EXIN AI Compliance Professional flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

AI system definition

A machine-based system that infers from input how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments.

Intended purpose

The use for which an AI system is intended by its provider, including specific context and conditions of use, as stated in instructions, promotional material, or technical documentation.

Foreseeable misuse

Reasonably predictable use of an AI system in a way inconsistent with its stated intended purpose; providers must still assess and mitigate the resulting risks.

Risk-based approach

Regulatory strategy that calibrates obligations to the severity and likelihood of harm a system can cause, rather than applying uniform rules to all AI.

Transparency obligation

Duty to inform affected persons that they interact with an AI system or receive synthetic content, enabling them to understand and challenge outcomes.

Provider versus deployer

A provider develops or places an AI system on the market under its own name; a deployer uses it under its authority in a professional context.

Prohibited AI practices

Applications banned outright regardless of safeguards, such as social scoring by public authorities or manipulative techniques exploiting vulnerability, because the harm is deemed unacceptable.

High-risk classification

Status assigned to AI systems used in safety-critical or rights-critical areas, such as employment, education, essential services, or product safety components, triggering full conformity duties.

General-purpose AI model

A model trained on broad data that displays generality across many tasks and can be adapted to numerous downstream uses, with duties scaled by systemic-risk designation.

NIST AI RMF functions

Voluntary framework organized as Govern, Map, Measure, and Manage; Govern is cross-cutting, and the framework is outcome-based rather than certifiable.

ISO/IEC 42001

Certifiable international management-system standard for AI, requiring policy, roles, risk assessment, operational controls, and continual improvement in a plan-do-check-act cycle.

AI governance owner

The named individual accountable for a specific AI system's compliance, approvals, monitoring, and escalation, distinct from the team that builds or operates it.

Conformity assessment

Documented process demonstrating an AI system meets applicable requirements before market placement, typically via internal control plus testing or third-party review for higher-risk systems.

Algorithmic impact assessment

Structured review of an AI use case's effects on affected people and rights, recording purpose, data, risks, mitigations, and sign-off before deployment.

Disaggregated metrics

Performance measures reported separately for each demographic or affected subgroup, exposing failures that aggregate accuracy figures conceal.

Demographic parity

Fairness criterion requiring similar positive outcome rates across groups; it ignores differing base rates and can conflict with equalized odds and calibration.

Equalized odds

Fairness criterion requiring equal true positive and false positive rates across groups, tying error rates to actual outcomes rather than selection rates.

Human-in-the-loop

Oversight design where a human must review and approve each consequential AI output before it takes effect, suitable for irreversible or high-impact decisions.

Human-on-the-loop

Oversight design where a human monitors AI operation and can intervene or override, appropriate when harms are detectable and reversible.

Model drift

Degradation of an AI system's performance or relevance as live data diverges from training conditions, detected by monitoring input, output, and accuracy distributions.

Adversarial testing

Deliberate probing of an AI system with crafted or manipulative inputs, including prompt injection, to reveal exploitable weaknesses before deployment.

Red teaming

Independent structured attempt to defeat an AI system's safeguards and produce harmful or erroneous outputs, documented with findings and remediation.

Residual risk acceptance

Formal decision by an authorized person to tolerate risk remaining after controls, recorded with rationale, scope, expiry, and review conditions.

Data minimization

Principle limiting collection and use of personal data to what is necessary for a specified purpose, reducing privacy exposure in AI training and inference.

AI system inventory

Register of all AI systems in use, recording purpose, owner, risk tier, data sources, vendor, evaluation status, and review dates.

Three lines model

Assurance structure where business functions own risk, compliance and risk functions set and test controls, and internal audit provides independent oversight.

AI incident

Event where an AI system causes or contributes to harm, malfunction, or legal breach, triggering triage, containment, notification, and remediation steps.

Incident notification clock

Time-bound reporting duty to authorities or affected persons that usually starts when the organization becomes aware of a serious incident, not at root-cause completion.

Vendor due diligence

Pre-contract review of an AI supplier's documentation, evaluations, data-use terms, subprocessors, change notification, and audit or exit rights.

Change-triggered reassessment

Rule requiring a new or updated risk assessment when a model, data source, purpose, or market changes materially after initial approval.

Override rate

Proportion of AI outputs reversed or corrected by human reviewers; a rising rate signals degraded model performance or inadequate oversight design.

Control evidence mapping

Practice linking each compliance control to its source requirement, accountable owner, evidence artifact, and test frequency so audits can be answered directly.