Return to Civerent
RESOURCES / GLOSSARY
AI governance terms in plain language.
Shared definitions reduce ambiguity across product evaluation, policy work, control implementation, evidence review, and procurement.
Effective September 14, 2026
Core governance terms
- AI system — a system, application, model, agent, workflow, or combined service that uses AI capabilities for an organizational purpose.
- AI governance — the authority, policies, decisions, roles, controls, evidence, and oversight used to direct and account for AI throughout its lifecycle.
- AI inventory — an organized record of AI systems, uses, owners, vendors, lifecycle status, and governance context.
- Accountable owner — the person or organizational role responsible for ensuring required decisions and work occur; assignment does not erase executive or legal accountability.
- Human oversight — meaningful review and intervention by qualified people with authority, context, information, and time to challenge or change an AI-related decision.
Risk and assessment terms
- Risk — the effect of uncertainty on objectives, considered through likelihood, impact, affected people, context, controls, and organizational tolerance.
- Risk assessment — a documented evaluation of relevant threats, harms, impacts, controls, evidence, assumptions, and treatment decisions.
- Finding — an observed condition that may require evaluation, remediation, acceptance, monitoring, or escalation.
- Risk treatment — a decision to mitigate, avoid, transfer, accept, or monitor a risk, subject to appropriate authority.
- Technical test — a defined evaluation that produces evidence about system behavior; a test result is not by itself a legal or certification conclusion.
Policy, control, and evidence terms
- Policy — an approved statement of organizational direction, requirements, authority, or expected conduct.
- Control — a measure intended to modify risk or satisfy an organizational, contractual, framework, or legal requirement.
- Control implementation — the organization-specific process, owner, status, timing, and operating details that put a control into practice.
- Evidence — information used to support that an activity, decision, condition, or control exists or operated as represented.
- Evidence history — version and activity records that preserve how supported evidence changed over time.
- Exception — an authorized, documented departure from a requirement, including scope, rationale, risk, compensating measures, owner, and expiration or review date.
Compliance and assurance terms
- Readiness — preparation to evaluate or pursue a requirement; readiness is not certification, authorization, or proof of compliance.
- Compliance — satisfaction of applicable obligations as determined through the relevant legal, regulatory, contractual, or organizational process.
- Certification — a formal statement issued by an authorized independent body under a defined scheme and scope.
- Attestation — an independent practitioner's conclusion about subject matter under specified criteria and procedures.
- Authorization — formal approval by an authorized organization or government body to operate within a defined scope and risk decision.
- Framework mapping — a documented relationship between controls or requirements; a mapping does not prove that either side is implemented or legally equivalent.
Service and procurement terms
- Subprocessor — a provider engaged by Civerent that may process customer or personal information to help deliver the service.
- Data Processing Addendum — a contract defining processing roles, instructions, safeguards, transfers, subprocessors, rights assistance, deletion, and related obligations.
- Service level — a measurable contractual commitment for a defined service and period; a target or status statement is not automatically an SLA.
- RTO — recovery time objective, the target time for restoring a defined capability after disruption.
- RPO — recovery point objective, the target amount of data loss measured in time after a disruption.
- Trust Center — a maintained location for security, privacy, provider, assurance, status, and procurement information.
Contact Civerent
Questions and reports
Contact Civerent about this document, report a concern, or request additional information.
support@civerent.comDo not send passwords, authentication tokens, government identification numbers, vulnerability exploit code, or other highly sensitive information by ordinary email.