Glossary

The vocabulary of regulated AI.

The terms that come up when AI meets risk, compliance and audit, defined plainly. Useful if you are translating between a data-science team and a risk committee.

Model risk

The risk of loss from decisions based on a model that is wrong or misused. In regulated finance it is a supervised discipline: models are inventoried, validated independently, and monitored for as long as they are in use.

Model validation

Independent review of a model's design, data, assumptions and performance, carried out by people who did not build it. Usually the gate an AI system has to pass before it can make real decisions.

Second line of defence

The risk and compliance functions that oversee the business rather than run it. In practice this is who decides whether your AI ships, which is why they belong in the design conversation early.

AML / KYC

Anti-money-laundering and know-your-customer: the checks a regulated firm must run to verify who a customer is and detect illicit activity. Document-heavy and rule-bound, which makes it one of the highest-value automation targets in a bank.

Explainability (XAI)

Being able to say why a model produced a given output, in terms a human can act on. In lending and asset management this is often a requirement rather than a nicety, because decisions have to be justified to customers and regulators.

Audit trail

A durable record of what a system did, on what input, under which version, and who approved it. Without one, an AI decision cannot be defended after the fact.

RAG (retrieval-augmented generation)

Giving a language model relevant source material at query time instead of relying on what it memorised in training. It grounds answers in your own data and makes provenance possible, since each output can point back to a source.

Agentic AI

Systems where a model plans and takes multi-step actions using tools, rather than only returning text. The governance question shifts from what it says to what it is permitted to do.

Guardrails

The constraints around a model: what it may access, what it may output, and when it must hand off to a human. The difference between a demo and something you can put in front of customers.

Human in the loop

A design where a person reviews or approves decisions before they take effect. Often the pragmatic route to shipping in a regulated setting: automate the work, keep the accountable decision with a named human.

Model drift

The decay in a model's performance as the world moves away from the data it was trained on. It is a monitoring problem, not a build problem, and it is where most production AI quietly fails.

Evaluation (evals)

Systematic measurement of model output quality against a fixed set of cases. Without evals you cannot tell whether a change improved the system, which makes every release an act of faith.

MLOps

The engineering practice of getting models into production and keeping them healthy: pipelines, versioning, deployment, monitoring and retraining. The unglamorous half that determines whether AI survives contact with reality.

Fine-tuning

Further training an existing model on your own data so it performs better on your specific task. Often beats a larger general model on narrow work, at lower cost, and keeps the weights and data under your control.

EU AI Act

The European Union's regulation of AI, which sorts systems by risk level and attaches heavier obligations to higher-risk uses. Several financial-services applications, including credit scoring, fall into its stricter tiers, so classification is an early design question.