AI regulatory glossary
What each term of the EU AI Act and the GDPR means, with the article that supports it and from when it applies.
What you find in each entry
What the term means, which article supports it and from when it applies.
Why a definition on its own is not enough
In Regulation (EU) 2024/1689 almost no term binds everyone in the same way. The same word changes consequence depending on who reads it — whoever builds the system or whoever deploys it in their organisation — and on when they read it, because the obligations did not all start to apply at once.
That is why each entry states the role and the date in words, inside the text. You will not see a loose label: a label is a status, and a status expires.
What sets an entry apart from a summary
Not everything that is recommended binds, and not everything worth doing is mandated by a rule. Each entry separates four things that are usually presented mixed together: what the articles impose and already applies; what they impose with a future date already set; what is only recommended by frameworks such as ISO 42001, NIST AI RMF or the guidance of ENISA, the OECD and the Spanish AI supervisory agency (AESIA) — which guide, but do not bind —; and what no rule mandates but is needed to be able to demonstrate what you did.
And it says so tied to whom and to when, inside the sentence and not in a label: the same obligation may fall on whoever builds the system and not on whoever deploys it in their organisation. The AI Act dates, one by one, are in the calendar.
How it is written
The definitions the Regulation lays down are quoted verbatim, with their article and point. The rest is explained in our own prose, with the article alongside so that anyone can go to the official text and check it.
- Agentic AI as a means of processing
Data protection obligations attach not to the agent but to each processing operation in which it acts.
- AI literacy
It is one of the Regulation’s broadest horizontal obligations: it reaches any company using AI, whatever the risk of its tools, and it is a measures-based obligation, not one of result.
- AI Officer
It is an organisational decision, not a legal requirement, and confusing the two is costly in both directions.
- AI system
It is the gateway to the Regulation: everything else — categories, obligations, dates — starts from whether a tool meets this definition.
- Algorithmic or automated decision-making system
It is the subject of the Spanish employment duty of algorithmic transparency, and its perimeter is wider than that of “AI system”.
- Circuit breakers (AI agents)
It is the agent’s automatic brake: it acts when what the agent does goes outside what was planned, without waiting for someone to notice.
- Deployer
It is the role of almost any company that buys software with AI in it rather than developing it.
- DPIA — Data protection impact assessment
It is the assessment made by whoever decides what personal data are processed for, before starting to process them.
- FRIA — Fundamental rights impact assessment
It is the assessment made by whoever uses the system, not whoever makes it, and only a few must do it.
- Golden set (AI agents)
It is the test that is repeated with the same cases to see whether the agent still responds as it should after a change.
- GPAI — General-purpose AI models
It is the model underneath the tool, and its obligations belong to whoever makes it, not whoever uses it.
- High risk
It is not “the important AI”: it is a list of areas of use, and being in one of them is not enough.
- Legal representation of the workforce
It is the collective layer of algorithmic transparency at work in Spain; the individual one is added by Royal Decree 723/2026.
- Marking of synthetic content
It is the obligation that what an AI generates carries a mark a machine can read, not a label the user sees.
- Minimal risk
It is where the vast majority of the tools a company uses sit, and where the obligations are few, but not zero.
- Penalties regime (Article 99)
The Regulation sets the maximum amounts of the fines (Article 99(3) to (5)); each Member State lays down the penalties regime and its enforcement, and whatever the Regulation does not cap.
- Prohibited practices
It is the only part of the Regulation that admits no risk management: it is not mitigated, not documented — it is not done.
- Proof of transmission or receipt
It is what puts a delivery on record: without the proof, the information was given but there is no way to show it.
- Provider
It is whoever develops the system, or has it developed, and puts it on the market under its own name or trademark.
- Rule of 2 (AI agents)
Of three risky capabilities, an agent may combine two at most, and each combination calls for its own containment.
- Substantial modification
It is one of the three acts that turn a deployer into a provider, and all three exist only on high-risk systems.
- Transparency obligations (Article 50)
It is the only part of the Regulation that allocates obligations between whoever builds and whoever uses, paragraph by paragraph.