Glossary of AI Act, AI Governance and Data Governance

The data quality dimension that measures whether data reflects reality: the stored value matches the true value.

The independent authority that enforces the GDPR in Spain, including the use of personal data in AI systems.

The Spanish public agency, based in A Coruña, responsible for supervising artificial intelligence and enforcing the AI Act in Spain.

Regulation (EU) 2024/1689, the world's first comprehensive law regulating artificial intelligence according to the risk it creates.

Fines for breaching the AI Act: up to €35 million or 7% of worldwide annual turnover for using prohibited practices.

The dates on which each part of the AI Act starts to apply, from February 2025 to August 2028, updated for the Digital Omnibus.

An AI system that does not just answer but acts: it plans steps and uses tools (email, databases, payments) to reach a goal with little human intervention.

The ability to understand and explain why an AI system produced a given output, in a way that users and affected people can follow.

Companies that bring AI systems from non-EU providers into the EU (importers) or resell them (distributors), with checking duties.

The skills, knowledge and understanding people need to use AI in an informed way and be aware of its risks. The AI Act requires organisations to promote it.

The person who coordinates the use and governance of AI in an organisation: inventory, risks, policies, training and dealings with authorities.

Whoever develops an AI system or model (or has it developed) and places it on the market or puts it into service under its own name or trademark.

Canada has no federal AI law after AIDA lapsed in 2025; PIPEDA, Quebec’s Law 25 and a voluntary code apply.

China regulates AI through specific rules: public-facing generative AI, algorithm registration and mandatory labelling of AI-generated content since 2025.

India has no AI law, but since February 2026 its IT Rules require labelling synthetic content and removing unlawful content within 3 hours.

The region is moving at different speeds: Peru has regulations for its AI law, Brazil, Chile and Mexico are processing bills and others rely on data protection laws.

The UK has no AI law: it applies five principles through each sector’s regulators (ICO, CMA, FCA, Ofcom) and is preparing sandboxes.

The US has no federal AI law: state laws (Colorado, California, Texas, Illinois…), sector agencies and the voluntary NIST framework apply.

An authority-supervised environment where companies can develop and test innovative AI with guidance on how to comply with the AI Act.

A machine-based system that, with some autonomy, infers from the input it receives how to generate predictions, content, recommendations or decisions.

When an AI system systematically treats certain groups of people differently and unfairly, usually because of the data it learned from.

The list of areas in which an AI system is considered high-risk: biometrics, employment, education, credit, essential services, justice and more.

Two techniques for protecting personal data: anonymisation makes identifying the person irreversibly impossible; pseudonymisation only hides their identity.

The EU-based person or company that a non-EU AI provider must appoint to act on its behalf before European authorities.

People’s right not to be subject to decisions based solely on automated processing that significantly affect them, except in specific cases and with safeguards.

Brazil’s risk-based AI bill, inspired by the AI Act; passed by the Senate in 2024 and pending in the Chamber of Deputies.

The document that sets one approved definition for each business term (active customer, sale, margin…) so the whole company speaks the same language.

The data quality dimension that measures whether all the data that should be there is present: mandatory fields filled in and no missing records.

The procedure by which a provider shows its high-risk AI system meets the AI Act requirements before placing it on the market.

The data quality dimension that measures whether the same data says the same thing everywhere it appears, and does not contradict other data.

The first legally binding international treaty on AI, focused on human rights, democracy and the rule of law, open to countries worldwide.

A data element on which important decisions, regulatory reports or key processes depend, and which therefore deserves its own rules and monitoring.

The reference body of knowledge in data management, published by DAMA International, organising the discipline into areas such as governance, quality and metadata.

The organised inventory of a company's data: what data sets exist, what they mean, where they live, who is responsible and who can use them.

A person in a business team who acts as the go-to for data topics: answers questions, spots problems and connects with the data team.

Assigning each data set a sensitivity level (public, internal, confidential, restricted) that determines how it is protected, shared and retained.

Correcting, completing, standardising or removing wrong, incomplete or duplicate data so that it is fit for use.

An explicit agreement between whoever produces some data and whoever consumes it about its structure, meaning, quality and delivery times.

When it is normal in an organisation to decide with data, ask where a figure comes from and flag data that looks wrong.

The technical role (usually IT) that stores and protects data: storage, backups, access and security, following the Data Owner’s rules.

The set of roles, rules and processes that decide who is responsible for each piece of data, what quality it must have and who can use it.

The body that takes data governance decisions affecting several areas: priorities, policies, conflicts and follow-up.

The quality, representativeness and bias-control requirements for the data used to train, validate and test a high-risk AI system.

The map of a piece of data's journey: where it comes from, which systems it passes through, what transformations it undergoes and where it ends up.

People's ability to read, understand, question and communicate data in their daily work, from a chart to a KPI.

An approach that spreads data responsibility across business domains, which offer their data to others as "products" with guaranteed quality.

Continuously and automatically monitoring the state of data and of the processes that move it, to catch problems before they reach users.

The business person accountable for a data set: decides who can use it, what quality it must have and approves the rules that affect it.

The vendor that processes personal data on your company’s behalf (such as a cloud AI service) and the mandatory contract governing that relationship.

Analysing a dataset to see what it really looks like: blanks, formats, duplicates, ranges and anomalies, before using it or setting rules.

The person who advises on and monitors GDPR compliance in an organisation; mandatory in certain cases.

