EU AI Act & GDPR Glossary

Laws, standards & frameworks

EU AI Act

AIA

AI ActRegulation (EU) 2024/1689

The EU's horizontal law on artificial intelligence, in force since 1 August 2024 and applying in phases until 2028. It regulates AI systems by risk level and general-purpose AI models by capability, using machinery borrowed from EU product-safety law: CE marking, notified bodies and market surveillance.

Often confused with

General Data Protection Regulation

GDPR protects people's personal data in any processing. The AI Act regulates AI systems as products, by risk. When AI processes personal data, both apply at once.

Connected terms · 7

AI Office AI system Council of Europe Framework Convention on AI Digital Omnibus New Legislative Framework Product Liability Directive (revised)Risk-based approach

Interactive 3D map of 206 EU AI Act, GDPR and Shadow AI terms and how they connect. Search a term like DPIA or click a node to read its definition.

Core concepts

AI system
General-purpose AI model (GPAI)
General-purpose AI system (GPAI system)
Large language model (LLM)
Generative AI (GenAI)
Placing on the market
Making available on the market
Putting into service
Intended purpose
Reasonably foreseeable misuse
Substantial modification
Safety component
Risk-based approach
Risk
Extraterritorial scope
Scope exclusions
Free and open-source exemption

Roles & actors

Operator
Provider
Deployer
Importer
Distributor
Authorised representative
Product manufacturer
Downstream provider
Becoming a provider
Affected person
Controller
Processor
Joint controllers
Sub-processor
Data subject
Data Protection Officer (DPO)

Risk tiers & bans

Unacceptable risk
Manipulative or deceptive techniques
Exploiting vulnerabilities
Social scoring
Crime prediction from profiling
Untargeted facial image scraping
Emotion recognition at work or school
Sensitive biometric categorisation
Real-time biometric identification by police
Non-consensual intimate imagery and CSAM (NCII, CSAM)
High-risk AI system
Annex I (product safety route)
Annex III (use-case route)
Article 6(3) filter
Limited risk
Deep fake
Minimal risk
Systemic risk
High-impact capabilities
Floating-point operations (FLOP, FLOPs)

Obligations & assessments

AI literacy
Risk management system (RMS)
Data and data governance
Record-keeping (logging)
Human oversight
Accuracy, robustness and cybersecurity
Quality management system (QMS)
Conformity assessment
Post-market monitoring
Serious incident reporting
Corrective actions, withdrawal and recall
Fundamental rights impact assessment (FRIA)
Transparency obligations (Article 50)
Right to explanation
GPAI model obligations
Systemic-risk model obligations
Copyright compliance policy
Data protection by design and by default (DPbD, PbD)
Data Protection Impact Assessment (DPIA)
Records of processing activities (RoPA, ROPA)
Personal data breach notification
Legitimate interests assessment (LIA)
Transfer impact assessment (TIA)

Documents & marks

Technical documentation
Instructions for use
EU declaration of conformity
CE marking (CE)
Training data summary
GPAI model documentation
Model cards and datasheets
Data processing agreement (DPA)
Standard contractual clauses (SCCs)

Data & biometrics

Personal data
Special categories of personal data
Non-personal data
Processing
Pseudonymisation
Anonymisation
Profiling
Biometric data
Biometric identification
Biometric verification
Remote biometric identification (RBI)
Biometric categorisation
Emotion recognition system
Publicly accessible space
Training data
Validation data
Testing data
Input data
Data provenance and lineage

GDPR principles & rights

Data protection principles
Lawfulness, fairness and transparency
Purpose limitation
Data minimisation
Accuracy (GDPR)
Storage limitation
Integrity and confidentiality (security)
Accountability
Lawful basis
Consent
Legitimate interests
Data subject rights (DSR)
Right of access (SAR, DSAR)
Right to erasure
Automated decision-making (ADM)
International data transfers
Adequacy decision

Authorities & enforcement

AI Office
European Artificial Intelligence Board
Scientific panel of independent experts
Advisory forum
National competent authorities (NCA)
Market surveillance authority (MSA)
Notifying authority
Notified body
EU database for high-risk AI systems
Data protection authority (DPA, SA)
Lead supervisory authority
European Data Protection Board (EDPB)
AI Act penalties
GDPR fines
AI regulatory sandbox
Testing in real-world conditions
General-Purpose AI Code of Practice
Voluntary codes of conduct
AI Pact

Techniques & safeguards

Privacy-enhancing technologies (PETs)
Differential privacy (DP)
Federated learning (FL)
Synthetic data
Homomorphic encryption (HE, FHE)
Secure multi-party computation (SMPC, MPC)
Encryption at rest and in transit
Role-based access control (RBAC)
Red teaming and adversarial testing
Watermarking and content credentials (C2PA)
Explainability (XAI)
Human-in-the-loop (HITL, HOTL)
Automation bias
Bias and fairness testing
Machine unlearning
Membership inference and model inversion
Hallucination

Laws, standards & frameworks

EU AI Act (AIA)
General Data Protection Regulation (GDPR)
New Legislative Framework (NLF)
Digital Omnibus
EDPB Opinion 28/2024 on AI models
Digital Services Act (DSA)
Product Liability Directive (revised) (PLD)
AI Liability Directive (AILD)
Cyber Resilience Act (CRA)
NIS2 Directive (NIS2)
Data Act
Text and data mining opt-out (TDM)
Medical Device Regulations (MDR, IVDR)
Harmonised standards
Common specifications
CEN-CENELEC JTC 21 (JTC 21)
ISO/IEC 42001
ISO/IEC 23894
ISO/IEC 27001 and 27701
NIST AI Risk Management Framework (AI RMF)
OECD AI Principles (OECD)
Council of Europe Framework Convention on AI
US CLOUD Act (CLOUD Act)

Shadow AI & controls

Shadow AI
Sanctioned AI use
Contained AI
Personal account use
Enterprise AI licence
Desktop AI app
Coding agent
TLS inspection
Secure web gateway (SWG)
Certificate pinning
Mutual TLS (mTLS)
Data loss prevention (DLP)
Endpoint DLP
Sensitivity label
Sensitive information pattern
Endpoint data lineage
Data laundering
Analog hole
Genesis problem
Taint explosion
On-device intent classifier (SLM)
LLM gateway
Prompt masking
Managed settings
Enterprise browser
AI usage record