its AI governance capabilities.
Maturity models commonly progress from:
Ad hoc
Developing
Defined
Managed
Optimized
Maturity should be assessed across areas such as policy, risk, inventory, controls, accountability, monitoring, and assurance.
28. AI Governance Operating Model
An AI governance operating model defines how AI governance works in practice.
It establishes:
Decision rights
Governance forums
Escalation routes
Roles
Processes
Controls
Reporting
Technology support
Business ownership
29. Three Lines Model
The Three Lines Model separates organizational roles relating to governance and risk.
In an AI context, this can broadly translate into:
First line: AI developers, product teams, and business owners.
Second line: Risk, compliance, privacy, security, and governance functions.
Third line: Internal audit and independent assurance.
30. AI Governance Charter
An AI Governance Charter defines the mandate, authority, responsibilities, membership, decision rights, and operating procedures of an AI governance body.
It provides formal authority for AI governance activities.
4. AI Lifecycle Governance
31. AI Lifecycle
The AI lifecycle encompasses the stages through which an AI system progresses.
Typical stages include:
Ideation
Design
Data acquisition
Development
Training
Validation
Deployment
Monitoring
Maintenance
Retirement
Governance should apply throughout the lifecycle rather than only at deployment.
32. AI Use Case
An AI use case describes a specific business application of AI.
A use case should identify:
Business objective
Users
Data
AI technology
Outputs
Decisions affected
Risks
Controls
Owner
33. AI Use Case Intake
AI use case intake is the process through which proposed AI applications are formally registered and assessed.
An effective intake process helps organizations prevent uncontrolled or "shadow" AI adoption.
34. AI Approval Gate
An AI approval gate is a formal decision point requiring an AI system or use case to satisfy defined criteria before progressing.
Gates may occur before:
Development
Testing
Production
Material model changes
Expansion into new use cases
35. AI System Inventory
An AI system inventory is a centralized record of AI systems used, developed, purchased, or operated by an organization.
Typical fields include:
System name
Owner
Vendor
Model
Purpose
Data
Risk classification
Users
Deployment status
Review date
36. Model Inventory
A model inventory is a specialized register containing information about models used across the organization.
It may include model versions, owners, validation results, dependencies, performance measures, and lifecycle status.
37. Model Card
A model card is documentation describing important characteristics, intended uses, limitations, evaluation results, and other relevant information about an AI model.
Model cards support transparency and informed deployment decisions.
38. System Card
A system card documents characteristics, capabilities, limitations, risks, evaluations, and intended use of an AI system.
System cards can provide a broader view than model cards because they can cover the complete AI application rather than only the underlying model.
39. AI Documentation
AI documentation is the body of records required to understand an AI system's purpose, design, data, ownership, risks, controls, performance, and lifecycle.
Documentation provides evidence for governance, audit, incident response, and regulatory inquiries.
40. AI Change Management
AI change management governs modifications to AI models, data, prompts, infrastructure, configurations, integrations, or intended use.
Material changes should trigger appropriate reassessment before deployment.
5. Data Governance and AI
41. AI Data Governance
AI data governance establishes policies, processes, controls, and accountability for data used by AI systems.
It addresses areas such as:
Data quality
Provenance
Privacy
Access
Security
Retention
Lineage
Classification
Usage rights
42. Data Provenance
Data provenance describes where data originated, how it was obtained, how it was transformed, and where it has been used.
Provenance supports traceability and accountability.
43. Data Lineage
Data lineage tracks the movement and transformation of data through systems and processes.
For AI, lineage can help organizations determine which datasets contributed to model development or outputs.
44. Data Quality
Data quality describes how suitable data is for its intended purpose.
Important dimensions can include:
Accuracy
Completeness
Consistency
Timeliness
Validity
Uniqueness
Poor data quality can directly affect AI performance and risk.
45. Training Data
Training data is data used to develop or train an AI model.
Governance should consider its provenance, quality, representativeness, legal basis, licensing, privacy implications, and potential biases.
46. Validation Data
Validation data is used to evaluate or tune model performance during development.
It helps teams determine whether model behavior is appropriate before production deployment.
47. Test Data
Test data is used to evaluate a model's performance after development.
Testing should reflect relevant real-world conditions and risk scenarios where appropriate.
48. Data Bias
Data bias occurs when data characteristics introduce systematic distortions that can affect model behavior or outcomes.
Bias can arise from:
Sampling
Historical practices
Measurement
Labeling
Missing data
Data collection processes
49. Data Minimization
Data minimization is the principle of limiting data collection and processing to what is necessary for a defined purpose.
