Terms and definitions

Accountable: answerable for actions, decisions and performance.

Accountability: state of being accountable.

Aligned ISO 22989:2022

3.5.1

3.5.2

Aligned ISO 22989:2022

3.1.1

AI Developer: An organisation or individual that is concerned with the development of AI models, systems, and associated applications, products, and services.

AI Model Developer: An organisation or individual that is concerned with activities such as preparing training data, feature engineering, training and fine-tuning, testing, validating AI models.

AI System Developer: An organisation or individual that is concerned with activities such as designing, building, testing, training or adapting the overall AI system. This includes integrating AI models with other components such as knowledge or databases, input/output filters, user interfaces, tools, and other systems.

Note: A single organisation may play multiple roles, such as AI model developer, AI system developer, and AI system deployer.

Note: Organisations or individuals who, design, build, train, adapt, or combine AI systems and applications and distributes or otherwise places it on the market as a service for others to use, whether for payment or free of charge are referred to as an AI provider under the EU AI Act.

Adapted from ISO 22989:2022

5.19.3.2 

An organisation or individual that uses an AI system to provide a product or service. Deployment can be internal to the business or external. When deployment is external it can affect other stakeholders, such as customers.

AI deployment is concerned with making an AI model or system available in a specific production environment tailored to particular use cases. Deployment activities often involve customising and integrating AI systems with existing systems and workflows, preparing infrastructure to support operational demands, conducting environment or use case-specific testing, ensuring compliance with security and regulatory standards, creating policies for AI users, and setting up monitoring mechanisms for operations and AI usage.

Note: The technical and legal nature, as well as the amount of customisation and integration, may affect whether the activity is system deployment or system development.

ISO42001

AI model

Representation of an entity, phenomenon, process or data, employing various algorithms to interpret, predict, or generate responses based on input.

Note: A machine learning model is a type of AI model and is a mathematical construct that generates inferences or predictions based on input data or information.

Note: AI models, together with other components, are combined to form AI systems. The inference capability in the AI system which is the key difference with conventional software, comes from its models.

Adapted from ISO 22989:2022

3.1.23 

AI supply chain

Sequence of activities or parties that provides AI products or services to an organisation or individual.

Note: In some cases, AI supply chain is used interchangeably with AI value chain.

AI system

A machine-based system that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments. Different AI systems vary in their levels of autonomy and

adaptiveness after deployment.

Note: AI systems integrate AI models with other components such as knowledge or databases, input/output data processes, user interfaces, tools, and other systems.

Note: AI models typically need to be converted to an AI system to be deployed and used. For example, by addition of at least some minimal interfaces or input/output data processes.

OECD.AI Policy Observatory

See AI deployer.

Note: In this standard, we use the term AI users refer to organisational users, which largely equates to AI deployers, as the scope of the standard addresses organisational, not individual responsibilities. We note that, in typical software standards, user is often defined as a “person who interacts with a system, product, or service” (ISO 25066:2016) or an “individual or group that interacts with a system or benefits from it during its utilization” (ISO 25010:2011).

A set of instructions that guide a computer in performing specific tasks or solving problems.

Note: A machine learning algorithm is an algorithm used to determine parameters of a machine learning model from data according to given criteria.

Systematic difference in treatment of certain objects, people or groups in comparison to others.

Note: From a technical perspective, bias is necessary for AI to identify systematic differences between groups of objects or people and to treat them differently when justified. However, bias becomes problematic or "unwanted" when it leads to unfairness, i.e. unjustified differential treatment that preferentially benefits or harms certain individuals or groups over others.

Aligned ISO 22989:2022

3.5.4

Any intended or actual individual or organisation that consumes an AI-based product or service, interacts with it, or is impacted by it after deployment.

Affected stakeholder.

Note: The term end user is often defined as a “person who directly uses the system for its intended purpose” (ISO 25010:2023) to emphasize direct interaction, or as an “individual person who ultimately benefits from the outcomes of the system or software” (ISO/IEC 25000:2014), highlighting the derived benefits. Since this standard encompasses both benefits and risks, with a focus on affected impacts on a wide range of stakeholders, we adjusted the definition to reflect this.

The process of assessing against specific criteria with or without executing the artifacts, including model/system evaluation, capability evaluation, benchmarking, testing, verification, validation, as well as broader risk assessment and impact assessment against criteria or thresholds.

AI model evaluation: the process of assessing an AI model against predefined specific criteria or general benchmarks.

AI system evaluation: the process of assessing an AI system against predefined specific criteria or general benchmarks.

AI capability evaluation: a comprehensive assessment of an AI model or system’s overall capabilities, including both planned capabilities and unplanned, emerging, or dangerous capabilities. 

Xia et.al 2024

https://arxiv.org/abs/2404.05388v1

Aligned ISO 22989:2022

3.5.7

Treatment, behaviour or outcomes that respect established facts, beliefs or norms and are not determined or affected by favouritism or unjust discrimination. 

