AI enablement terms

Prepared 2026-10-09. Prices verified 2026-10-07 to 2026-10-08. From The Nonprofit AI Almanac.

Print double-sided for one sheet (two sides): terms on the front, costs on the back.

Please note: This site is only a guide to help people understand. Consult your IT, security and/or privacy department for clarification.

AI model

The computer program behind an AI tool. It learned patterns from a huge amount of writing and other material, and it uses those patterns to answer you.

Prompt

The instructions or question you type to the AI. A clear prompt with some background usually gets a more useful answer.

Token

A small chunk of text, often a short word or part of a longer word, that the AI reads and writes. Tools often count and price their usage in tokens.

Hallucination

When an AI states something that sounds confident but is wrong or made up, such as a fake statistic or a source that does not exist. Always check facts, names and numbers before you use them.

Training data

The writing, images and other material a model learned from, and, depending on the product and your settings, possibly what people type in later.

Retention

How long a company keeps your information before it deletes it. Some tools keep chats for a set number of days, and some let you choose.

Opt-out

A setting or request that lets you say no to something. Here it usually means asking that your chats not be used to improve the AI.

Anonymization

Changing information so that no one can work out who it is about, even by combining clues. Removing names alone is not enough.

PII

Personally identifiable information: details that point to a specific person, like a name with an address. Leave it out of a prompt. Ask your privacy contact before using it in any tool, even an approved one.

API

A way for one computer program to talk to another. Companies use an API to build the AI into their own software, instead of typing into a chat window.

Open-weight model

An AI model whose inner settings (called weights) are shared publicly, so anyone can download it and run it on their own computers. Whoever runs it is responsible for keeping it secure.

Enterprise tier

The top paid plan, made for large groups. It usually adds admin controls, extra security features and special contract terms, and it costs more.

SOC 2

A security report. An outside auditor checks a company's habits for protecting customer data and writes up what they found. A Type I report checks whether the controls are designed well, as of one date. A Type II report also tests whether they actually worked throughout a stated period of time. Having one is a good sign, but it does not mean nothing can go wrong.

ISO/IEC 27001

An international standard for running an information security management system: the policies, people and tools a company uses to manage risks to its data. An outside certification body, not ISO itself, can certify a company against it. Each certificate covers a stated scope.

HIPAA

A US law that protects health information held by health plans, health care clearinghouses and health care providers that bill electronically ("covered entities"), and by their "business associates". If your organization is neither, the HIPAA rules do not apply to it, though other laws may.

GDPR

The General Data Protection Regulation, the EU's main data protection law. It can also apply to organizations outside the EU that offer goods or services to people in the EU, or monitor their behaviour there.

Human in the loop

A way of working where a person checks and approves what an AI tool produces before anyone relies on it.