It is particularly relevant where AI systems process personal or sensitive information.
50. Synthetic Data
Synthetic data is artificially generated data designed to reproduce selected characteristics of real-world data.
It can support testing, development, privacy-enhancing approaches, and data augmentation, but its quality and representativeness must still be assessed.
6. Model Governance
51. Model Governance
Model governance is the framework used to manage the development, validation, approval, deployment, monitoring, and retirement of models.
AI model governance extends traditional model governance to account for characteristics such as generative behavior, complex dependencies, dynamic environments, and emerging risks.
52. Model Risk
Model risk is the possibility that a model produces incorrect, unreliable, misleading, or inappropriate outputs or is used incorrectly.
AI model risk can arise from model design, data, assumptions, implementation, deployment, or changes in operating conditions.
53. Model Validation
Model validation is the independent or appropriately controlled assessment of whether a model performs as intended and is suitable for its intended purpose.
Validation can examine:
Accuracy
Robustness
Stability
Bias
Explainability
Data
Assumptions
Limitations
54. Model Performance
Model performance describes how effectively a model performs its intended task.
Metrics should be selected according to the use case rather than relying on a single generic measure of accuracy.
55. Model Drift
Model drift occurs when model performance or the relationship between inputs and outputs changes over time.
Drift can result from:
Changing user behavior
Market conditions
Data changes
Environmental changes
Concept changes
56. Data Drift
Data drift occurs when the statistical characteristics of input data change over time.
Significant data drift can affect model reliability even when the model itself has not changed.
57. Concept Drift
Concept drift occurs when the relationship between inputs and the target or desired outcome changes over time.
This can cause previously effective models to become less reliable.
58. Model Monitoring
Model monitoring involves continuously or periodically assessing model behavior after deployment.
Monitoring can cover:
Performance
Drift
Bias
Availability
Security
Data quality
User feedback
Unexpected behavior
59. Model Retirement
Model retirement is the controlled removal of an AI model from operational use.
Governance should address replacement, data retention, documentation, dependencies, access removal, and archival requirements.
60. Model Versioning
Model versioning maintains identifiable versions of AI models and their associated configurations.
It supports reproducibility, rollback, auditability, and controlled change management.
7. Responsible AI and Ethics
61. AI Fairness
AI fairness concerns whether AI systems produce outcomes that are appropriately equitable across relevant individuals or groups.
Fairness is context-dependent and may involve different statistical, legal, ethical, or organizational criteria.
62. Algorithmic Bias
Algorithmic bias refers to systematic patterns in an algorithmic system that can produce inappropriate or inequitable outcomes.
Bias may originate in data, model design, objectives, deployment conditions, or human processes.
63. Bias Testing
Bias testing evaluates AI behavior across relevant groups or conditions to identify potentially harmful disparities.
Testing should be designed around the risks and characteristics of the specific use case.
64. Discrimination
In AI governance, discrimination concerns potentially unlawful or inappropriate differential treatment resulting from AI-supported decisions or processes.
Legal definitions vary by jurisdiction and application.
65. Transparency
AI transparency concerns the availability of information about an AI system, its purpose, operation, limitations, governance, and relevant decision processes.
Transparency does not necessarily mean revealing proprietary source code or every technical detail.
66. Explainability
Explainability concerns the ability to provide meaningful information about how or why an AI system produced an output.
The appropriate level of explanation depends on the system, audience, risk, and decision context.
67. Interpretability
Interpretability concerns how readily humans can understand the relationship between a model's inputs, internal processes, and outputs.
Interpretability and explainability are related but are not necessarily identical concepts.
68. Human Oversight
Human oversight involves mechanisms through which qualified people monitor, review, intervene in, or override AI system behavior.
The appropriate level of oversight depends on the system's risk and intended use.
69. Human-in-the-Loop
Human-in-the-loop systems require human involvement in specified stages of an AI-supported process.
For example, an AI system may recommend an action while a person makes the final decision.
70. Human-on-the-Loop
Human-on-the-loop systems operate with human supervision while the AI system performs actions with a degree of autonomy.
The human may intervene when predefined conditions or exceptions occur.
8. AI Safety, Security, and Resilience
71. AI Safety
AI safety concerns preventing AI systems from causing unacceptable physical, operational, or other harmful outcomes.
Safety considerations become especially important where AI affects physical systems, critical operations, healthcare, transportation, or other high-consequence environments.
