AI governance glossary
18 terms buyers meet when evaluating AI governance platforms.
- AI inventory (AI registry)
- A maintained record of an organization’s AI systems, models, agents, and vendor AI, with owners, purpose, risk tier, and lifecycle status.
- AI use case intake
- The process and form through which a new AI use case is proposed, described, and routed for review.
- Risk tiering
- Assigning each AI system a risk level that decides which reviews and controls it needs.
- Model risk management (MRM)
- A discipline, common in banking and insurance, for controlling the risk that models are wrong or misused, through inventory, validation, and ongoing monitoring.
- Model validation
- Independent review and testing of a model’s design, data, performance, and limits before and after it goes into use.
- SR 11-7
- US Federal Reserve supervisory guidance on model risk management, issued in 2011, that many banks map their model governance to.
- AI lifecycle controls
- Required checks at each stage of an AI system’s life, from design and data review through testing, approval, deployment, monitoring, and retirement.
- Third-party AI risk
- Risk from AI that an organization buys or uses through vendors, including AI embedded in SaaS products.
- Shadow AI
- AI tools or systems in use without approval or without a record in the AI inventory.
- AI agent governance
- Oversight of AI agents that take actions, including what tools they can reach, how much autonomy they have, and which actions need approval or can be blocked.
- Runtime guardrails
- Controls that check AI inputs, outputs, or agent actions in production and can block, redact, or escalate them.
- Policy pack
- Pre-built set of requirements and controls for a regulation or standard that a platform can apply to AI systems.
- NIST AI RMF
- The US National Institute of Standards and Technology AI Risk Management Framework, a voluntary framework organized around govern, map, measure, and manage.
- EU AI Act
- The European Union regulation that sets obligations for AI systems based on their risk category.
- ISO/IEC 42001
- An international certification for an AI management system. A vendor holding it is different from a platform that helps customers prepare for it.
- SOC 2 Type II
- An independent auditor’s report on how a company’s security controls operated over a period.
- ISO/IEC 27001
- An international certification for an information security management system.
- FedRAMP
- The US government program that authorizes cloud services for federal agency use, at Low, Moderate, or High impact levels.