Which terms does the website use, and where?
This glossary explains 29 core terms from the AI compliance pages. The third column shows where each term is most relevant.
| Term | Definition | Where used |
|---|---|---|
| AI Compliance Staircase | Maturity model by Mag. Eiler & Partner OG mapping the four Gartner analytics stages (descriptive, diagnostic, predictive, prescriptive) to the obligations under the EU AI Act, GDPR and DORA that apply at each stage. | |
| AI Management System (AIMS) | A systematic management framework for responsible development, implementation, and use of AI in an organisation. It follows the High-Level Structure known from standards such as ISO 9001 and ISO 27001. | |
| Annex A Controls (ISO/IEC 42001) | 38 control objectives across 9 control areas that specify operational AI governance requirements. Their application is justified in the Statement of Applicability on a risk basis. | |
| Annex III (EU AI Act) | The list of standalone high-risk AI categories under the EU AI Act. For financial institutions, creditworthiness assessment, life and health underwriting, and HR decisions are particularly relevant. | |
| Automation bias | A cognitive bias: the tendency to accept automated system outputs without sufficient challenge. It can weaken human oversight and should be addressed through training, sampling, and clear override rights. | |
| Deployer | The organisation that uses an AI system under its own responsibility. Deployers are distinct from providers and have separate compliance duties under Art. 26 EU AI Act. | |
| Business judgment rule | A liability privilege for business decisions where corporate bodies act without extraneous interests, on adequate information and for the benefit of the company. | |
| CEN/CENELEC | European standardisation organisations that develop harmonised standards under EU mandates. In the AI context, they are relevant for European standards under the EU AI Act. | |
| Conformity assessment | The procedure used to demonstrate that a high-risk AI system meets the EU AI Act requirements. Depending on the system, this may be a self-assessment or involve a notified body. | |
| Digital Omnibus on AI | Regulation (EU) 2026/1744, published on 24 July 2026 and in force since 27 July 2026. It amends the AI Act and postpones the high-risk deadlines to 2 December 2027 (Annex III) and 2 August 2028 (Annex I). Art. 4, Art. 5 and the Art. 50 transparency duties were not postponed. | |
| Transparency guidelines and EU icons (Art. 50) | Final Commission guidelines on the Art. 50 transparency obligations of 20 July 2026: provider duties (interaction notice, machine-readable marking) and deployer duties (emotion recognition, deepfakes, published AI-generated text on matters of public interest, with an exception where editorial responsibility applies). The EU icons available since September 2026 are optional; using them does not in itself establish compliance. | |
| Code of Practice on Transparency (Art. 50) | Voluntary Commission code on marking and labelling AI-generated content, finalised on 10 June 2026 with around 190 signatories by the end of July 2026. It gives practical shape to the Art. 50(2), (4) and (5) transparency duties that have applied since 2 August 2026; not to be confused with the GPAI Code of Practice of 10 July 2025. | |
| High-risk guidelines (Art. 6, draft) | Commission draft of 19 May 2026 on the classification of high-risk AI systems under Art. 6, with practical examples including creditworthiness and employment and guidance on documenting exemptions under Art. 6(3). Consultation extended until 23 July 2026; the Commission plans the final version by the end of 2026, it was still pending on 20 October 2026 and the draft is not binding. | |
| Serious-incident reporting templates (Art. 73 / Art. 55) | Commission draft guidance and reporting template for serious incidents involving high-risk AI under Art. 73 (26 September 2025, final version pending) and a separate reporting template for GPAI models with systemic risk under Art. 55 (4 November 2025). A reference for internal templates and for separating AI Act, GDPR, DORA and NISG reports. | |
| CSRD / ESRS bias relevance | AI-related discrimination or human-rights risks can also matter for sustainability reporting when they affect social impacts, governance, due diligence, risk management, or auditable metrics – provided the company is subject to the CSRD at all after its narrowing by Directive (EU) 2026/470 (EU companies: more than 1,000 employees and more than EUR 450 million net turnover) and the impact is material. | |
| FRIA (Art. 27 EU AI Act) | Fundamental Rights Impact Assessment: an impact assessment for certain deployers of high-risk AI, especially creditworthiness assessment and life or health insurance risk assessment, before use. | |
| Gap analysis | A structured comparison between the current state and the requirements of a standard or regulation. The result is a prioritised list of gaps and actions. | |
| Harmonised standard | A standard developed by CEN/CENELEC and published in the Official Journal of the EU. For specified requirements, it can create a presumption of conformity. | |
| High-Level Structure (HLS) | The common chapter structure of modern ISO management system standards. It helps integrate ISO 9001, ISO 27001, and ISO/IEC 42001 into one management system. | |
| Internal control system | A system of organisational rules, controls, responsibilities and evidence used to manage risks and make processes auditable. | |
| Supervisory board | The corporate body that oversees management and relies on robust reporting, inspection rights and, where applicable, approval requirements. | |
| Audit committee | A supervisory-board committee for audit, reporting and control topics. In AI governance, it is relevant where AI affects controls, risk management or reporting. | |
| Three-lines model | A governance model with operational responsibility in the first line, risk/compliance control in the second line and independent assurance in the third line. | |
| Presumption of conformity | A legal presumption that requirements are met when a harmonised standard is applied. The concrete effect depends on the relevant standard and its publication. | |
| New Legislative Framework (NLF) | EU regulatory model: legislation defines essential requirements, while harmonised standards specify practical implementation. It is the basis for CE marking and conformity assessment. | |
| EN 18286:2026 | European standard "Artificial intelligence – Quality management system for EU AI Act regulatory purposes", announced as published by CEN/CENELEC on 31 July 2026 (formerly prEN 18286). It addresses in particular Art. 17 for providers of high-risk AI. Its reference was published in the Official Journal of the EU by Implementing Decision (EU) 2026/2274 on 14 October 2026; since then it has conferred a presumption of conformity for the Art. 17 requirements it covers. | |
| Statement of Applicability (SoA) | A document listing all ISO/IEC 42001 Annex A controls and explaining for each control whether and how it is applied or excluded. | |
| Vendor AI / Shadow AI | AI components in purchased software or unapproved tools that have not been explicitly identified, classified, or approved. They are a central source of shadow AI risk. | |
| WEIRD bias | Systematic bias in machine-learning models caused by training data from Western, Educated, Industrialized, Rich, Democratic contexts. It can lead to structural disadvantage. |
How to use this glossary
For practical classification, the system purpose, actual use, vendor documentation, role allocation, and business process always remain decisive.
Ing. Mag. Patrick Eiler
Patrick Eiler advises banks and insurers in Vienna on regulatory reporting, data architecture and AI compliance. More than twenty years in banking, insurance and financial services; speaker at the Hypo-Verband (expert session of 23 September 2026).