72. AI Security
AI security concerns protecting AI systems, models, data, infrastructure, interfaces, and supply chains from malicious or unauthorized activity.
73. Adversarial Machine Learning
Adversarial machine learning examines attacks and defenses involving machine-learning systems.
NIST has published a dedicated taxonomy covering concepts, attack types, attacker objectives, capabilities, and mitigation approaches. (NIST Computer Security Resource Center)
74. Adversarial Attack
An adversarial attack is an intentional attempt to manipulate an AI system into producing an unintended outcome.
Examples include manipulated inputs, malicious prompts, poisoned training data, or other attacks against the model or surrounding system.
75. Data Poisoning
Data poisoning occurs when malicious or inappropriate data is introduced into a dataset with the potential to influence model behavior.
It is particularly relevant during model training and fine-tuning.
76. Model Poisoning
Model poisoning involves manipulating model parameters, weights, artifacts, or related components to create undesirable behavior.
77. Prompt Injection
Prompt injection is an attack in which malicious or unintended instructions influence a generative AI system's behavior.
It can become particularly significant when an AI system has access to tools, confidential information, external systems, or autonomous actions.
78. Jailbreak
A jailbreak is an attempt to circumvent restrictions or safeguards imposed on a generative AI system.
Organizations should consider jailbreak resistance as part of security and safety testing where relevant.
79. AI Resilience
AI resilience is the ability of an AI-enabled system to continue operating appropriately, recover from disruption, and maintain acceptable performance under adverse conditions.
80. AI Incident
An AI incident is an event involving an AI system that results in, or has the potential to result in, undesirable consequences.
Incidents can involve:
Security
Privacy
Safety
Bias
Incorrect outputs
Unauthorized use
Data exposure
Regulatory breaches
9. Generative AI Governance
81. Generative AI
Generative AI refers to AI systems capable of generating new content such as text, images, audio, video, software code, or other outputs.
Generative AI introduces governance challenges involving hallucination, intellectual property, data leakage, prompt security, misinformation, and uncontrolled use.
NIST's Generative AI Profile provides a companion resource to AI RMF 1.0 for identifying and managing risks associated with generative AI. (NIST)
82. Large Language Model (LLM)
A large language model is a machine-learning model designed to process and generate natural-language content at large scale.
LLMs are commonly used for conversational AI, content generation, summarization, coding assistance, research, and enterprise automation.
83. Foundation Model
A foundation model is a broadly capable model trained on extensive data that can subsequently be adapted for multiple applications.
Foundation models may support numerous downstream products and use cases.
84. AI Agent
An AI agent is an AI-enabled system capable of pursuing tasks through a combination of reasoning, tool use, planning, interaction, and action.
Agentic systems create additional governance considerations because they may execute actions rather than simply generate information.
85. Agentic AI
Agentic AI describes AI systems capable of performing multi-step tasks with some degree of autonomy.
Governance considerations include:
Authorization
Tool access
Human approval
Action limits
Audit logs
Identity
Monitoring
Failure recovery
86. Retrieval-Augmented Generation (RAG)
Retrieval-Augmented Generation combines generative AI with external information retrieval.
Instead of relying solely on information encoded in model parameters, the system retrieves relevant information and incorporates it into the generation process.
Governance should cover the sources being retrieved, access permissions, data quality, citation behavior, and security.
87. Prompt
A prompt is an instruction or input provided to a generative AI system to guide its response.
Prompts can become governance-relevant assets when they contain confidential information, proprietary instructions, business logic, or operational controls.
88. Prompt Governance
Prompt governance establishes rules for creating, storing, testing, approving, monitoring, and protecting prompts used in enterprise AI systems.
89. AI Hallucination
An AI hallucination is an AI-generated output that contains fabricated, unsupported, or incorrect information presented as though it were valid.
Hallucinations create particular risks when AI outputs are used without appropriate verification.
90. Grounding
Grounding refers to connecting AI outputs to reliable external information or defined sources so that generated responses are constrained by relevant evidence.
RAG is one common grounding approach.
10. AI Privacy and Data Protection
91. AI Privacy
AI privacy concerns the protection of personal information when AI systems collect, process, infer, store, transmit, or generate information relating to individuals.
92. Privacy-Enhancing Technology (PET)
Privacy-enhancing technologies are technical methods designed to reduce privacy risks while allowing data to be used for legitimate purposes.
Examples can include:
Differential privacy
Federated learning
Secure computation
Data anonymization techniques
93. Differential Privacy
Differential privacy is a mathematical approach designed to limit what can be inferred about an individual from statistical outputs.
