Definitions for compliance teams.

A maintained register of AI systems, models, agents, vendors, owners, use cases, risk status, controls, and evidence. It is the operating base for AI governance.

Software that uses machine-learning, logic, statistical, or related techniques to generate outputs such as predictions, recommendations, content, or decisions for a defined objective.

The EU AI Act annex that lists high-risk use-case areas, including employment, education, critical infrastructure, essential services, law enforcement, migration, justice, and democratic processes.

The EU AI Act annex describing technical documentation expected for high-risk AI systems, including system purpose, design, data, validation, risk controls, and monitoring.

The EU AI Act article that sets out prohibited AI practices, including bans tied to manipulation, exploitation, social scoring, and certain biometric uses.

The EU AI Act article that establishes administrative fines, including the highest tier for prohibited-practice violations.

A documented management system for governing AI policies, roles, risks, controls, reviews, audits, and continual improvement.

An emerging assurance standard for AI agents and AI systems, often described as SOC 2-like assurance for AI-specific controls.

AI that can pursue goals through multi-step planning, tool use, memory, workflow execution, or autonomous action rather than only returning a single answer.

Records, approvals, logs, tests, source data, exports, and documentation that show a control was designed, operating, and reviewed.

Measured business activity used in emissions calculations, such as kilowatt-hours, gallons, miles, tonnes, supplier spend, or units purchased.

A Scope 3 estimation method that uses average emissions intensities for goods, services, or activities when company-specific supplier data is incomplete.

The practice of linking policies, procedures, tests, owners, and evidence to requirements across multiple standards or regulatory frameworks.

Corporate Sustainability Reporting Directive. The EU law expanding sustainability reporting, assurance, and ESRS-aligned disclosure requirements.

A disclosure platform and questionnaire process used by companies, investors, and customers to report climate, water, forests, and supply-chain data.

Carbon Border Adjustment Mechanism. An EU policy applying carbon-related obligations to certain imported goods in carbon-intensive sectors.

A party using an AI system under its authority in a professional context. Deployers usually own the operational controls, monitoring, and use-context evidence.

A CSRD/ESRS concept requiring companies to assess both financial materiality and impact materiality across sustainability topics.

A traceable record showing where data came from, how it changed, what assumptions were applied, and which outputs it supports.

A quantified emissions-reduction goal, often tied to a baseline year, target year, scope coverage, and reduction pathway.

A coefficient that converts activity data, such as fuel, electricity, spend, distance, or mass, into estimated greenhouse gas emissions.

European Sustainability Reporting Standards. The detailed disclosure standards that operationalize CSRD reporting requirements.

EU Deforestation Regulation. A regulation requiring due diligence for certain commodities and products linked to deforestation risk.

Fundamental Rights Impact Assessment. A structured assessment of how an AI system may affect people’s rights, especially before certain high-risk deployments.

General-purpose AI: AI models or systems capable of serving many downstream tasks and integrating into many products, workflows, or services.

A widely used greenhouse gas accounting framework covering corporate inventories, Scope 1, Scope 2, and Scope 3 value-chain emissions.

Global Reporting Initiative. A sustainability reporting framework focused on organizational impacts on the economy, environment, and people.

AI used in regulated contexts where errors can materially affect safety, fundamental rights, employment, education, access to services, law enforcement, or similar protected domains.

Controls that keep accountable people able to understand, supervise, challenge, override, or stop AI-supported actions where risk requires it.

A Scope 3 method that combines supplier-specific data with secondary estimates for missing inputs, often improving accuracy over purely spend-based calculations.

The international standard for an AI Management System, used to structure AI governance, risk management, controls, audits, and continual improvement.

International Sustainability Standards Board. The IFRS body that issued IFRS S1 and IFRS S2 for global sustainability-related financial disclosures.

The ISSB standard for general requirements for disclosure of sustainability-related financial information.

The ISSB standard for climate-related disclosures, including governance, strategy, risk management, metrics, and targets.

A Scope 2 calculation method using average grid emission factors for the physical location where electricity is consumed.

An external assurance engagement that provides a lower level of confidence than reasonable assurance, often used for early sustainability reporting periods.

A concise document describing a model’s intended use, limitations, data, evaluation results, risks, and responsible-use guidance.

Model Context Protocol. A protocol pattern for connecting AI agents and assistants to external tools, data sources, and actions.

A Scope 2 calculation method reflecting contractual electricity instruments, supplier-specific emission rates, and renewable energy purchases where applicable.

The National Institute of Standards and Technology AI Risk Management Framework, organized around Govern, Map, Measure, and Manage.

An AI practice banned outright under the EU AI Act because it creates unacceptable risk, such as certain manipulative, exploitative, social-scoring, or biometric practices.

A party that develops or places an AI system or general-purpose AI model on the market or puts it into service under its own name or trademark.

Ongoing tracking of AI system performance, incidents, changes, risks, and control effectiveness after release or deployment.

The process of assigning an AI system to a regulatory or governance risk tier based on intended purpose, context, users, impacts, and applicable frameworks.

AI tools, agents, models, or vendor features used without formal registration, ownership, review, or governance approval.

Direct greenhouse gas emissions from sources an organization owns or controls, such as boilers, furnaces, vehicles, or process emissions.

Indirect greenhouse gas emissions from purchased electricity, steam, heating, or cooling consumed by the reporting organization.

Indirect greenhouse gas emissions across the value chain, including purchased goods, transportation, product use, waste, travel, investments, and other categories.

A Scope 3 estimation method that applies industry or product-category emission factors to financial spend when primary supplier activity data is unavailable.

Science Based Targets initiative. A body that validates corporate emissions-reduction targets against climate science-based pathways.

Sustainability Accounting Standards Board standards, now under the IFRS Foundation, focused on financially material industry-specific sustainability topics.

Structured evidence describing how an AI system is designed, trained or configured, tested, controlled, monitored, and governed.

Uyghur Forced Labor Prevention Act. A U.S. import law requiring supply-chain evidence for goods connected to forced-labor risk.