Home › Move Into AI Governance › AI Governance & GRC Glossary

AI Governance & GRC Glossary

By GRC Careers · October 29, 2026

Understand the terms. Recognize the work. Explore the roles.

A job description can make familiar work sound unfamiliar. You may have assessed risks, documented decisions, checked a supplier's practices, or made sure someone followed the rules. In AI governance, those responsibilities come with terminology that can take some getting used to.

This glossary explains that language and connects it to work people actually do. Each entry includes a plain-English explanation, a workplace example, and the roles where you might encounter it.

You do not need to learn every term before exploring a career in this field. Start with the ones appearing in the roles that interest you.

These are GRC Careers' explanatory summaries, rather than quotations of official definitions. Meanings can vary across laws, standards, and professional settings. Workplace examples are illustrative, and role responsibilities vary by employer.

Accountability

What it means: Being answerable for decisions and actions involving AI, with responsibilities assigned and evidence showing how those responsibilities were fulfilled. Accountability follows people and organisations throughout an AI system's life.

At work: An organisation identifies who approves an AI hiring tool, who monitors its performance, and who must respond when applicants report a problem. It records those decisions.

Where it appears in roles: AI governance managers, risk leaders, business owners, and compliance officers may establish responsibilities, document approvals, and track unresolved issues.

Common confusion: Assigning someone a task does not, by itself, establish accountability. They also need appropriate authority, reporting arrangements, and a way to demonstrate what happened.

Related terms: AI governance; human oversight; transparency.

AI governance

What it means: The arrangements an organisation uses to direct and oversee AI: its policies, decision rights, responsibilities, and review processes.

At work: Before a department introduces an AI assistant, it follows an approval process covering intended use, sensitive information, testing, and ongoing responsibility.

Where it appears in roles: AI governance analysts and managers may maintain policies, coordinate reviews, and help departments follow approval processes.

Common confusion: Governance is broader than compliance. It also addresses decisions about acceptable uses, responsibilities, and organisational priorities.

Related terms: Accountability; AI risk management; human oversight.

AI impact assessment

What it means: A structured examination of how an AI system could affect people, groups, organisations, or the environment in its intended setting.

At work: Before adopting an AI scheduling tool, a team examines whether its recommendations could disadvantage employees with disabilities or caregiving responsibilities.

Where it appears in roles: Responsible AI specialists, governance analysts, privacy professionals, and risk managers may gather evidence, consult affected groups, and recommend safeguards.

Common confusion: An impact assessment is broader than a technical performance test. A system can produce accurate results while still creating harmful consequences in its particular use.

AI inventory

What it means: A maintained record of the AI systems an organisation builds or uses, with enough detail to govern them: what each one does, who owns it, what data it touches, and how risky its use is.

At work: A compliance lead surveys departments and finds AI features switched on inside the HR platform, the customer service software, and a marketing tool nobody had reported. Each one goes into the inventory with a named owner.

Where it appears in roles: AI governance analysts and IT asset or procurement teams may build and maintain the inventory, then use it to decide which systems need review first.

Common confusion: An inventory is not a one-time list. AI features arrive through software updates and new subscriptions, so the record needs a regular way to catch additions.

Related terms: Shadow AI; AI governance; third-party AI risk.

AI literacy

What it means: The knowledge and judgment people need to use AI systems sensibly and to recognize their risks and limits. Under the EU AI Act, as amended in 2026, providers and deployers must take measures to support AI literacy among the people who operate and use AI systems on their behalf, taking account of those people's knowledge, experience, training, and the context of use.

At work: A hospital trains the staff who use an AI documentation assistant on what it gets wrong, which patient information must never go into it, and how to report a bad output. It keeps a record of who completed the training.

Where it appears in roles: AI governance managers, learning and development teams, compliance officers, and HR professionals may design training for different jobs and track who completed it.

Common confusion: The EU AI Act does not require an individual professional certificate for AI literacy, and since the 2026 amendment it does not require organisations to guarantee a specific level of literacy for each person. Organisations can document their training internally.

Related terms: EU AI Act; human oversight; deployer.

AI management system (ISO/IEC 42001)

What it means: A set of policies, objectives, roles, and processes an organisation uses to govern its AI activities in a consistent, repeatable way. ISO/IEC 42001:2023 is the international standard that specifies requirements for one.

At work: A software company that already runs an ISO/IEC 27001 information security program extends its policies and internal audits to cover the AI features it sells, then prepares for a certification audit.

Where it appears in roles: AI governance managers, ISO program leads, internal auditors, and GRC consultants may write the policies and run the internal audits that certification depends on.

Common confusion: ISO/IEC 42001 certification shows that an organisation's management system meets the standard. It is not a certificate that any particular AI system is safe or lawful.