It can be useful when organizations need to derive insights from sensitive datasets while reducing individual privacy exposure.
94. Anonymization
Anonymization involves transforming data so that individuals are no longer identifiable using reasonably available means, subject to the applicable legal and technical context.
Organizations should distinguish anonymization from pseudonymization.
95. Pseudonymization
Pseudonymization replaces identifying information with artificial identifiers or pseudonyms.
Unlike properly anonymized information, pseudonymized data may remain capable of being linked back to an individual using additional information.
96. Personally Identifiable Information (PII)
PII is information that can identify or be associated with an individual.
Terminology and legal definitions vary between jurisdictions, so organizations should apply the relevant legal framework.
11. AI Compliance and Assurance
97. AI Compliance
AI compliance is the process of ensuring that AI systems and associated organizational activities meet applicable laws, regulations, contractual requirements, standards, policies, and internal controls.
Compliance requirements vary significantly according to jurisdiction, sector, application, and AI use case.
98. AI Audit
An AI audit is a structured examination of an AI system, governance process, controls, documentation, or outcomes against defined criteria.
An AI audit may assess:
Governance
Compliance
Security
Privacy
Model performance
Data
Documentation
Controls
99. AI Assurance
AI assurance provides confidence that an AI system or governance process satisfies specified requirements or expectations.
Assurance can involve testing, assessment, validation, audit, certification, monitoring, and independent review.
100. AI Conformity Assessment
AI conformity assessment is the process of evaluating whether an AI system meets specified requirements under an applicable framework, standard, regulation, or organizational control structure.
The precise assessment process depends on the relevant regime.
12. AI Accountability and Decision-Making
101. Decision Rights
Decision rights define who has authority to make particular AI-related decisions.
Examples include:
Approving AI use cases
Accepting risk
Approving production deployment
Authorizing exceptions
Approving vendors
Retiring systems
102. AI System Owner
The AI system owner is the individual or organizational function accountable for a specific AI system.
The owner should understand the system's purpose, risks, controls, lifecycle, and performance.
103. Business Owner
The business owner is responsible for the business purpose and outcomes associated with an AI use case.
The business owner should not automatically be assumed to be the technical model owner.
104. Model Owner
The model owner is accountable for the governance and lifecycle management of a specific model.
Responsibilities may include performance monitoring, documentation, validation, change management, and retirement.
105. AI Developer
An AI developer designs, builds, configures, trains, integrates, or otherwise develops AI systems.
Developers are typically part of the first line of AI risk management and must operate within established governance requirements.
106. AI Operator
An AI operator manages or supervises the operational use of an AI system.
This may include monitoring, incident handling, configuration, access management, and operational controls.
107. AI Stakeholder
An AI stakeholder is any individual, group, organization, or other party with an interest in, responsibility for, or potential exposure to an AI system.
Stakeholders may include employees, customers, regulators, suppliers, affected individuals, shareholders, and communities.
13. Third-Party AI and AI Supply Chain
108. Third-Party AI
Third-party AI refers to AI technologies, models, platforms, APIs, services, or products supplied by an external organization.
Third-party AI creates additional governance requirements because organizations may have limited visibility into underlying models, training data, security controls, or development practices.
109. AI Vendor Risk
AI vendor risk is the risk arising from reliance on external providers of AI systems, models, infrastructure, data, or services.
Vendor assessments may examine:
Security
Privacy
Resilience
Data handling
Intellectual property
Model governance
Compliance
Subcontractors
Incident management
110. AI Supply Chain
The AI supply chain includes the interconnected providers, technologies, models, datasets, infrastructure, software components, and services that contribute to an AI system.
Supply-chain governance is increasingly important where an organization relies on multiple external AI components.
111. Model-as-a-Service (MaaS)
Model-as-a-Service describes the provision of AI models through externally managed services, often through APIs or cloud platforms.
Organizations using MaaS should understand provider responsibilities, data handling, availability, model changes, security, and contractual controls.
112. AI Service Provider
An AI service provider supplies AI capabilities, models, platforms, applications, infrastructure, or related services to another organization.
Contracts should clearly define responsibilities and risk allocation.
14. AI Intellectual Property and Content
113. AI-Generated Content
AI-generated content is content produced wholly or partly through an AI system.
Governance considerations can include:
Accuracy
Copyright
Ownership
Confidentiality
Attribution
Brand risk
Human review
114. Intellectual Property (IP)
Intellectual property encompasses legally protected creations and rights, including copyrights, patents, trademarks, trade secrets, and related rights.
