Reference
A sourced reference index for the language of AI governance, privacy, cybersecurity, risk, and independent assurance. AuditDIFF separates plain-language explanations from legal, regulatory, standards, and other authoritative terminology.
Your search stays in this browser.
Reference index
27 terms
The structures, roles, decision processes, controls, and oversight an organization uses to govern AI systems across their lifecycle.
Why it matters: AI governance connects technical systems to accountability, risk decisions, evidence, and oversight.
View Full EntryA management system for establishing policies, objectives, processes, responsibilities, and continual improvement related to the responsible development, provision, or use of AI systems.
Why it matters: An AIMS turns AI governance from a collection of separate policies into an organized management system with defined responsibilities, processes, monitoring, and improvement.
View Full EntryInformation an auditor uses to evaluate whether a requirement or control is actually satisfied.
Why it matters: Policies and statements may describe what should happen. Evidence helps an auditor determine what was implemented and whether it operated as expected.
View Full EntryA California regulatory term for technology that processes personal information and uses computation to replace human decisionmaking or substantially replace human decisionmaking.
Why it matters: California attaches specific transparency and consumer-right requirements to qualifying uses of ADMT.
View Full EntryA term used in frontier AI safety law for specified extremely severe harms or risks. The exact definition depends on the applicable law and should not be treated as universal.
Why it matters: Catastrophic-risk laws establish special duties for certain frontier AI developers, while the underlying focus on extreme severity can also inform broader risk analysis without extending those legal duties to organizations outside scope.
View Full EntryChemical, biological, radiological, and nuclear hazards or threats. In AI safety, CBRN commonly appears when evaluating whether highly capable AI could meaningfully assist activities that create extreme physical harm.
Why it matters: Frontier AI safety frameworks and catastrophic-risk laws may treat certain CBRN capabilities or assistance as severe-risk scenarios requiring heightened evaluation, safeguards, or reporting.
View Full EntryA legally defined category of serious frontier-model safety event that can trigger reporting and response obligations. Covered events and reporting requirements depend on the applicable law.
Why it matters: The classification connects frontier AI safety monitoring to concrete escalation and reporting duties, making incident identification and governance an auditable part of the safety program.
View Full EntryUnder California's CCPA regulations, a cybersecurity audit is the annual audit required for a business whose processing of consumers' personal information presents significant risk to consumers' security under the applicable regulation.
Why it matters: The California requirement introduces defined scope, independence, evidence, reporting, and certification expectations for businesses that meet the regulatory threshold.
View Full EntryA ForHumanity governance concept for deliberately incorporating people with varied lived experiences, backgrounds, cultures, perspectives, skills, expertise, protected categories, and intersectionalities into risk input, evaluation, and assessment across the system lifecycle.
Why it matters: Governance decisions can miss material impacts when they rely on a narrow set of perspectives.
View Full EntryRisk that emerges or changes when an organization deploys an AI model within its own environment, combining upstream model capabilities, safeguards, and limitations with local access, data, tools, autonomy, scale, and business processes.
Why it matters: A model provider's safety controls do not fully describe the risk created by a customer's deployment. Auditors need to examine both upstream dependencies and the conditions the deploying organization controls.
View Full EntryA highly capable foundation model that meets a technical threshold defined by an applicable frontier AI law. The precise threshold and related requirements depend on the jurisdiction.
Why it matters: Whether a model meets a legal frontier-model definition can determine whether special safety, transparency, assessment, and incident-reporting requirements apply to its developer.
View Full EntryEvaluation performed with sufficient independence from the activity being assessed to provide credible confidence in the result.
Why it matters: Independence helps separate an organization's own claims about its program from an external evaluation of evidence against defined criteria.
View Full EntryUnder California SB 813, an Independent Verification Organization, or IVO, is an AI auditor designated by the Government Operations Agency as having demonstrated expertise in assessing risks associated with artificial intelligence and identifying the metrics and methodologies used to conduct those assessments.
