High-Risk AI System
A screener that ranks applicants is high-risk. A tool that copies fields from a CV into a form may not be. The difference is a documented assessment.
-
-
Automation Bias
The hundredth correct match makes the hundred-and-first easier to accept unread. No overrides is a reason to investigate; effective review may still agree with every correct result.
-
Control Effectiveness
Correct implementation, substantive operation, and desired outcomes need different evidence. Counts and completion markers alone do not settle effectiveness.
-
Continuous Control Monitoring
A periodic check can miss a transient violation. Monitoring needs evidence of coverage and collection health, with actionable responses to real failures.
-
Audit Evidence
Screenshots, logs, interviews, and tests can each contribute evidence. Their value depends on the claim, provenance, scope, and reliability.
-
Risk Response
Selecting mitigation does not prove risk has fallen. Track operating controls, implementation milestones, and the authority for carrying remaining exposure.
-
Risk Register
Keep undecided risks visible. Record the next action and owner alongside the estimate, then preserve approval conditions and implementation evidence.
-
Risk Appetite
Connect broad risk appetite to specific outcomes, measurable conditions, and delegated authority. A limit alone does not authorize acceptance.
-
Technology Standard
A usable standard states its scope, authority, support, review conditions, and response to unmet needs. Technology status alone does not grant permission.
-
Governance Body
A governance body needs a defined mandate. Evaluate its authority, review evidence, waiting time, and the conditions for delegation or automation.
-
Decision Latency
Waiting for a decision can change behavior. Measure the wait and its causes, then reduce it within defined authority and control requirements.
-
Data Product Owner
The role is not “the person whose name is in the owner field.” It is whoever can say no to a request and explain why to the consumer.
-
Legal Hold
A legal hold needs locatable scope, accountable ownership, and review. Releasing one hold does not override other valid preservation requirements.
-
Retention Schedule
The regulation states the principle and declines to state the number. Someone in your organization has to, and the reasoning is the part that matters.
-
Data Classification
Labels help determine handling rules, but do not locate every person’s records or enforce policy. Classification needs owners, controls, and current context.
-
Survivorship Rule
Two systems hold different addresses for one customer, both updated this month. Deciding which one the merged record shows is not a technical question.
-
Golden Record
The name suggests a true version that existed all along. What it is: the output of a process, correct exactly to the extent that the process was right.
-
Entity Resolution
Matching is a judgment under uncertainty. Merging two different customers and splitting one across two records are both errors, and only one is easy to undo.
-
Operational Metadata
Technical metadata describes shape and business metadata describes meaning. Operational metadata describes what actually happened, and it changes every day.
-
Quality Threshold
A threshold needs a defined population, window, and acceptable impact. Derive its value from the decision it protects rather than choosing a percentage without a basis.
-
Data Incident
Bad data in production is closer to an incident than a bug. While the affected data keeps being published, copied, or read, the decisions and outputs needing correction can grow.
-
Data Observability
A large change in row count calls for investigation. Expected-count tests, reconciliation, current-state observation, and anomaly detection provide complementary evidence.
-
Policy as Code
Executable checks can support repeatable policy decisions. Their protection depends on enforced results, deployed policy versions, path coverage, and verified inputs.
-
Federated Computational Governance
Autonomy without common rules fragments, and common rules with no enforcement are only requests. The platform automates the repeatable checks, people keep exceptions and review, and the hard part is drawing the line.
-
Decision Rights
Naming an owner is easy. Saying which questions that person may answer alone, and which they may not, is the part that decides whether anything moves.
-
Impact Analysis
Before changing a column, find everything that depends on it. Lineage finds the pipelines; query logs find the people; neither finds everyone on its own.
-
Column-Level Lineage
Column-level lineage narrows the dependencies to investigate. Its usefulness depends on whether selected fields, filters, joins, and other relevant paths were captured.
-
Data Residency
Data residency is where data is stored at rest. A requirement may also cover processing, access, and exports, and a region setting only settles the first.
-
Medical AI
A model update can change the device behavior that was evaluated. Planned changes need defined scope, validation, and evidence of safety and effectiveness.
-
KYC
KYC is not a check at account opening. It is a continuing program: relationship understanding supplies the context needed to assess ongoing transaction monitoring.
-
Catalog Coverage
The share of in-scope data assets whose catalog entries carry required metadata, how to choose the denominator, and what a high number cannot show.
-
Risk-Based Decisions
Expected value can inform a one-time decision. Whether the mean is sufficient depends on utility, tail losses, constraints, and who bears the harm.
-
Fair Lending laws
The statutes have not changed. What an agency will pursue under them changed in 2025, which is why the two need tracking separately.
-
Basel III
Basel III is a minimum standard, not a statute. What binds a bank is whatever its own regulator adopted, which may be stricter and may arrive later.
-
High-Stakes Domains
Calling a system high-stakes is your own judgment about care. Being classified high-risk is someone else’s judgment with obligations attached.
-
Decision Record
Preserve the scope, rationale, authority, conditions, and evidence behind an AI use decision.
-
AI System Inventory
Track deployed AI uses, ownership, dependencies, and decision status in a maintained inventory.
-
Model Card
Read a model card as documentation of evaluated scope, performance, and limitations.
-
Human Oversight
Explain what people need to detect, challenge, and correct AI-assisted decisions.
-
Residual Risk
Identify risk remaining after applied controls and distinguish it from promised improvements.
-
Risk Control
Understand how a risk control interrupts a failure path and how its effectiveness is checked.
-
Risk Assessment
Assess concrete failure scenarios, their consequences, likelihood, and uncertainty.
-
Responsibility and Accountability
Distinguish carrying out assigned work from answering for a decision and its follow-through.
-
AI Governance
Connect AI use, decision authority, evaluation evidence, and ongoing review.
-
Purpose Limitation
Treat a new use of existing data as a new decision: state the purpose, check the basis and expectations, and do not inherit the original justification.
-
Re-identification Risk
Assess re-identification risk from precise times, places, rare traits, and linkage with other data, and choose a release model for the actual dataset.
-
Data Ethics
Understand data ethics as checkable standards for collecting, storing, analyzing, sharing, and using data, beyond personal judgment and beyond the law.
-
Open License
Learn what an open license must permit, which conditions such as attribution and share-alike are acceptable, and why non-commercial terms are not open.
-
Open Data
Understand open data by its legal permission to use, modify, and share, not by whether it is visible or free to download, and what it does not settle.
-
Privacy Notice and Consent
Distinguish explaining data handling from recording and enforcing a scoped consent choice.