What the law requires, with the article number behind every line.
Glossary
The vocabulary, defined the way this site uses it.
Alphabetical · each term in two sentences
This is the vocabulary a compliance lead actually needs, defined once and used the same way on every other page. Where a term has a page behind it, the term links to that page rather than repeating it here.
Terms
- Term
- Article 4
- What it means
- EU AI Act provision on AI literacy. It requires that staff who operate or are affected by an AI system have a level of understanding proportionate to their role.
- Term
- Article 27
- What it means
- EU AI Act provision requiring a Fundamental Rights Impact Assessment before certain high-risk systems are put into use. It applies to a scoped set of deployers, notably public bodies and some financial and insurance activities.
- Term
- Article 50(1)
- What it means
- The duty to make sure a person is told they are interacting with an AI system, unless that is obvious from the circumstances. The duty sits with the provider of the system, not with whoever answers the phone.
- Term
- Article 50(2)
- What it means
- The duty to mark synthetic audio, image, video and text in a machine-readable way, detectable as artificially generated. For systems already on the market before 2 August 2026 it applies from 2 December 2026.
- Term
- Article 57
- What it means
- EU AI Act provision under which member states establish regulatory sandboxes for AI under supervisory oversight. Participation is national, so the entry route differs per country.
- Term
- Article 86
- What it means
- EU AI Act provision giving an affected person the right to an explanation of an individual decision taken with a high-risk AI system. It sits next to, not instead of, the GDPR rules on automated decision-making.
- Term
- Attestation
- What it means
- A statement inside a compliance receipt that one specific duty was met on that interaction, for example that the approved Article 50 disclosure text was sent, and where in the call. A receipt is the artefact; an attestation is one of the claims it carries.
- Term
- AudactRules
- What it means
- An open, executable specification for compliance rules, intended for publication under CC-BY-SA so that runtime engines can read the same rule the same way. It is a specification, not a certification.
- What it means
- The keyed code on a compliance receipt: HMAC-SHA256, computed with a symmetric key held by Audact, which authenticates the receipt against that key. It is not a digital signature and there is no public verification key. The three hash-based fields are what a third party checks today without any key at all, with Merkle inclusion as a fourth, checked against the published root with the inclusion proof from the call's Article 50 report.
- Term
- C2PA
- What it means
- Coalition for Content Provenance and Authenticity: an open standard for recording, and cryptographically protecting, where a piece of media came from. It is one of the routes towards the machine-readable marking that Article 50(2) asks for.
- What it means
- The per-interaction artefact Audact emits: the input hash, the output hash, the link to the previous receipt, its Merkle inclusion, and an authentication code. The fourth, inclusion in the Merkle root, is checked against the published root with the inclusion proof from the call's Article 50 report; the first three can be recomputed by anyone today, without a key and without an account.
- Term
- Decision outcome
- What it means
- Control has three: allow, escalate, refuse — there is no fourth. The governance gate returns three verdicts: allow, modify, block. Every one of them writes a receipt.
- Term
- Deployer
- What it means
- Under the EU AI Act, the party that uses an AI system under its own authority in the course of its activity. An agency that puts its own name on a voice agent and sells it on is, on most readings, a provider rather than merely a deployer.
- Term
- Digital Omnibus
- What it means
- Regulation (EU) 2026/1744, in force since 27 July 2026, which amends the AI Act and inserts Article 111(4). Its practical effect here is the 2 December 2026 date for Article 50(2) on systems that were already on the market before 2 August 2026.
- Term
- DORA
- What it means
- Digital Operational Resilience Act: the EU regulation on ICT risk management, incident reporting and third-party oversight for financial entities. It has applied since January 2025.
- Term
- DSA
- What it means
- Digital Services Act: the EU regulation on intermediary services, content moderation and platform transparency. It has applied in full since February 2024.
- Term
- EUDI Wallet
- What it means
- The EU Digital Identity Wallet: a member-state-issued identity container through which a person can present verified attributes across borders. It is a primitive an AI interaction can lean on, not an obligation the AI Act imposes.
- Term
- Evidence chain
- What it means
- A hash-linked sequence of compliance events, batched into a Merkle tree and anchored with an RFC 3161 timestamp. Because each entry carries the hash of the one before it, a later change or reordering is detectable by recomputation against the retained commitment.
- Term
- Evidence Vault
- What it means
- The Audact interface that exposes the evidence chain as a queryable, exportable store rather than a log you have to ask for. Its current state is on the roadmap page, not here.
- Term
- FRIA
- What it means
- Fundamental Rights Impact Assessment, required under Article 27 of the EU AI Act for scoped high-risk deployments. It is an assessment of effects on people, not a security review.
- What it means
- The data processing agreement that a controller and a processor must have in place, covering scope, sub-processors, security, audit rights and breach notification. Audact publishes its version before signature rather than after.
- Term
- ISO 42001
- What it means
- ISO/IEC 42001:2023, the management-system standard for artificial intelligence. Audact is not certified against it: there is no certification and no audit scheduled, and the control documentation is mapped to the standard as a starting point.
