ISACA AAIR key terms

A documented structure of policies, roles, decision rights, and oversight mechanisms that directs how an organization develops, deploys, and monitors AI systems to meet its objectives and obligations.

A formal statement approved by senior leadership that sets mandatory rules and expectations for acceptable AI use, accountability, and escalation across the enterprise.

A cross-functional executive body that prioritizes AI initiatives, resolves escalated risks, allocates resources, and holds owners accountable for AI outcomes.

A governance structure separating management ownership of risk (first line), independent risk and compliance oversight (second line), and independent assurance (third line).

The obligation of a named person or role to answer for AI decisions, outcomes, and control effectiveness, including to regulators and affected parties.

The amount and type of AI-related risk an organization is willing to accept in pursuit of its objectives, expressed as qualitative statements or quantitative tolerances.

The specific, measurable boundaries within an approved risk appetite, such as maximum error rates or loss thresholds, used to judge whether a given AI risk is acceptable.

A maintained register of all AI systems and initiatives in the organization, capturing purpose, owner, data, model type, and risk rating to enable oversight.

Stated organizational commitments such as fairness, transparency, privacy, safety, and human well-being that guide AI decisions beyond legal minimums.

Deliberate human involvement in AI operation, ranging from monitoring to approving or overriding outputs, proportionate to the risk and impact of the system.

A control design in which a qualified person reviews and confirms or rejects an AI output before it produces a consequential effect.

The human tendency to over-trust automated output and accept it without adequate scrutiny, weakening the effectiveness of human review controls.

The degree to which AI purpose, data use, logic, limitations, and decision impacts are disclosed clearly to stakeholders, including customers and regulators.

The ability to describe how an AI model produced a specific output in terms a human reviewer, auditor, or affected person can understand and act on.

A property of a model whose internal logic is inherently understandable to humans, such as simple decision trees or linear models, as opposed to opaque deep networks.

Communication to users or affected parties that AI is being used and, where required, what it does, what data it uses, and how to seek recourse.

The condition in which an AI system does not produce unjustified differential outcomes across groups, assessed against defined metrics and protected attributes.

Systematic error or skew in AI data, design, or use that produces unfair or inaccurate outcomes for particular groups or contexts.

A measurable difference in AI outcomes between demographic groups that may indicate discrimination even without intent to discriminate.

Rules defining which AI tools, data, and use cases are permitted or prohibited for employees, including restrictions on confidential data in public models.

AI tools or services used within an organization without governance approval or visibility, creating unmanaged data, legal, and model risks.

A structured evaluation of the likelihood and impact of harms from a specific AI system, including affected stakeholders, data, and control gaps.

A documented review of how an AI system affects individuals, groups, and society, typically covering rights, safety, fairness, and privacy before deployment.

A log of identified AI risks with owners, ratings, controls, and treatment plans that is reviewed and updated throughout the AI life cycle.

The chosen response to an identified risk: mitigate with controls, transfer, avoid the activity, or accept it within approved appetite.

The risk that remains after controls and treatments are applied, which must be compared with tolerance and formally accepted by an accountable owner.

A measurable signal tracked over time, such as model drift rate or override frequency, that provides early warning that AI risk exposure is changing.

A structured record of each model's purpose, version, owner, data sources, validation status, and dependencies, supporting oversight and change management.

The risk of loss or harm from incorrect, misused, or poorly understood model outputs, including errors in design, data, implementation, or interpretation.

Independent testing of a model's conceptual soundness, data quality, and performance against requirements before and after deployment.

Degradation of model performance over time as real-world data or behavior diverges from what the model learned during training.

Continuous tracking of AI system performance, inputs, outputs, and fairness metrics in production, with defined thresholds that trigger investigation or remediation.

Skew or underrepresentation in the data used to build a model that causes systematically inaccurate or unfair outputs for certain groups or situations.

The fitness of data for AI use, judged by accuracy, completeness, relevance, timeliness, and provenance, which directly affects model reliability.

Unauthorized exposure of sensitive data, including through prompts to external AI services or through training data that reveals confidential information.

The risk that AI processing of personal data causes unlawful or unexpected exposure, inference, or profiling of individuals.

An event where an AI system causes or nearly causes harm, such as a harmful output, outage, or discriminatory decision, requiring logging and response.

Documented procedures for detecting, containing, escalating, communicating, and remediating AI incidents, including roles and regulatory notification triggers.

A structured post-incident review that identifies root causes and updates controls, policies, or training so similar AI failures are less likely to recur.

Risk arising from vendors, foundation models, or data providers whose performance, security, and practices the organization does not directly control.