Related terms: AI governance; AI risk management; conformity assessment.

AI risk management

What it means: The continuing work of identifying, assessing, prioritizing, and addressing risks associated with AI, including monitoring whether safeguards remain effective.

At work: A team identifies the risk that an AI assistant could reveal confidential information, introduces access restrictions, tests them, and monitors incidents.

Where it appears in roles: AI risk analysts, GRC analysts, and enterprise risk managers may maintain risk registers, assess proposed uses, and follow up on corrective actions.

Common confusion: Completing a risk assessment is one activity within risk management. The work continues as systems, users, and circumstances change.

Bias in AI

What it means: Systematic patterns in data, systems, or human decisions that can skew AI outcomes. Harmful bias can arise from social structures, computational methods, and human judgment, even without discriminatory intent.

At work: A recruitment team investigates whether a screening tool consistently rates qualified applicants from certain backgrounds less favorably. It examines the data, evaluation methods, and hiring process.

Where it appears in roles: Responsible AI analysts, model validators, data scientists, and HR governance professionals may investigate unequal outcomes and help design corrective measures.

Common confusion: Removing a sensitive attribute from a dataset does not necessarily remove harmful bias. Other information may act as a substitute, and problems may originate elsewhere in the process.

Conformity assessment

What it means: Under the EU AI Act, the process a provider of a high-risk AI system follows to demonstrate that the system meets the Act's requirements before it is placed on the market or put into service. For most high-risk systems the provider carries this out through internal checks; some, such as certain biometric systems, can involve an independent notified body.

At work: A company selling an AI tool that screens job applicants in the EU compiles its technical documentation and test results, confirms the requirements are met, and draws up an EU declaration of conformity.

Where it appears in roles: Regulatory compliance managers, product compliance specialists, quality managers, and AI governance leads at AI providers may coordinate the evidence and sign-off.

Common confusion: Conformity assessment is the provider's job. An organisation that only uses a high-risk system (a deployer) has its own duties, but it does not carry out the provider's conformity assessment.

Related terms: High-risk AI system; provider; EU AI Act.

Data governance

What it means: The rules and responsibilities that decide how data is obtained, checked for quality, protected, and used. For AI, it covers the data used to train and run systems.

At work: Before a model is trained on customer records, a data governance lead confirms where the data came from, whether its use is permitted, how gaps and errors were handled, and who approved it.

Where it appears in roles: Data governance analysts and managers, data stewards, privacy professionals, and AI governance teams may define data standards, document lineage, and approve uses.

Common confusion: Data governance is not the same as data security. Security protects data from unauthorized access; governance decides what data should be used, for what, and to what quality standard.

Data protection impact assessment (DPIA)

What it means: Under the EU General Data Protection Regulation (GDPR), an assessment an organisation must carry out before processing personal data in a way likely to result in a high risk to people's rights and freedoms. Many AI uses that involve personal data fall into that category.

At work: Before introducing an AI tool that analyzes employee performance, an organisation's privacy team documents what data the tool uses, the risks to employees, and the measures that reduce them, and consults the data protection officer.

Where it appears in roles: Privacy analysts, data protection officers, privacy counsel, and AI governance professionals may draft and approve DPIAs.

Common confusion: A DPIA focuses on personal data and privacy rights. An AI impact assessment can be broader, covering effects that have nothing to do with personal data. Many organisations coordinate the two.

Related terms: AI impact assessment; data governance; deployer.

Deployer

What it means: Under the EU AI Act, an organisation or person that uses an AI system under its own authority in a professional setting. A company that buys an AI hiring tool and uses it on applicants is a deployer of that tool.

At work: A bank using a third-party credit scoring model assigns trained staff to oversee it, keeps the logs the system generates, and informs applicants where the rules require it.

Where it appears in roles: Compliance officers, AI governance managers, operational managers, and procurement teams at organisations that use AI may manage deployer obligations.

Common confusion: Buying an AI system does not hand all responsibility to the vendor. Deployers of high-risk systems have their own duties, including assigning human oversight to people with the necessary competence, training, and authority.

Related terms: Provider; human oversight; high-risk AI system.

EU AI Act

What it means: The European Union's regulation on artificial intelligence, Regulation (EU) 2024/1689. It sorts AI uses by risk: it bans a short list of practices, sets detailed requirements for high-risk systems, adds transparency duties for some others, and covers general-purpose AI models. It was amended in 2026 by Regulation (EU) 2026/1744, which, among other things, moved the main high-risk deadlines to December 2, 2027 and August 2, 2028.

At work: A U.S. software company that sells to European customers works out whether any of its products count as high-risk under the Act and what that means for its documentation and contracts.

