The AI regulation glossary

Automated decision-making technology, the term of art in Colorado's replacement statute and California's privacy regulations for systems that decide or substantially assist deciding consequential outcomes.

Enforcement reserved to a state attorney general, with no private suits. Texas TRAIGA and Colorado's ADMT law use this model, which caps exposure relative to private-action regimes.

The EU AI Act's duty on providers and deployers to build AI understanding among their staff, in force since February 2, 2025. Since the Digital Omnibus took effect on July 27, 2026, they must take measures to support AI literacy but need not guarantee any particular level.

The regulated unit in most modern AI law: a machine-based system that infers from inputs how to generate outputs such as predictions, recommendations, decisions, or content. The EU AI Act definition has become the template that Vietnam, Chile, Brazil, and others borrow.

Canada's Artificial Intelligence and Data Act, the AI part of Bill C-27, which died when Parliament was prorogued in January 2025 and left Canada without an AI statute.

A structured pre-deployment review of an AI system's risks and effects. Required for high-risk systems in the EU model; Nigeria's pending bill would require them in proportion to risk.

The EU AI Act's transparency article: chatbot disclosure, synthetic-content marking, and deepfake labeling, applying since August 2, 2026.

Decisions made by systems without meaningful human involvement. Privacy laws worldwide attach rights to it, and Colorado's 2027 law regulates it as its central category.

An independent evaluation of whether an automated tool produces disparate outcomes. New York City's Local Law 144 made annual bias audits mandatory for automated employment decision tools.

A biological measurement that identifies a person: faceprint, voiceprint, fingerprint, iris scan. The trigger term in BIPA and biometric provisions worldwide.

The Illinois Biometric Information Privacy Act: written consent before collecting biometric identifiers, statutory damages per violation, and a private right of action that has produced the largest AI-adjacent settlements in the country.

The pattern where EU rules become de facto global standards because multinationals build to the strictest regime they face. Vietnam's EU-styled law is the clearest 2026 example.

Telling users they are talking to a machine. Required by the EU from August 2026, by California's companion-chatbot rules, and by a fast-growing set of state bills.

The EU's voluntary code operationalizing Article 50's marking and labeling duties for AI-generated content, published in final form on June 10, 2026. Formally binding only on signatories, who gain a facilitated route to demonstrating compliance, it is expected to function as the practical benchmark for everyone in scope.

The pre-market process proving a high-risk system meets legal requirements, borrowed from EU product safety law. It is the machinery behind CE marking for AI.

The consumer-facing label built on provenance metadata, showing origin and edit history for media.

Metadata recording how a piece of content was made and altered, the C2PA approach. State laws in California and Washington now require provenance data or disclosures of this kind.

AI-generated or manipulated content that convincingly depicts real people or events. Regulated through labeling duties (EU, China), election statutes (many US states), and likeness rights (Tennessee's ELVIS Act).

The party using an AI system in a professional capacity, as distinct from building it. Deployer duties typically cover oversight, monitoring, and disclosure to affected people.

In US state bills, the party that creates or substantially modifies an AI system. Colorado's repealed act and Virginia's vetoed bill both split duties between developers and deployers.

The EU's 2026 simplification package that deferred the AI Act's high-risk deadlines to December 2027 and August 2028 and added a generation ban on non-consensual intimate imagery from December 2026. Adopted as Regulation (EU) 2026/1744, published July 24, 2026 and in force from July 27, 2026.

When obligations actually apply, as distinct from enactment or entry into force. The EU AI Act entered into force in 2024, for example, but its high-risk duties arrive in 2027 and 2028.

AI inferring emotional state from faces, voices, or physiology. The EU bans it in workplaces and schools; scientific validity remains contested.

A law reaching conduct outside its borders. The EU AI Act binds foreign providers whose outputs are used in the EU; Vietnam's law reaches foreign providers serving Vietnamese users; most US state laws follow the resident.

A large model trained on broad data and adapted to many downstream uses. Regulatory drafts use it interchangeably with GPAI; California's SB 53 regulates the largest ones as frontier models.

The Council of Europe's 2024 treaty on AI, human rights, democracy, and the rule of law, the first binding international AI treaty. Switzerland's coming bill implements it.

The most capable class of models, typically defined by training compute or capability thresholds. California, New York, and Illinois regulate frontier developers through transparency and safety-framework duties.

