AI Literacy
The skills, knowledge and understanding that allow staff to use AI systems informedly and to recognise their risks. Providers and deployers must take measures to support its development (Article 4, EU AI Act).
AI System
A machine-based system that operates with some autonomy and infers, from the input it receives, how to generate outputs such as predictions, content, recommendations or decisions (Article 3(1), EU AI Act).
AI Transparency Obligations
The duty to disclose certain uses of AI: telling people when they are interacting with a machine, marking synthetic content in a machine-readable format, and labelling deepfakes and AI-generated text published to inform the public on matters of public interest (Article 50, EU AI Act).
Artificial Intelligence Act (AI Act)
The EU’s risk-based law for AI systems, which applies alongside GDPR rather than replacing it. Its bans on unacceptable-risk AI have applied since 2 February 2025 and its transparency duties since 2 August 2026; Regulation (EU) 2026/1744 moved most high-risk obligations to 2 December 2027 (Annex III) and 2 August 2028 (Annex I), and new bans on AI-generated child sexual abuse material and non-consensual intimate imagery apply from 2 December 2026 (Regulation (EU) 2024/1689, Articles 5, 50).
Automated Decision-Making & Profiling
Decisions made about a person using only automated systems (like AI or algorithms), without meaningful human involvement (Article 22).
Biometric Data
Personal data from physical or biological characteristics — fingerprints, facial images, iris scans — used to uniquely identify a person. A special category of sensitive data (Article 4(14); Article 9).
Deployer
Any organisation using an AI system under its own authority in the course of its activities. Most businesses using off-the-shelf AI tools are deployers rather than providers (Article 3(4), EU AI Act).
Digital Operational Resilience Act (DORA)
An EU regulation requiring banks, insurers, payment institutions and other financial entities to manage ICT risk and report major ICT-related incidents, applicable since 17 January 2025 alongside their existing GDPR duties (Regulation (EU) 2022/2554).
Facial Recognition Technology
Technology that identifies or verifies a person from their facial features — treated as biometric, special category data processing under GDPR when used to uniquely identify someone (Article 9).
General-Purpose AI Model (GPAI)
An AI model trained on large amounts of data that displays significant generality and can competently perform a wide range of distinct tasks — the kind of model behind general-purpose chat assistants (Article 3(63), EU AI Act).