Glossary: the words you'll see, in plain language

People and roles under the AI Act

• Provider: whoever develops an AI system (or has it developed) and puts it on the market or into service under their own name.
• Deployer: whoever uses an AI system in their work. Most companies are deployers of tools they buy.
• Importer / distributor: bring an AI system made outside the EU into the EU market, or pass it along the supply chain.
• Affected person: someone the AI system makes decisions about, such as a job applicant or loan customer.

Risk words

• Prohibited practice: an AI use banned outright by Article 5, such as social scoring.
• High-risk AI system: AI used in an area listed in Annex III (such as hiring or credit), or as a safety component of a regulated product (Annex I). These carry the heaviest obligations.
• Limited risk: AI with transparency duties, such as chatbots and generated content.
• Minimal risk: everything else. No specific AI Act duties beyond AI literacy, though good practice still applies.
• GPAI model: a general-purpose AI model, such as a large language model, that can be used for many tasks.

Documents and processes

• Control: a specific thing you do to meet a requirement, such as "a human reviews every declined application".
• Evidence: proof that a control is in place: a policy, a log export, a screenshot, a test result.
• Finding: a gap or problem you've found that needs fixing.
• Remediation task: a piece of work to fix a finding, with an owner and a due date.
• FRIA: fundamental rights impact assessment (Article 27), required for some deployers of high-risk AI.
• DPIA: data protection impact assessment under GDPR Article 35.
• Technical documentation (Annex IV): the file a provider of a high-risk system must keep, describing how it was built and tested.
• Conformity assessment: the check, done internally or by a notified body, that a high-risk system meets the requirements before it is placed on the market.
• Serious incident: an AI failure that causes death, serious harm, a breach of fundamental rights or serious disruption. Providers must report these (Article 73).
• Post-market monitoring: ongoing checks that a system keeps working as intended after release.

In V77 Trust

• Assessment: the set of controls that apply to one system, with their status.
• Proof Seal: a timestamped fingerprint of evidence that anyone can verify.
• AI passport: a signed summary of a system's compliance status you can share with customers.
• Activity log: the tamper-evident record of every change in your workspace.