AI governance should address both the organization's proprietary IP and IP contained in or generated through AI systems.
115. Training Data Rights
Training data rights concern whether an organization has the appropriate legal or contractual basis to use data for training, fine-tuning, evaluation, or other AI purposes.
116. AI Content Provenance
AI content provenance refers to information about the origin, history, transformation, and processing of content.
Provenance mechanisms can support authenticity, traceability, and accountability.
117. Content Credentials
Content credentials are metadata or other mechanisms used to provide information about the origin and history of digital content.
They can support transparency around AI-assisted or AI-generated media.
15. AI Metrics and Monitoring
118. AI Performance Metric
An AI performance metric is a quantitative or qualitative measure used to evaluate whether an AI system is performing as intended.
Metrics should reflect the system's purpose and risk profile.
119. AI Risk Metric
An AI risk metric measures an indicator associated with potential AI risk.
Examples include:
Error rate
Bias disparity
Security findings
Incident frequency
Drift
Human override rate
120. Key Risk Indicator (KRI)
A Key Risk Indicator is a metric used to provide early warning of increasing risk.
AI KRIs can help governance committees identify deteriorating performance or control effectiveness before a major incident occurs.
121. Key Performance Indicator (KPI)
A Key Performance Indicator measures progress toward defined business or operational objectives.
AI governance should balance business KPIs with risk and control metrics.
122. AI Control Effectiveness
AI control effectiveness measures whether a control is appropriately designed and operating as intended.
A control that exists on paper but is not consistently executed does not provide the same assurance as an effectively operating control.
16. AI Governance Strategy
123. AI Strategy
An AI strategy defines how an organization intends to use artificial intelligence to support business objectives.
It should connect:
Business priorities
Technology
Data
Talent
Governance
Risk
Investment
Operating model
124. AI Portfolio
An AI portfolio is the collection of AI initiatives, systems, products, and use cases managed by an organization.
Portfolio governance helps leadership understand aggregate investment, risk, dependencies, and strategic alignment.
125. AI Center of Excellence (AI CoE)
An AI Center of Excellence is a centralized or federated capability that provides expertise, standards, reusable assets, governance support, and enablement for AI adoption.
126. AI Governance Center of Excellence
An AI Governance Center of Excellence focuses specifically on establishing and scaling governance capabilities.
It may develop:
Policies
Standards
Risk frameworks
Assessment tools
Training
Governance processes
Reporting
Control libraries
127. AI Literacy
AI literacy is the knowledge and skills needed to understand AI capabilities, limitations, risks, appropriate use, and organizational requirements.
AI literacy is increasingly important beyond technical teams because employees may interact with AI systems directly.
128. AI Training
AI training provides employees, leaders, developers, risk professionals, and other stakeholders with knowledge relevant to their responsibilities.
Training should be role-specific rather than relying on a single generic AI course.
17. Emerging Enterprise AI Governance Terms
129. Shadow AI
Shadow AI refers to AI tools or services used within an organization without appropriate authorization, visibility, or governance.
It can create risks involving:
Confidential information
Privacy
Security
Intellectual property
Compliance
Uncontrolled automation
130. AI Sprawl
AI sprawl describes the uncontrolled proliferation of AI tools, models, applications, agents, and use cases across an organization.
AI inventories, procurement controls, approved platforms, and governance standards can help manage sprawl.
131. AI Guardrails
AI guardrails are technical, procedural, or organizational controls designed to constrain AI behavior within acceptable boundaries.
Examples include:
Input restrictions
Output filters
Access controls
Human approval
Tool restrictions
Policy enforcement
Content moderation
132. AI Red Teaming
AI red teaming involves deliberately testing an AI system to identify vulnerabilities, unsafe behaviors, weaknesses, or failure modes.
Red teaming can assess security, safety, misuse scenarios, prompt attacks, and other risks.
133. AI Evaluation
AI evaluation is the systematic assessment of an AI system's capabilities, limitations, performance, safety, security, or other relevant characteristics.
Evaluation should be aligned with the intended use and risk profile.
134. AI Benchmark
An AI benchmark is a defined test or dataset used to compare or measure AI system performance.
Benchmarks can be useful but should not be treated as complete evidence of real-world suitability.
135. AI Observability
AI observability is the ability to understand and monitor the behavior and operational state of AI systems through logs, metrics, traces, evaluations, and other signals.
It becomes increasingly important for complex AI applications and autonomous systems.