Why it matters: California is creating an IVO designation to identify AI auditors that meet state-developed expectations for expertise, risk assessment, conflicts of interest, and independence.
View Full EntryISO/IEC 42001:2023 is an international management system standard that specifies requirements for establishing, implementing, maintaining, and continually improving an artificial intelligence management system.
Why it matters: It gives organizations a structured management-system approach for governing AI-related risks, responsibilities, objectives, controls, monitoring, and continual improvement.
View Full EntryA meaningful change to covered processing that creates new negative impacts, increases an existing impact, or makes a safeguard less effective.
Why it matters: A material change can trigger an update to a CCPA risk assessment as soon as feasible and no later than 45 calendar days after the change.
View Full EntryThe most severe reasonably foreseeable harm an AI system could cause or materially contribute to, used as a starting point for reasoning backward through the conditions, capabilities, failures, and controls that shape the risk.
Why it matters: Starting with harm can prevent an assessment from being constrained by the controls an organization already has and can make severe risk pathways easier to test.
View Full EntryA harmful consequence that processing personal information may create for a consumer.
Why it matters: A CCPA risk assessment must identify relevant negative impacts and weigh privacy risks against the benefits of the processing.
View Full EntryA set of intergovernmental principles and policy recommendations intended to support innovative and trustworthy AI that respects human rights and democratic values.
Why it matters: The principles provide a widely recognized policy baseline for human-centered AI and have influenced AI governance approaches across jurisdictions and organizations.
View Full EntryUnder the CCPA, personal information is information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked with a particular consumer or household.
Why it matters: Whether information falls within the CCPA definition can determine which privacy duties, rights, notices, contracts, and safeguards apply.
View Full EntryA structured assessment used to understand how a project or system handles personal information, identify privacy risks, and document decisions or safeguards.
Why it matters: A PIA can surface privacy issues before deployment and create a record of how risks and design choices were considered.
View Full EntryA broad governance concept for developing, deploying, and using AI in ways that address risks such as safety, security, accountability, transparency, privacy, fairness, reliability, and harmful bias.
Why it matters: Responsible AI gives organizations a way to connect technical performance with human, organizational, legal, and societal impacts.
View Full EntryA structured process for identifying relevant risks, evaluating their significance, and documenting decisions about treatment or acceptance.
Why it matters: Risk assessments turn broad governance concerns into explicit decisions that can be reviewed, monitored, and evidenced.
View Full EntryA discipline focused on identifying hazardous conditions, understanding how failures can lead to harm, and designing controls that prevent, detect, limit, or support recovery from those failures.
Why it matters: AI risk practitioners can borrow established safety-engineering ideas to reason backward from severe harm, map causal pathways, and connect safeguards to the failures they are intended to interrupt.
View Full EntryA decision with important consequences for a person in areas the California regulations specify, such as financial services, housing, education, employment, or healthcare.
Why it matters: Using ADMT to make a significant decision is one of the activities that can trigger California risk-assessment and ADMT requirements.
View Full EntryA ForHumanity risk concept used to examine whether an AI, algorithmic, or autonomous system can create impacts that extend beyond direct users or a single organization and become broader societal risks.
Why it matters: A risk assessment can miss important harms if it stops at direct organizational or individual effects. ForHumanity includes Systemic Societal Impact analysis within its broader AI risk evaluation approach.
View Full EntryAI risk that can spread, accumulate, interact, or scale across populations, institutions, markets, infrastructure, or other parts of society rather than remaining confined to one user, system, or organization.
Why it matters: Some AI harms become important because of scale, repetition, interconnectedness, concentration, or correlated failures. Evaluating only direct organizational impacts can miss those broader pathways.
View Full EntryForHumanity terminology for the defined subject and boundary of an evaluation, including the data processing operation and relevant AAA System components that the certification plan will assess.
Why it matters: An audit needs a clear boundary. If the target is ambiguous, evidence, responsibility, and conclusions can become ambiguous too.
View Full EntryTry a shorter phrase or reset the topic and authority filters.