Two-sentence definitions written to be quoted, each with the normative reference and the SoAITrust control that assesses it. Updated as the market and the regulations move.
AI due diligence · ISO/IEC 42001 · NIST AI RMF · EU AI Act · OWASP Top 10 for LLM · Prompt injection · AI-BOM · Model card · Human oversight · Automated decision · AI impact assessment · Algorithmic bias · Third-party AI risk management · AI security questionnaire · Verifiable seal · Source verification · Criticality score · AI red teaming
Independent verification of an AI system's security and governance before or during procurement, based on evidence, so the buyer decides on facts rather than promises.
Reference: NIST AI RMF 1.0 · ISO/IEC 42001 · Assessed by control G5.4
The 2023 international standard for an AI management system (AIMS): policy, roles, risks, model lifecycle and continuous improvement. It is certifiable; SoAITrust assesses against it but does not certify.
Reference: ISO/IEC 42001:2023 · Assessed by control G1.1
The US NIST AI Risk Management Framework, organized in four functions: Govern, Map, Measure and Manage. Voluntary and used worldwide as a good-practice reference.
Reference: NIST AI RMF 1.0 (2023) · Assessed by control G3.1
Regulation (EU) 2024/1689, which classifies AI systems by risk and imposes obligations on providers and deployers. Article 25 extends responsibilities along the value chain, reaching non-EU vendors that sell to European companies.
Reference: Reg. (EU) 2024/1689, art. 25 · Assessed by control G2.2
The list of the ten most critical vulnerabilities in applications built on large language models, such as prompt injection, sensitive information disclosure, supply chain and excessive agency.
Reference: OWASP Top 10 for LLM Applications 2025 · Assessed by control S4.1
An attack in which malicious instructions, typed by the user or hidden in content the model reads, make the AI system ignore its rules, leak data or take unwanted actions. Control: separate instructions from data, validate inputs and limit tools.
Reference: OWASP LLM01 · MITRE ATLAS · Assessed by control S4.1
An inventory of an AI system's components: models, weights, datasets, libraries and providers, with origin, license and version. The AI counterpart of an SBOM; it answers what the system is made of and enables reaction to vulnerabilities.
Reference: OWASP LLM03 · ISO/IEC 42001 A.6.2 · Assessed by control S4.4
A short technical document describing a model: purpose, training data, metrics, limitations and discouraged uses. The basic transparency evidence a buyer asks for.
Reference: ISO/IEC 42001 A.6.2.7 · EU AI Act art. 11 · Assessed by control G4.2
The ability of people to understand, review, correct and stop an AI system, proportional to risk. Ranges from human-in-the-loop (approves each decision) to on-the-loop (monitors and intervenes).
Reference: EU AI Act art. 14 · ISO/IEC 42001 A.9.3 · Assessed by control G5.3
A decision about a person made by a system without meaningful human review, such as credit, eligibility or hiring. The LGPD (art. 20) and the GDPR (art. 22) grant a right to review and explanation.
Reference: LGPD art. 20 · GDPR art. 22 · Assessed by control G5.2
A pre-deployment analysis of an AI system's effects on people and groups: bias, exclusion, privacy, safety. When personal data is involved, a data protection impact assessment (DPIA) is added.
Reference: ISO/IEC 42001 A.5 · EU AI Act art. 27 · Assessed by control G3.2
A systematic difference in an AI system's performance or outcomes across groups of people, usually inherited from training data. Measured with per-group fairness metrics and defined thresholds.
Reference: NIST AI RMF Measure 2.11 · ISO/IEC TR 24027 · Assessed by control G3.3
The process by which a company assesses and monitors vendors whose products use AI: criticality tiering, questionnaire, evidence, contract and monitoring. An extension of traditional TPRM to AI risks.
Reference: Res. CMN 4.893/2021 · EU AI Act art. 25 · Assessed by control G5.4
A set of questions a buyer sends a vendor before contracting, covering security, privacy and AI governance. SIG and CAIQ are the most used standards; an independent assessment with a seal answers most of them at once.
Reference: Shared Assessments SIG · CSA CAIQ · Assessed by control G5.4
A mark with a unique code that anyone can check on a public page, showing what was assessed, when and until when it is valid. Unlike a copyable logo, a verifiable seal proves the assessment at the source.
Reference: SoAITrust seal policy · Assessed by control G5.4
Checking a certification in the registry of the body that issued it (for example, the IAF CertSearch database for ISO), instead of accepting the PDF the vendor sent.
Reference: IAF CertSearch · Assessed by control S1.4
A number from 0 to 100 summarizing an AI system's exposure, computed from 14 risks scored by likelihood and impact. It sets the band (low, medium, high, critical) and the recommended assessment tier.
Reference: SoAITrust methodology v1.0 · Assessed by control G3.4
Planned adversarial testing of an AI system to provoke failures: jailbreak, system prompt leakage, harmful outputs, data extraction. It should recur, with versioned test cases and release-blocking criteria.
Reference: NIST AI RMF Measure · ISO/IEC 42001 A.6.2.4 · Assessed by control S4.5
Glossary v1 · September 2026 · 18 terms · Suggest a term: [email protected]