136. AI Traceability
AI traceability is the ability to reconstruct relevant information about an AI system's inputs, processes, decisions, outputs, changes, and operational events.
Traceability supports auditability, incident investigation, and accountability.
137. AI Audit Trail
An AI audit trail is a chronological record of relevant AI system activities and governance events.
It may include:
User actions
Model versions
Inputs
Outputs
Approvals
Changes
Overrides
Incidents
Access events
138. AI Exception
An AI exception is an authorized deviation from an established policy, standard, control, or requirement.
Exceptions should be documented, approved by an appropriate authority, time-bound where appropriate, and periodically reviewed.
139. AI Risk Acceptance
AI risk acceptance is a formal decision to accept a defined level of residual risk.
The decision should be made by an appropriately authorized person or governance body rather than implicitly through inaction.
140. AI Continuous Improvement
AI continuous improvement is the ongoing process of evaluating and improving AI governance, controls, systems, processes, and outcomes.
ISO/IEC 42001 uses a management-system approach that includes continual improvement of an organization's AI management system. (ISO)
This lifecycle perspective is important because AI governance should not be treated as a one-time compliance exercise. NIST's AI RMF is intended to address trustworthiness considerations across design, development, deployment, use, and evaluation, while ISO/IEC 42001 provides a management-system approach covering the establishment, implementation, maintenance, and continual improvement of AI management systems.
The Most Important AI Governance Concepts for Enterprise Leaders
Although an enterprise glossary may contain hundreds of terms, several concepts form the foundation of an effective AI governance program.
1. Governance
Organizations need clear decision rights, ownership, policies, committees, escalation routes, and accountability.
2. Risk
AI risks should be identified, assessed, treated, monitored, and reported throughout the lifecycle.
3. Accountability
Every material AI system should have clearly identified owners and decision-makers.
4. Transparency
Organizations need sufficient information to understand what AI systems do, how they are used, what their limitations are, and who is responsible for them.
5. Human Oversight
Higher-impact AI applications may require meaningful human review, intervention, or decision authority.
6. Data Governance
The quality, provenance, security, privacy, legality, and appropriateness of AI data can materially affect AI outcomes.
7. Security
AI systems need protection against malicious manipulation, unauthorized access, data exposure, model attacks, and other threats.
8. Monitoring
AI governance does not end at production deployment. Systems need ongoing monitoring for performance, drift, security, bias, incidents, and changes in operating conditions.
9. Assurance
Organizations need evidence that governance processes and controls are working as intended.
10. Continuous Improvement
AI technology and its associated risks continue to evolve. Governance frameworks therefore need mechanisms for learning, adaptation, reassessment, and improvement.
AI Governance Frameworks and Standards
Several major frameworks and standards provide important reference points for enterprise AI governance.
NIST AI Risk Management Framework
NIST's AI RMF is a voluntary framework designed to help organizations manage AI risks and incorporate trustworthiness considerations into AI design, development, deployment, use, and evaluation. Its core functions are Govern, Map, Measure, and Manage.
NIST also provides a dedicated Generative AI Profile addressing risks associated with generative AI.
ISO/IEC 42001
ISO/IEC 42001:2023 specifies requirements for an Artificial Intelligence Management System and is designed for organizations that develop, provide, or use AI-based products or services. It provides a management-system approach to establishing, implementing, maintaining, and continually improving AI governance.
ISO/IEC AI Standards
ISO also identifies other AI standards covering areas such as terminology, AI and machine-learning frameworks, and AI risk management. For example, ISO identifies ISO/IEC 22989 for AI terminology and ISO/IEC 23894 for guidance on AI-related risk management. (ISO)
Final Takeaway
AI governance is not a single policy, committee, technology, or compliance exercise. It is an organizational capability spanning strategy, people, processes, technology, data, risk, security, privacy, compliance, and accountability.
The terminology in this glossary provides a common language for building that capability.
For enterprise organizations, the objective is not simply to understand what individual AI terms mean. The larger objective is to understand how those concepts connect:
AI strategy → governance → risk → data → models → controls → deployment → monitoring → assurance → continuous improvement.
Organizations that establish this shared vocabulary are better positioned to move AI governance from high-level principles into repeatable operational processes.
As AI adoption expands, the glossary itself should also evolve. New model architectures, AI agents, regulatory requirements, security threats, evaluation techniques, and governance practices will continue to introduce new terminology and change the meaning or importance of existing concepts.
The strongest enterprise AI governance programs therefore treat terminology as part of a broader governance architecture rather than as a static dictionary.