Unfairness: unjustified differential treatment that preferentially benefits certain groups more than others.

General-purpose AI/General AI

Adapted from ISO22928

3.1.14 

Generative AI (GenAI)

A type of AI models or systems with the capability to generate synthetic content such as text, images, videos, and other media. 

Note: Many current GenAI is based on GPAI. However, GenAI can be developed to perform a narrow set of tasks either by restricting GPAI capabilities or via other development approaches.

Note: ChatGPT can be considered both a GenAI system and a GPAI system. It is based on the GPT series of models, which are GPAI models (further tuned from foundation models to follow instructions and align with human).

Qinghua et al.

A process by which an organisation developing, deploying, or using AI systems identifies, analyses, and evaluates the broader economic, social, and environmental effects of the AI systems on individuals, groups, and societies.

Note: Compared to AI risk assessment, AI impact assessment typically considers broader effects beyond the immediate consequences of an AI system. It usually does not incorporate detailed likelihood or probability analysis and focuses directly on affected stakeholders and society. In contrast, risk assessment emphasises the financial, reputational, and legal consequences for the organisation, which are only indirectly linked to

ISO 42001:2022

ISO CD 42005: 2024

Labelling (data): the process of attaching meaningful information (called labels) to pieces of data so that an AI system can learn from them or be tested on them. Datasets are labelled where samples are associated with target variables.

Labelling (content): techniques which vary by modality to alert stakeholders to the presence of AI-generated content and its provenance.

Note: labelling may take the form of overt watermarks (such as icons overlaid on content, audible disclosures), labels within content (such as warnings, pre-roll or interstitial labels in video and/or audio, or font differences), or user interfaces (such as disclaimers, warnings or symbols to indicate provenance data). 

Aligned ISO22989:2022 5.10

Aligned NIST AI 100-4 p30

Employs quantitative, qualitative, or mixed-method tools, techniques, and methodologies to analyse, assess, benchmark, and monitor AI system

performance, risk and related impacts.

Aligned NISTL AI RMF Core

A qualitative or quantitative measure used to assess, compare, and track the performance or quality of a system, process, product or service.

• Internal metrics measure the AI model or system itself (such as model complexity, explainability, training compute resources).

• External metrics measure the behaviour and quality of the AI model or system (such as accuracy, response time, scalability).

• Risk metrics measure the negative outcomes of using the AI system in a specific context (such as impacts on bias, privacy, security and compliance).

• Impact metrics measure the broader effects of AI systems on users, groups and society.

Aligned ISO 22989:2022

5.2

Measurable results

Note: this can relate to quantitative or qualitative findings, actions or behaviours. 

Aligned ISO 22989:2022

3.1.25

Aligned C2PA

2.3.8

NIST: AI RMF Core

ISO 31000:2018

EU AI Act: Code of Practice

ISO 31073:2022

EU AI Act: Code of Practice

ISO 31073:2022

EU AI Act: Code of Practice

Risk mitigation (of AI system)

The process of prioritising, selecting, and implementing appropriate risk-reduction controls.

Note: Risk mitigation focuses on risk-reduction controls, while risk treatment includes additional options as well as recovery, response, and communication plans for the realisation of risks.

NIST: AI RMF Core

OECD.AI

An organisation’s or individual’s readiness to bear the risk in order to achieve their objectives.

Note: It is sometimes used interchangeably with risk appetite—referring to a justified or unjustified attitude as opposed to a readiness to bear risks.

The systematic process of prioritising, selecting, and implementing options (e.g., avoidance, transfer, acceptance, reduction) and risk controls to manage and address identified risks.

Note: Risk treatment is broader than risk mitigation, as it often involves detailed prioritisation based on impact, probibility, and available resources, along with response, recovery, and communication plans for the realisation of risks.

ISO 23894:2023

NIST: AI RMF Core

The process of executing an AI model or system to verify and validate that it

exhibits expected behaviours across a set of appropriately selected test cases.

<organisation> Property of an organisation that appropriate activities and decisions are communicated to relevant stakeholders in a comprehensive, accessible and understandable manner.

<system> Property of a system that appropriate information about the system is made available to relevant stakeholders.

<mechanism> Process of making information about an AI system or AI-generated content or its provenance available to users and stakeholders.

Adapted ISO 22989:2022

3.5.14 and 3.5.15

ISO 25010

Trustworthiness

(of AI system)

ISO 22989:2022

3.5.16

Australia’s AI Ethics Principles

IEEE SEBoK

Watermark

Information embedded into digital content, either perceptibly or imperceptibly by humans, that can serve a variety of purposes, such as establishing digital content provenance or informing stakeholders that the contents are AI-generated or significantly modified.

AI-generated content watermarking: a procedure by which watermarks are embedded into AI-generated content.

Adapted from C2PA

2.4.2