The words founders keep hearing.

AIAI system

Under the EU AI Act, a machine-based system that infers from its inputs how to generate outputs such as predictions, content, recommendations or decisions, with some level of autonomy. The definition is broad; most products that use a model for those outputs are covered.

AIProvider

The EU AI Act term for whoever develops an AI system or model and places it on the market under their own name. Providers carry most of the obligations. You can become one by putting your name on a system someone else built, or by substantially modifying it.

AIDeployer

The EU AI Act term for an organisation that uses an AI system under its authority in a professional context. Deployers have lighter but real duties, such as human oversight, transparency to affected people and, for some uses, impact assessments.

AIGeneral-purpose AI (GPAI) model

A model trained on broad data that can perform a wide range of tasks, such as a large language model. Providers of GPAI models have their own documentation, copyright and, for the most capable models, systemic-risk obligations under the AI Act.

AIHigh-risk AI system

An AI system used in an area listed in the AI Act, such as hiring, education, credit or essential services, or one that is a safety component of a regulated product. High-risk systems need risk management, data governance, logging, documentation and human oversight.

AIProhibited practices

AI uses banned outright under Article 5 of the AI Act, including certain manipulative techniques, social scoring and some biometric uses. The 2026 amendments added bans on generating non-consensual intimate imagery and child sexual abuse material.

AIAI literacy

The AI Act requirement that providers and deployers take measures to support an appropriate level of AI understanding among staff who use or operate AI systems.

AIAutomated decision-making (ADM / ADMT)

Decisions about people made by software with little or no human involvement. GDPR Article 22, the UK’s revised framework, California’s ADMT rules and Colorado’s new law all regulate it, usually through notice, explanation and human review.

AISynthetically generated information (India)

The term India’s amended IT Rules use for AI-generated or altered content that appears real. Platforms that enable it must label it and, where feasible, embed provenance metadata.

AIISO/IEC 42001

An international standard for an AI management system: the policies, roles, risk processes and controls an organisation uses to govern AI. It certifies the management system, not any particular model.

PrivacyPersonal data

Information about an identified or identifiable person. Under GDPR and India’s DPDP Act, identifiability is judged broadly, so device IDs, account IDs and inferred profiles can all count.

PrivacyData fiduciary (India)

The DPDP Act’s term for whoever decides the purpose and means of processing personal data, broadly equivalent to a GDPR controller. Most obligations under the Act sit with data fiduciaries.

PrivacySignificant Data Fiduciary (India)

A data fiduciary the Indian government designates based on factors such as volume and sensitivity of data and risk to people. SDFs must appoint an India-based DPO and an independent auditor and carry out impact assessments.

PrivacyData principal (India)

The DPDP Act’s term for the person the data is about. For a child or a person with a disability, it includes the parent or lawful guardian.

PrivacyConsent manager (India)

A registered entity under India’s DPDP framework that lets people give, manage, review and withdraw consent through a single interoperable platform.

PrivacyController and processor

The GDPR’s roles. A controller decides why and how personal data is processed. A processor acts on the controller’s documented instructions. The role depends on what you actually do, not on what the contract calls you.

PrivacyDPA (data processing agreement)

The contract between a controller and a processor that sets out instructions, security, subprocessors, assistance, deletion and audit rights. GDPR Article 28 sets the minimum contents.

PrivacyDPIA

A data protection impact assessment: a structured analysis of a processing activity likely to create high risk to people, its necessity, the risks and the safeguards. Required by GDPR in specified cases and by the DPDP Act for Significant Data Fiduciaries.

PrivacySubprocessor

A vendor your processor uses to process your customers’ personal data, such as a cloud host or an AI API. Enterprise customers usually expect a published list and notice of changes.

PrivacyInternational transfer

Moving personal data, or allowing access to it, across borders. GDPR requires a transfer mechanism such as adequacy or standard contractual clauses. India’s DPDP Act lets the government restrict transfers to notified countries.

PrivacyAdequacy decision

A finding by the European Commission (or the UK government for UK transfers) that a country protects personal data to an essentially equivalent standard, so data can flow there without extra safeguards.

PrivacyStandard contractual clauses (SCCs)

Model contract terms approved by the European Commission for transferring personal data out of the EU where there is no adequacy decision. The UK uses its own IDTA or an addendum to the EU clauses.

PrivacyEU–US Data Privacy Framework (DPF)

The 2023 framework that lets EU personal data flow to US companies that self-certify to it. A UK extension supports transfers from the UK.

PrivacyLegitimate interests

A GDPR lawful basis for processing that is necessary for your or a third party’s legitimate interests, unless people’s rights override them. It requires a documented balancing test.

PrivacyLead supervisory authority

Under the GDPR’s one-stop-shop, the data protection authority in the member state of your main EU establishment, which leads on your cross-border processing.

PrivacySale and sharing (US state laws)

Under the CCPA/CPRA and similar laws, disclosing personal information for value (‘sale’) or for cross-context behavioural advertising (‘sharing’) triggers opt-out rights, including through browser signals.

CryptoVirtual digital asset (India)

The Indian legal term, introduced in the Income-tax Act, covering crypto-assets and similar digital tokens. It drives India’s crypto tax and anti-money-laundering treatment.

CryptoVDA service provider (India)

A business that exchanges, transfers, safekeeps or administers VDAs, or provides related financial services. Since March 2023 these businesses are reporting entities under India’s anti-money-laundering law and must register with FIU-IND.

CryptoCrypto-asset (MiCA)

Under the EU’s MiCA Regulation, a digital representation of value or rights that can be transferred and stored electronically using distributed ledger technology. MiCA separates e-money tokens, asset-referenced tokens and other crypto-assets.

CryptoCASP

Crypto-asset service provider: MiCA’s term for businesses providing services such as custody, exchange, trading platforms or advice on crypto-assets in the EU. CASPs need authorisation.

CryptoTravel rule

The anti-money-laundering requirement, set out by FATF, that originator and beneficiary information travels with crypto transfers between service providers.

CryptoStablecoin (EMT / ART)

MiCA splits stablecoins into e-money tokens, which reference a single official currency, and asset-referenced tokens, which reference other assets or baskets. Both face issuer authorisation and reserve rules.

ContractsMSA

Master services agreement: the umbrella contract governing a commercial relationship, with order forms or statements of work for each purchase.

ContractsLimitation of liability

The clause capping how much each party can recover. Enterprise buyers often push for higher caps, or no cap, for data breaches and confidentiality. This clause deserves the most attention.

ContractsIndemnity

A promise to cover the other party’s losses from specified events, such as third-party IP claims. AI vendors increasingly offer output IP indemnities, usually with conditions.

ContractsIP assignment

The transfer of ownership of intellectual property, for example from founders, employees or contractors to the company. Missing assignments are among the most common diligence findings.

ContractsSLA

Service level agreement: measurable commitments on uptime, response and resolution times, usually with service credits as the remedy.

General definitions for orientation, simplified from the underlying laws. They are not legal advice. How a term applies depends on your facts and the law in force. Read the fieldnotes