EXIN AI Compliance Professional key terms

A machine-based system that infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments.

The full span of an AI system from design and data collection through development, validation, deployment, monitoring, and eventual retirement, with compliance obligations attaching at each phase.

The awareness and understanding that staff and users need about AI systems, their capabilities and limits, so they can use them safely and make informed choices.

A model trained on broad data at scale that can perform a wide range of distinct tasks and can be adapted to many downstream uses, some of which the original developer never intended.

A large model pretrained on general data that serves as a base for many downstream applications through fine-tuning, prompting, or integration into products.

An AI use that a regulator bans outright because the harm is considered unacceptable, such as social scoring, manipulative techniques, or untargeted facial scraping, regardless of any mitigation.

An AI system classified as posing significant risk to health, safety, or fundamental rights, typically because of its use in critical areas such as employment, education, credit, or essential services.

The duty to inform people when they interact with AI, when content is AI-generated or manipulated, and when emotion recognition or biometric categorisation is in use.

A structured evaluation, often documented in a declaration, showing that an AI system meets the legal requirements applicable to it before it is placed on the market or put into service.

A visible marker indicating that a product, including an AI system where the law requires it, has passed the applicable conformity assessment and may be freely placed on the market.

The recorded evidence of an AI system's design, purpose, data, testing, and risk controls, kept so that regulators and auditors can verify compliance after the fact.

A short structured document describing a model's intended uses, training data, performance, and known limitations, so downstream users can judge whether it fits their context.

A continuous, documented process for identifying, evaluating, mitigating, and monitoring AI risks across the lifecycle, rather than a one-off checklist completed at launch.

A maintained log of identified AI risks, each with its owner, likelihood, impact, controls, and status, serving as the operational record of the risk management system.

The risk that remains after controls have been applied, which must be documented and consciously accepted by an accountable person rather than assumed away.

The amount and type of AI risk an organisation is willing to accept in pursuit of its objectives, expressed in statements or thresholds that guide decisions on individual use cases.

A structured review of how a proposed AI use affects individuals, groups, and fundamental rights, performed before deployment and revisited when the system or context changes.

An evaluation focused specifically on effects on rights such as non-discrimination, privacy, and access to services, required for certain public-sector and critical high-risk deployments.

A privacy review required when processing personal data is likely to create high risk, now commonly extended to cover AI training, inference, and profiling activities.

A systematic and unfair skew in AI outputs affecting particular groups, arising from data, labelling, model design, or deployment context, and requiring measurement rather than assumption.

The practice of measuring AI outcomes across groups using defined metrics, documenting disparities, and deciding whether observed differences are justified and acceptable.

Adversarial testing in which specialists deliberately try to make an AI system fail, mislead, leak data, or produce harmful output, so weaknesses are found before real users do.

Systematic measurement of an AI system's accuracy, robustness, and safety against defined criteria before and after deployment, using test sets and documented methods.

A standardised test or dataset used to compare AI systems' performance, useful as an indicator but never a substitute for testing in the actual deployment context.

The gradual decline in an AI system's performance or relevance as real-world data and behaviour diverge from what the model was trained and validated on.

Ongoing collection and analysis of data on a deployed AI system's performance and effects, with defined triggers for investigation, correction, or withdrawal.

The designed ability for a competent person to understand, intervene in, override, or stop an AI system, with the authority and time to act effectively.

A control design in which a person reviews or approves each material AI output before it takes effect, appropriate where errors carry serious consequences.

The human tendency to over-trust automated output and accept it without adequate scrutiny, which weakens oversight controls unless deliberately countered by training and design.

The policies, roles, committees, and decision rights an organisation establishes to direct and supervise AI use consistently across business units and geographies.

A written internal rule set stating which AI uses are permitted, which are restricted, what approvals are needed, and how exceptions are escalated and recorded.

A responsibility structure in which operational teams own AI risk, a compliance or risk function oversees and advises, and internal audit provides independent assurance.

The named senior individual who owns the organisation's AI risk posture and answers for it to the board, regulators, and affected parties.

A register of every AI system and pilot in the organisation, with owner, purpose, risk tier, and status, forming the basis for scoping compliance work.

The defined process for recording, escalating, and notifying regulators or customers about AI failures or serious harm within required timeframes.

Automatically captured records of AI inputs, outputs, decisions, and human interventions, retained so that conduct can be reconstructed and reviewed later.

The technical practice of recording system events and model activity in sufficient detail and duration to support monitoring, investigation, and evidential needs.

An independent function that tests whether AI controls and governance actually work as described, reporting findings to the board or audit committee.

Information relating to an identified or identifiable individual, which AI training and inference frequently process and which triggers privacy obligations.

The principle of collecting and using only the personal data actually needed for a stated purpose, limiting over-collection in AI training and operation.

The dataset used to fit a model's parameters, whose quality, provenance, representativeness, and lawful basis largely determine downstream compliance and fairness outcomes.

Synthetic or manipulated image, audio, or video content that convincingly depicts real people or events, typically triggering disclosure and labelling duties.

Risk of large-scale harm from a highly capable general-purpose model, addressed through additional evaluation, reporting, and incident-tracking duties for its provider.