Reference

AI governance glossary: responsible AI terms explained

32 definitions in plain UK English, written for the people who have to make decisions about AI rather than build it — boards, educators, safeguarding leads and public servants.

Read the responsible AI guide How the framework governs AI

Governance and accountability

The structures that decide what AI is allowed to do and who answers for it.

Responsible AI: The practice of designing, deploying and supervising AI so the people affected are protected, informed and able to challenge outcomes. It combines lawfulness, safety, transparency and accountability, and it is evidenced through records rather than asserted through policy statements.
AI governance: The set of structures, roles and controls an organisation uses to keep control of AI as it scales. In practice it means an inventory of AI uses, a risk assessment for each, a named owner, an approval decision, monitoring while it runs and a scheduled review.
AI governance framework: A reusable structure that tells an organisation how to assess, approve, monitor and review AI use. A framework differs from a policy: the policy states the rule, the framework describes the repeatable process that produces evidence the rule was followed.
AI register(AI inventory, use-case register): A single list of every AI use in the organisation, with an owner, a purpose, the data involved and a risk rating. It is normally the first artefact an auditor or regulator asks for, and the hardest to produce retrospectively.
AI policy: A short internal document that states what staff may and may not do with AI, which tools are approved, what data must never be entered, and who to ask. A usable AI policy is measured in pages, not chapters, and is reviewed at least annually.
Human in the loop(HITL): A design in which a person reviews or approves an AI output before it takes effect. Meaningful human review requires the reviewer to have the time, information and authority to disagree — a rubber stamp is not a control.
Accountable owner: The named individual answerable for a specific AI use, including its risks and its outcomes. Accountability cannot be assigned to a committee, a supplier or the model itself; regulators expect a person.
Contestability and redress: One of the UK's five cross-sector AI principles: people affected by an AI-assisted decision must be able to challenge it and get it put right. In practice it needs a published route, a response timescale and a record of the outcome.
EU AI Act: The European Union's risk-tiered AI regulation, imposing duties by risk category from prohibited uses through to minimal-risk systems. UK organisations operating or selling into the EU should map it as an overlay on their existing AI register.

Safeguarding and harm

Terms that describe protecting people — especially children and vulnerable adults.

AI safeguarding: Protecting people — particularly children and vulnerable adults — from harm arising through AI use. It covers detecting risk signals in a conversation, escalating to a named human, keeping evidence of what happened, and limiting what the system holds at all.
Age-appropriate design: Adapting a service so it is suitable for the age of the people using it, as required by the UK's Children's Code. For AI assistants this means restrained defaults, no profiling for engagement, and content and tone matched to developmental stage.
Escalation route: The defined path a flagged concern takes from the AI system to a responsible human, with a timescale attached. Without a timescale and a named recipient, an escalation route is a log entry rather than a safeguarding control.
Guardrail: A constraint that stops an AI system doing something harmful — refusing categories of request, blocking outputs, or forcing an escalation. Guardrails sit outside the model's judgement, which is why they hold when the model is wrong.
Consent-driven memory: An approach where an assistant only retains information about a person that they have knowingly agreed it may keep, and can remove on request. It reduces both data protection exposure and safeguarding risk by limiting what exists to be misused.

Data protection and UK law

The UK GDPR vocabulary that AI projects are assessed against.

UK GDPR: The UK's data protection regime, sitting alongside the Data Protection Act 2018. It governs any AI use involving personal data, requiring a lawful basis, transparency, purpose limitation, minimisation and safeguards for automated decisions with significant effects.
DPIA(Data Protection Impact Assessment): A structured assessment of how a project affects people's privacy, required under UK GDPR where processing is high risk — which most AI involving personal data is. It records the purpose, the risks, the mitigations and the residual risk accepted, before launch.
Lawful basis: The specific legal ground relied on to process personal data, such as consent, contract, legal obligation, vital interests, public task or legitimate interests. It must be identified before processing begins and cannot be swapped later for convenience.
Data minimisation: The UK GDPR requirement to collect and keep only the personal data actually needed for the stated purpose. For AI, it is the cheapest control available: data an assistant never receives cannot leak, drift into training, or appear in an audit finding.
Automated decision-making(ADM): A decision made about someone by a system without meaningful human involvement. Where it has legal or similarly significant effects, UK GDPR restricts it and gives people the right to an explanation, human review and a challenge.
Subject access request(SAR): A person's right to ask what personal data you hold about them and receive a copy, normally within one month. AI conversation logs count, so systems that cannot search their own history create an immediate compliance problem.

Models and behaviour

How AI systems actually work, in language that survives a board meeting.

Large language model(LLM): A model trained on very large amounts of text that predicts likely continuations, which makes it fluent in language and useful for reasoning-shaped tasks. It has no inherent access to truth, so accuracy depends on the information and controls placed around it.
Hallucination(confabulation): A confident but false AI output — an invented citation, statistic, policy or case. It is a predictable property of language models, not a bug to be fully removed, so responsible use pairs generation with sources, verification or human review.
Prompt injection: An attack in which instructions hidden in content the AI reads — a web page, document or email — override the instructions it was given. It is the main security reason AI systems must not hold credentials or act on untrusted text without limits.
Retrieval-augmented generation(RAG): A pattern where an assistant retrieves relevant documents and answers from them, rather than from memory alone. It improves accuracy and makes answers traceable to a source, which is why it suits governed and regulated environments.
Model drift: The gradual decline in a system's suitability as the world, the data or the underlying model changes. Drift is why AI governance requires scheduled review: a use case approved a year ago may now be operating outside its assessment.
Hyper-personalisation: Adapting a system's content, tone and pacing to an individual's context, needs and preferences rather than to a broad segment. Done responsibly it improves access and comprehension; done carelessly it becomes profiling and requires a lawful basis.

Assurance and evidence

How you prove, after the fact, that the system behaved as claimed.

Explainability: The ability to describe, in terms the affected person can understand, why a system produced a particular outcome. Explainability is a communication requirement as much as a technical one — an accurate explanation nobody understands does not satisfy it.
Audit trail: A durable record of what a system did and why: inputs, decisions, escalations and the humans involved. A useful audit trail can be reconstructed months later by someone who was not present, without relying on anyone's memory.
Decision trace: A per-interaction record of how an output was reached — which knowledge, policies and checks applied. It is finer-grained than an audit trail and is what makes an individual AI-assisted decision defensible rather than merely logged.
Assurance: Independent confirmation that AI controls exist and work, through testing, review, internal audit or third-party assessment. Assurance is what turns a self-declared responsible AI position into something a partner or regulator can rely on.
Bias and fairness testing: Checking whether a system produces materially worse outcomes for particular groups, and acting on what you find. Under the Equality Act, an AI system that disadvantages a protected group is your responsibility even if a supplier built it.
AI transparency notice: A plain-English statement telling people when AI is involved, what it does, what data it uses and how to challenge it. It is the most visible responsible AI control, and usually the cheapest to get right.