Where it appears in roles: AI governance managers, regulatory counsel, privacy and compliance professionals, and product teams selling into Europe may interpret the Act and plan for its deadlines.

Common confusion: The Act can apply to organisations outside the EU, for example when they place AI systems on the EU market or when their systems' outputs are used in the EU.

Explainability

What it means: Providing an understandable account of the mechanisms behind an AI system's operation. The explanation should suit the audience and the question being asked.

At work: A lending team asks which inputs influenced a model's recommendation and whether the explanation accurately reflects how the model works.

Where it appears in roles: Model risk specialists, validators, responsible AI professionals, and technical teams may develop or evaluate explanations.

Common confusion: A convincing explanation is not necessarily an accurate explanation. Governance work includes checking whether the explanation is supported by evidence.

Related terms: Interpretability; transparency; accountability.

High-risk AI system

What it means: Under the EU AI Act, an AI system used in an area where errors can seriously affect people's health, safety, or fundamental rights. The Act lists areas such as hiring and worker management, education, access to essential services including credit, critical infrastructure, law enforcement, migration, and the administration of justice. AI used as a safety component of certain regulated products, such as medical devices or machinery, also qualifies.

At work: A university checks whether the AI tool it plans to use for scoring admissions applications falls into the education category, and if so, what its duties as a deployer will be.

Where it appears in roles: AI governance leads, regulatory compliance managers, and counsel may classify systems and plan the controls that a high-risk classification requires.

Common confusion: Whether a system is high-risk depends on how it is used. The same model can be high-risk when it screens job applicants and low-risk when it drafts marketing copy.

Related terms: EU AI Act; conformity assessment; deployer; provider.

Human oversight

What it means: Arrangements that enable people to supervise AI use and intervene when appropriate. Effective oversight depends on people having suitable knowledge, authority, and practical means to act.

At work: A benefits organisation gives trained reviewers access to supporting information, authority to override an AI recommendation, and a process for escalating recurring errors.

Where it appears in roles: AI governance professionals, operational managers, compliance officers, and product teams may define review responsibilities and intervention procedures.

Common confusion: Having a person approve an output does not automatically make oversight meaningful. A reviewer who lacks time, information, or authority may be unable to challenge it.

Related terms: Accountability; AI governance; AI risk management; deployer.

Interpretability

What it means: Understanding what an AI system's output means in the context in which it is being used.

At work: A fraud analyst needs to understand whether a score represents an estimated probability, a ranking, or a threshold for further investigation before deciding what to do.

Where it appears in roles: Model validators, risk analysts, business analysts, and operational specialists may check whether users understand outputs and their limitations.

Common confusion: Explainability concerns how a system works; interpretability concerns how to make sense of its output. The distinction is useful, although terminology varies across sources.

Related terms: Explainability; transparency; human oversight.

Model monitoring and drift

What it means: Checking an AI system's behavior after it goes into use, to catch changes in accuracy or fairness. Drift is the gradual change that happens when the data a system sees in practice moves away from the data it was built and tested on.

At work: Six months after launch, a fraud model starts flagging far more transactions from a new payment method. The monitoring dashboard shows the pattern, and the team retests the model before trusting its scores again.

Where it appears in roles: Model risk managers, machine learning engineers, AI risk analysts, and operational owners may set alert thresholds and decide when a system needs retesting.

Common confusion: Passing testing before launch does not settle the question. A system that worked well at launch can become less accurate or less fair as conditions change.

Related terms: AI risk management; model risk management; bias in AI.

Model risk management

What it means: The discipline of controlling the risk that a model is wrong or misused, covering how models are developed, independently validated, approved, monitored, and retired. In U.S. banking it rests on supervisory guidance: SR 26-2, Revised Guidance on Model Risk Management, issued on April 17, 2026 by the Federal Reserve, the Office of the Comptroller of the Currency, and the Federal Deposit Insurance Corporation. It replaced SR 11-7, the guidance banks had followed since 2011.

At work: Before a bank uses a new AI model to set credit limits, an independent validation team tests it, documents its limitations, and the model risk committee decides whether it can go live.

Where it appears in roles: Model risk managers, model validators, quantitative analysts, and internal auditors in financial services may run validations and maintain the model inventory.

Common confusion: Model risk management predates today's AI. Banks have applied it to statistical models for years, which is why many AI governance programs in finance grew out of existing model risk teams.

NIST AI Risk Management Framework (AI RMF)

What it means: A voluntary framework developed by the U.S. National Institute of Standards and Technology to help organisations manage AI risks. Version 1.0 organizes activities around four functions: Govern, Map, Measure, and Manage.

At work: A governance team uses the framework to organize responsibilities, understand a proposed AI use, evaluate risks, and decide how to address them.