How fit data is for its intended use: whether it is accurate, complete, consistent, timely, valid and free of duplicates.

A data quality metric tracked over time, with a target and an owner, to tell whether quality is improving or getting worse.

A condition that data must meet to be considered good, written so it can be checked automatically.

The minimum acceptable level of a quality metric: below it, action is needed. It is set by whoever uses the data, not the technical team.

The specific capabilities a person needs to work with data in their role, from reading an indicator to defining quality rules.

The person who looks after a data set day to day: defines terms, monitors quality, documents and coordinates fixing errors.

Explaining a data-based conclusion clearly: what the data shows, what it doesn’t and what decision is proposed.

AI-generated or manipulated image, audio or video that resembles real people, places or events and could falsely appear authentic.

The company or body using an AI system under its authority in a professional activity. It is the role most companies have.

The 2026 EU regulation that simplified the AI Act and pushed high-risk obligations back to December 2027 and August 2028.

The EU regulation requiring banks, insurers and other financial entities to manage their technology risks and their ICT providers.

The GDPR-mandated analysis before any processing of personal data likely to pose a high risk to individuals, such as many uses of AI.

The public EU register in which high-risk AI systems must be entered before being placed on the market or used.

The document signed by the provider taking responsibility for compliance, and the CE mark that accompanies it on high-risk AI.

The European Commission body that supervises general-purpose AI models and coordinates enforcement of the AI Act across the EU.

The body bringing together one representative from each Member State to coordinate consistent application of the AI Act across the EU.

An analysis certain users of high-risk AI must carry out before using it, to see how it may affect people's rights.

An AI model trained on large amounts of data that can perform a wide range of different tasks, such as large language models.

A general-purpose AI model so capable it could cause large-scale harm; presumed when its training exceeds 10^25 FLOPs.

When a generative AI model produces an answer that sounds convincing but is false or made up, such as facts, quotes or references that do not exist.

European technical standards that, when followed, give a presumption that a high-risk AI system meets the AI Act requirements.

An AI system that can significantly affect people's health, safety or rights and therefore carries the strictest obligations.

The requirement that trained people can monitor, understand, correct and, if needed, stop a high-risk AI system.

Sending personal data outside the European Economic Area; only allowed with safeguards such as an adequacy decision or standard contractual clauses.

The certifiable international standard for setting up an artificial intelligence management system in an organisation, published in December 2023.

Japan’s 2025 law promoting AI through principles and a national plan, without general obligations or fines for companies.

The legal justification every processing of personal data needs: consent, contract, legal obligation, vital interests, public task or legitimate interests.

Brazil’s personal data protection law, closely modelled on the GDPR, in force since 2020 and supervised by the ANPD.

An AI model trained on huge amounts of text to understand and generate language; it powers conversational assistants.

The national authority that checks AI systems on the market comply with the AI Act and can inspect, order withdrawals and impose penalties.

Managing the key data shared by many processes (customers, products, suppliers, employees) so there is one single reliable version.

"Data about data": what each field means, where it comes from, who is responsible, when it was updated and who may use it.

A short, standardised document describing an AI model: what it is for, what data it was trained on, how it performs and what its limits are.

The loss of accuracy of an AI model over time because real-world data changes compared with the data it was trained on.

The EU cybersecurity directive requiring companies in essential and important sectors to manage security risks and report incidents.

The US standards institute's voluntary AI risk management framework, organised into four functions: Govern, Map, Measure and Manage.

An independent body authorised by a Member State to assess whether certain high-risk AI systems comply with the AI Act before they are placed on the market.

The first intergovernmental AI principles (2019, updated in 2024), whose definition of an AI system inspires the AI Act and other laws.

The monitoring a provider must carry out on its high-risk AI once in use, collecting data on real-world performance to spot problems.

Uses of AI that the AI Act bans outright since 2 February 2025, such as social scoring or emotion recognition at work.

The set of written policies, procedures and instructions by which a high-risk AI provider ensures it complies with the AI Act systematically.

A table that makes clear, for each task, who does it (R), who is accountable (A), who is consulted (C) and who is informed (I).

A technique that makes an AI model answer based on the company’s own documents, retrieved at query time, instead of only on what it learned in training.

The GDPR-mandated inventory describing what personal data a company processes, why, about whom, who it is shared with and how long it is kept.

A continuous process, throughout the life of a high-risk AI system, to identify, evaluate and reduce its risks.

A permissions model in which access to data is granted according to each person's job (role), rather than person by person.

An AI malfunction that causes death or serious harm to health, critical infrastructure, property or the environment, or infringes fundamental rights.

Employees using AI tools without the company knowing or having authorised it.

Singapore’s voluntary guidance for responsible AI, including the first framework for agentic AI (January 2026) and the AI Verify testing toolkit.

Korea’s AI law, applicable since 22 January 2026 also to foreign companies: notices, labelling and rules for high-impact AI.

The file the provider of a high-risk AI system must prepare before placing it on the market to show it complies with the AI Act.

The data quality dimension that measures whether data is available and up to date when it is needed.

The rules requiring people to be told when they are talking to an AI or seeing AI-generated content, such as chatbots, deepfakes or synthetic text.

The data quality dimension that measures whether each real-world thing appears only once: no duplicate customers, products or suppliers.

The data quality dimension that measures whether values meet the format, range and rules defined for that data.

Vietnam’s risk-tiered AI law, in force since 1 March 2026 with a one-year grace period, requiring prior assessment for high-risk AI.