- Term
- Merkle tree
- What it means
- A tree in which every node above the leaves is the hash of its children, so one root value stands for a whole batch. Where a root is published, it lets a single receipt be shown to belong to that batch without revealing the rest of it. The roots are published at api.audact.ai/v1/metachain; inclusion of a single receipt is checked with the inclusion proof from the call's Article 50 report against the published root.
- Term
- MiCA
- What it means
- Markets in Crypto-Assets Regulation: the EU regime for issuing crypto-assets and providing crypto-asset services. It has applied since December 2024.
- What it means
- An open protocol from Anthropic for connecting a model to tools and data sources through a declared server. Audact's own connectors page describes where this fits for developer integration.
- Term
- NL Telecomwet
- What it means
- The Dutch Telecommunications Act, whose provisions on AI-assisted outbound calling have applied since 1 July 2026. These are separate duties from separate statutes, and satisfying one says nothing about the other.
- What it means
- Rendering personal data unreadable by destroying the key it was encrypted with, so the sequence remains checkable while the content is gone.
- Term
- Policy engine
- What it means
- The runtime component that picks the rule set for an interaction (disclosure wording, recording consent, outbound eligibility) from the jurisdictions of both parties. A country is only added once its national layer has been checked by a person against the national text, so coverage is deliberately narrower than the map.
- What it means
- Directive (EU) 2024/2853, which treats software as a product and treats a party that puts its own name on someone else's product as its manufacturer. It applies from 9 December 2026, and being a directive, the exact transposition runs per member state.
- What it means
- One end-client sub-account that places production calls through its deployed configuration. Founding terms include up to five; draft and test accounts are unlimited.
- Term
- Provider
- What it means
- Under the EU AI Act, the party that develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trade mark. The Article 50 duties in subsections (1) and (2) sit here.
- What it means
- The IETF standard for asking a time-stamping authority to bind a hash to a point in time. It establishes that a value existed no later than that moment; it says nothing about whether the underlying event was true.
- Term
- W3C Verifiable Credentials
- What it means
- An open data model for credentials that carry their own proof of issuance, used in identity and attestation flows. The model is a container format: what it is worth depends entirely on who issued the credential.
Patent-pending families
The mechanisms in the patent-pending governance stack (UK IPO) that map most directly onto the vocabulary above. Filed is not granted: these are applications, and nothing here claims a granted right.
- Mechanism
- Inline proxy
- What it means
- Mediating an AI conversation through a governance boundary and producing an evidence record for each interaction.
- Mechanism
- Compliance receipt
- What it means
- The per-interaction record: the input and output hashes, the verdict, the policy version and the link to the record before it.
- Mechanism
- Multi-candidate selection
- What it means
- Evaluating several candidate model outputs against policy before one of them is allowed out.
- Mechanism
- Incident reconstruction
- What it means
- Rebuilding what happened in a past interaction from anchored evidence rather than from memory.
- Mechanism
- Brand governance
- What it means
- Enforcing approved messaging, pricing and claim rules against AI output while the call is still running.
- Mechanism
- Commercial transaction validation
- What it means
- Checking an AI-initiated commercial commitment against pricing and contract rules before it is dispatched.
- Mechanism
- Article 50 attestation
- What it means
- Producing a per-interaction record of the approved disclosure text and where in the interaction it was sent.
- Mechanism
- Cross-jurisdiction consent
- What it means
- Resolving consent and recording rules when the two parties to one conversation sit under different regimes.
- Mechanism
- Scope of practice
- What it means
- Keeping an agent's output inside the regulated scope of the profession it is speaking on behalf of.
- Mechanism
- Outbound eligibility
- What it means
- Deciding before dial-out whether this call may be placed at all, from jurisdiction, consent and do-not-contact state.
- Mechanism
- Vulnerability signals
- What it means
- Detecting indicators that the person on the line may be vulnerable. In development.
- Mechanism
- Disclosure sequencing
- What it means
- Ordering layered disclosures across a multi-turn conversation so each one lands where the rule requires it.
- Mechanism
- Channel-agnostic attestation
- What it means
- Producing the same evidence semantics whether the interaction happened over voice, chat or outbound.
- Mechanism
- Obligation lifecycle
- What it means
- Tracking a commitment made during an interaction from the moment it becomes an obligation under the formation rule configured for that workflow, to the moment it is discharged. Whether a commitment becomes an obligation depends on the contract, the workflow and the jurisdiction — Audact records the transition, it does not decide the law.
- Mechanism
- Assessment generation
- What it means
- Deriving a Fundamental Rights Impact Assessment from the deployment profile that is actually running.
A term you expected and did not find
If a term is missing, or is defined here differently from how you meet it elsewhere in the industry, tell us which one. The glossary is meant to remove ambiguity, not add a house dialect.
Related
Article 50 in full See a receipt Field by field, and what a third party can recompute from it.
Dates that already apply Each obligation with the date it started and the source that sets it.