Glossary

AI model

The computer program behind an AI tool. It learned patterns from a huge amount of writing and other material, and it uses those patterns to answer you.

Think of it like: a very well-read assistant who has seen a lot of examples but does not look anything up unless you give it a way to.

Prompt

The instructions or question you type to the AI. A clear prompt with some background usually gets a more useful answer.

Think of it like: the note you leave for a new volunteer. The more clearly you write it, the better the result.

Training data

The writing, images and other material a model learned from, and, depending on the product and your settings, possibly what people type in later.

Think of it like: the books and lessons a student studied before starting the job.

Opt-out

A setting or request that lets you say no to something. Here it usually means asking that your chats not be used to improve the AI.

Think of it like: the box you tick to stop receiving mailings.

Retention

How long a company keeps your information before it deletes it. Some tools keep chats for a set number of days, and some let you choose.

Think of it like: how long a filing cabinet keeps old folders before they are shredded.

Encryption

A way of scrambling information so that only someone with the right key can read it. It protects data while it is stored and while it travels over the internet.

Think of it like: a locked envelope: the mail carrier can carry it, but cannot read the letter.

SOC 2

A security report. An outside auditor checks a company's habits for protecting customer data and writes up what they found. A Type I report checks whether the controls are designed well, as of one date. A Type II report also tests whether they actually worked throughout a stated period of time. Having one is a good sign, but it does not mean nothing can go wrong.

Think of it like: a health inspection report for a restaurant's kitchen.

API

A way for one computer program to talk to another. Companies use an API to build the AI into their own software, instead of typing into a chat window.

Think of it like: a waiter who carries your order to the kitchen and brings back the food.

Open-weight model

An AI model whose inner settings (called weights) are shared publicly, so anyone can download it and run it on their own computers. Whoever runs it is responsible for keeping it secure.

Think of it like: a recipe you can take home and cook in your own kitchen, instead of ordering from a restaurant.

Hallucination

When an AI states something that sounds confident but is wrong or made up, such as a fake statistic or a source that does not exist. Always check facts, names and numbers before you use them.

Think of it like: a coworker who would rather guess smoothly than admit they do not know.

Enterprise tier

The top paid plan, made for large groups. It usually adds admin controls, extra security features and special contract terms, and it costs more.

Think of it like: the business class section: the same trip, with more services and a higher price.

PII

Personally identifiable information: details that point to a specific person, like a name with an address. Leave it out of a prompt. Ask your privacy contact before using it in any tool, even an approved one.

Think of it like: anything you would black out with a marker before sharing a document with the public.

Token

A small chunk of text, often a short word or part of a longer word, that the AI reads and writes. Tools often count and price their usage in tokens.

Think of it like: the pieces of a sentence cut into puzzle pieces, one piece at a time.

Context window

The amount of text an AI can keep in mind at one time, including your messages and its replies. If a conversation gets too long, the AI can lose track of the early parts.

Think of it like: the size of the desk the AI works at: only what fits on the desk can be seen at once.

SSO (single sign-on)

A way to log in to many tools with one work account, so staff do not need a new password for each one. It also lets an administrator turn off access in one place when someone leaves.

Think of it like: one key card that opens every door in the building.

Anonymization

Changing information so that no one can work out who it is about, even by combining clues. Removing names alone is not enough.

Think of it like: blurring a whole photo so nobody can recognize the scene, not just covering one face.

ISO/IEC 27001

An international standard for running an information security management system: the policies, people and tools a company uses to manage risks to its data. An outside certification body, not ISO itself, can certify a company against it. Each certificate covers a stated scope.

Think of it like: a food-safety certificate that names which kitchens it covers.

HIPAA

A US law that protects health information held by health plans, health care clearinghouses and health care providers that bill electronically ("covered entities"), and by their "business associates". If your organization is neither, the HIPAA rules do not apply to it, though other laws may.

Covered entity

Under HIPAA, a health plan, a health care clearinghouse, or a health care provider that sends health information electronically for certain transactions, such as billing.

Business associate

Under HIPAA, a person or company that does work for a covered entity that involves protected health information. US health officials list a cloud storage vendor and an AI chatbot on a patient portal as examples.

PHI (protected health information)

Under HIPAA, health information that can identify a person, such as medical records, when it is held or sent by a covered entity or a business associate.

BAA (business associate agreement)

A written contract HIPAA requires before a covered entity lets a vendor handle protected health information for it. It says what the vendor may do with the information and that the vendor must protect it.

Think of it like: the signed rules a caterer agrees to before working in a hospital kitchen.

GDPR

The General Data Protection Regulation, the EU's main data protection law. It can also apply to organizations outside the EU that offer goods or services to people in the EU, or monitor their behaviour there.

Data controller

Under the GDPR, the organization that decides why and how personal data is used. In the European Commission's example, a brewery that hires a payroll company to pay its staff is the controller.

Data processor

Under the GDPR, an organization that handles personal data only on behalf of a controller. In the European Commission's example, the payroll company a brewery hires is the processor.

Lawful basis

Under the GDPR, one of six legal reasons you must have before you use personal data: consent, a contract, a legal duty, protecting someone's life, a task in the public interest, or legitimate interests.

DPA (data processing agreement)

The contract between a data controller and a data processor. The GDPR requires the processor's work to be set out in a contract or other legal act, including what it may do with the data.

Human in the loop

A way of working where a person checks and approves what an AI tool produces before anyone relies on it.

Think of it like: a supervisor who reads a new hire's draft before it goes out the door.

Bias

When a system's output treats some groups unfairly or repeats stereotypes, often because of patterns in what it learned from.

Think of it like: a new volunteer who has only ever heard one side of a story and repeats it as if it were the whole truth.