Glossary
Key terms, in plain language
The vocabulary you will meet in AI adoption and AI regulation, and what each term means for your business.
AI basics
AI system
Software that, for a given set of objectives, generates outputs such as predictions, content, recommendations or decisions with a degree of autonomy. The EU AI Act uses a similar, legally binding definition.
Whether something counts as an AI system decides whether AI rules apply to it at all.
Machine learning
The approach behind most modern AI: instead of being programmed with explicit rules, a model learns patterns from example data and applies them to new inputs.
Model quality depends on the data it learned from, which is why your own data quality matters so much.
Generative AI
AI that produces new content: text, images, audio, video or code. Chat assistants and image generators are the best-known examples.
The fastest way into AI for most businesses, and the technology most new AI rules focus on.
Large language model (LLM)
A model trained on very large amounts of text to understand and generate language. The engine behind most chat assistants.
Most off-the-shelf AI tools you evaluate are built on someone else’s LLM: ask which one, and where your data goes.
Prompt engineering
Writing instructions for a generative AI system so it reliably produces the output you need: context, examples, format and constraints.
The cheapest AI skill to build in your teams, and usually the first training worth running.
AI agent
An AI system that does not just answer, but plans and carries out multi-step tasks with software tools, with limited human intervention.
Powerful for automation, but needs clear boundaries, monitoring and human oversight.
Hallucination
A confident but wrong or invented output from a generative AI system.
Never publish or act on unverified AI output: keep a human check where mistakes are costly.
RAG (retrieval-augmented generation)
A setup where the AI looks up your own documents first and answers based on what it finds, instead of relying only on its training data.
The standard way to make AI answer from your company knowledge without training your own model.
Fine-tuning
Further training of an existing model on your own examples so it behaves in a specific way.
Rarely the first step: most business needs are met with good prompting or RAG.
AI Act vocabulary
Provider
Under the EU AI Act, whoever develops an AI system or model and places it on the EU market under their own name or brand.
Providers carry the heaviest obligations: if you build and sell AI into the EU, this is likely you.
Deployer
Under the EU AI Act, whoever uses an AI system under their own authority in a professional context.
Simply using AI tools in your business can make you a deployer, with duties like human oversight and staff AI literacy.
General-purpose AI (GPAI)
AI models trained for broad capability and usable in many downstream systems, like large language models. Separate AI Act obligations apply to their providers, and stricter ones where systemic risk is involved.
If you build on a GPAI model, your obligations depend partly on what its provider documents and discloses.
High-risk AI system
An AI Act category for systems used in areas like employment, credit, education, critical infrastructure or as safety components of regulated products. They face strict requirements before and after market placement.
Check the use case, not the technology: the same model can be minimal risk in one use and high-risk in another.
Prohibited practices
AI uses the EU has banned outright, such as social scoring of people and certain manipulative or biometric practices. The original bans have applied since 2 February 2025, and new bans on AI-generated non-consensual intimate imagery and child sexual abuse material apply from 2 December 2026.
A short list, but absolute: screen your use cases against it once, early.
Transparency obligations
AI Act duties to tell people they are interacting with AI, and to mark AI-generated or manipulated content such as deepfakes.
If customers talk to your chatbot or see AI-generated content from you, label it.
AI literacy
The AI Act requires providers and deployers to take measures to support the AI literacy of staff dealing with AI. The duty has applied since 2 February 2025; since the Digital Omnibus amendment of July 2026, it no longer requires a guaranteed level of AI understanding.
Basic AI training for the relevant teams is now a compliance measure, not just good practice.
Annex I
The list of EU product laws in the AI Act, for example on medical devices, toys and lifts. An AI system that is a safety component of such a product, or is the product, and needs a third-party conformity check counts as high-risk. Since the Digital Omnibus, AI in machinery follows the Machinery Regulation instead.
Relevant if you make or import regulated products that contain AI.
Annex III
The list of areas in the AI Act where an AI system counts as high-risk because of what it is used for, such as recruitment and HR, credit scoring, education, biometrics and critical infrastructure.
Check your HR and finance tools first: they are the most common Annex III cases in business.
Article 50
The AI Act’s transparency article: people must be told when they interact with an AI system, providers of generative AI must mark its output in a machine-readable way, and deployers must disclose deepfakes.
If you publish AI-generated images, audio or video, plan how you label them.
Digital Omnibus on AI
Regulation (EU) 2026/1744, in force since 27 July 2026. It amended the AI Act: later dates for the high-risk rules, two new bans and a softer AI literacy duty.
If your plan was built on the original AI Act dates, check it against the amended ones.
Hong Kong SAR
PCPD
The Office of the Privacy Commissioner for Personal Data, Hong Kong’s data protection authority. It published the Artificial Intelligence: Model Personal Data Protection Framework.
Using personal data with AI in Hong Kong? The PCPD framework is the reference.
HKMA
The Hong Kong Monetary Authority, the banking regulator. Its circulars set expectations for banks that use generative AI with customers.
Relevant for banks and their service providers in Hong Kong.
Plain language summaries, not legal definitions. The official texts linked on the regulation pages prevail.