Where it appears in roles: AI governance analysts, risk managers, and consultants may map existing practices to the framework, identify gaps, and coordinate improvements.

Common confusion: Using the framework does not establish legal compliance or amount to a NIST certification.

Related terms: AI governance; AI risk management; AI impact assessment.

Provider

What it means: Under the EU AI Act, an organisation or person that develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark.

At work: A company that builds an AI tool for screening job applications and sells it to employers is the provider of that tool, so it carries the Act's provider obligations for documentation, risk management, and conformity assessment.

Where it appears in roles: Product compliance managers, regulatory affairs specialists, AI governance leads, and quality managers at companies that build AI may manage provider obligations.

Common confusion: An organisation can become a provider of a system it did not originally build, for example by putting its own name on it or substantially modifying a high-risk system.

Related terms: Deployer; conformity assessment; high-risk AI system.

Red teaming

What it means: Deliberately trying to make an AI system fail or misbehave, the way an attacker or a careless user might, so that weaknesses are found and fixed before real harm occurs.

At work: Before launching a customer chatbot, a team spends a week trying to get it to reveal other customers' information, give dangerous advice, or ignore its instructions, then logs each failure for the developers.

Where it appears in roles: AI security specialists, responsible AI testers, security engineers, and AI risk analysts may run these exercises and track the fixes.

Common confusion: Red teaming finds problems; it does not prove a system is safe. A test that finds nothing shows only that those particular attempts failed.

Shadow AI

What it means: AI tools that staff use for work without the organisation's knowledge or approval, such as a personal chatbot account used to summarize client documents.

At work: A compliance survey finds staff pasting contract text into a free AI tool. Rather than only banning it, the organisation provides an approved tool with data protections and updates its acceptable use policy.

Where it appears in roles: AI governance analysts, information security teams, compliance officers, and IT managers may find shadow AI and offer safer alternatives.

Common confusion: Shadow AI usually signals unmet needs, not bad intent. Bans without an approved alternative tend to push use further out of sight.

Related terms: AI inventory; third-party AI risk; AI literacy.

Third-party AI risk

What it means: The risk that comes from AI built or run by vendors and partners, including AI features added to software an organisation already uses.

At work: A procurement team adds questions to its vendor review: what data trained the model, whether customer data is used to improve it, who is accountable for errors, and how the vendor will report incidents.

Where it appears in roles: Third-party risk analysts, procurement and vendor managers, privacy professionals, and AI governance teams may assess vendors and negotiate contract terms.

Common confusion: A vendor's assurances do not transfer the organisation's own responsibilities. Under many rules, including the EU AI Act's duties for deployers, the organisation using the system remains accountable for how it uses it.

Related terms: AI inventory; deployer; accountability.

Transparency

What it means: Making relevant information about an AI system and its use available to the people who need it, for example explaining when AI is involved and communicating relevant capabilities and limitations.

At work: An employer tells applicants where AI is used in recruitment, explains its purpose, and provides an appropriate route for questions or challenges.

Where it appears in roles: Governance, privacy, compliance, communications, and product professionals may prepare notices, documentation, and reporting processes.

Common confusion: Transparency does not necessarily require publishing source code or disclosing confidential information. The information should be meaningful for the audience and appropriate to the context.

Related terms: Accountability; explainability; interpretability.

About this glossary

GRC Careers explains terminology to help readers understand AI governance and GRC work, evaluate career opportunities, and identify subjects for further learning. Sources accompany the explanations so readers can examine the underlying guidance. Legal and standards-specific entries identify the relevant jurisdiction, publication, and version.

Initial draft: October 29, 2026. Expanded to 25 terms: October 29, 2026.

Sources

Regulation (EU) 2024/1689 (EU AI Act), including Articles 3 (definitions of provider and deployer), 4 (AI literacy), 6 and Annex III (high-risk AI systems), 10 (data governance), 26 (obligations of deployers), and 43 (conformity assessment).
Regulation (EU) 2026/1744 amending the EU AI Act (in force July 27, 2026), including the replaced Article 4 and the revised application dates.
European Commission, AI Literacy: Questions and Answers.
Regulation (EU) 2016/679 (GDPR), Article 35 (data protection impact assessment).
NIST AI 100-1, Artificial Intelligence Risk Management Framework (AI RMF 1.0), 2023.
ISO/IEC 42001:2023, Information technology, Artificial intelligence, Management system.
Board of Governors of the Federal Reserve System, SR 26-2, Revised Guidance on Model Risk Management (April 17, 2026), issued with the OCC and FDIC; supersedes SR 11-7 (2011): https://www.federalreserve.gov/supervisionreg/srletters/sr2602.htm

More: Move Into AI Governance · All AI Governance Insights · AI governance job descriptions · Certification Academy · Search jobs