A model trained for broad capability rather than one task, such as a large language model. The EU regulates GPAI providers directly, with duties that began August 2, 2025.

The category carrying the heaviest obligations in risk-based regimes: uses affecting safety or consequential decisions such as hiring, credit, education, and law enforcement. The EU's high-risk obligations arrive December 2, 2027, and August 2, 2028 for AI built into regulated products.

One law covering AI across the whole economy, the EU and South Korean model, as against sectoral regulation, where existing regulators handle AI inside their own remits, the UK, Israeli, and Swiss model.

A third-party body approved to assess AI systems and models against state law. California's SB 813 (September 2026) sets up a state framework for them, Connecticut runs a pilot program from October 1, 2027, and California's Executive Order N-9-26 asks experts how IVOs could verify frontier labs onsite and check an emergency shutoff.

The international management-system standard for AI, the certification companies use to evidence governance where no statute tells them what enough looks like.

A required ability to shut down a frontier model in an emergency. California's governor vetoed a shutdown mandate in 2024's SB 1047, and Executive Order N-9-26 (September 2026) asks for recommendations on an emergency shutoff whose efficacy an independent verification organization checks.

A hidden, machine-readable marker of AI generation that survives ordinary edits, as required by California's AI Transparency Act from August 2, 2026.

Whether an instrument binds: in force, partially in force, proposed, or repealed. This register encodes it on every law, including in machine-readable form.

New York City's rule for automated employment decision tools: annual bias audits, published results, and candidate notice, in force since July 2023.

The US National Institute of Standards and Technology's AI Risk Management Framework, the voluntary reference standard American enforcement and procurement keep pointing back to.

A higher level of government displacing lower-level law. The live US question: the December 2025 executive order directs challenges to state AI laws, but displacing them generally requires Congress or a court ruling.

The ability of individuals to sue for violations themselves. It is the single biggest driver of exposure in US state law, and both BIPA and Washington's My Health My Data Act include one.

Uses banned outright: social scoring, exploitative manipulation, and certain biometric uses under the EU AI Act; unauthorized mass surveillance and predictive policing under Peru's regulation.

The party that develops an AI system or has it developed and places it on the market under its own name. Providers carry the primary obligations in the EU model and its descendants.

Live identification of people in public spaces, typically by facial recognition. The most restricted use in the EU framework, with narrow law-enforcement exceptions.

A supervised environment for testing AI systems with regulatory flexibility. Required of member states by the EU AI Act; used by Utah, Peru, and Singapore.

Control over commercial use of one's identity: name, image, likeness, and now voice. Tennessee's ELVIS Act extended it explicitly against AI cloning.

Scaling obligations to potential harm rather than regulating the technology as such. The EU's four-tier structure is the reference implementation; Vietnam, Peru, and most pending bills follow it.

A frontier developer's published protocol for assessing and managing catastrophic risks. California SB 53 requires one now, New York's RAISE Act from 2027, and Illinois' Safety Measures Act from 2028, when Illinois also begins requiring an independent audit of it.

Rating people across contexts in ways that produce detrimental treatment. Banned by the EU AI Act and prohibited in Saudi Arabia's SDAIA principles.

Fixed damages per violation without proving actual harm. Under BIPA they once accrued per scan, which is how nine-figure settlements happened; a 2024 amendment limits repeated collection from the same person to a single recovery.

Any AI-generated audio, image, video, or text. The regulatory questions are provenance, labeling, and consent, answered differently in every jurisdiction.

A digitally created figure, usually AI-generated, that appears to be a real human performer but is not recognizable as any identifiable person. New York has required ads to disclose synthetic performers since June 9, 2026, and California's SB 1050 adds a disclosure rule, audio ads included, from January 1, 2027.

The EU's category for the most capable GPAI models, presumed at very large training scale, carrying evaluation, incident-reporting, and cybersecurity duties.

California's Transparency in Frontier Artificial Intelligence Act (SB 53), effective January 1, 2026: safety frameworks, incident reporting, and whistleblower protection for frontier developers.

The Texas Responsible Artificial Intelligence Governance Act, effective January 1, 2026: intent-based prohibitions on harmful uses, enforcement by the attorney general with no private suits, fines from $10,000 to $200,000.

Documentation of what data trained a model. California's AB 2013 requires public summaries; the EU requires a sufficiently detailed summary under a template.

Duties to tell people they are dealing with AI or AI-generated content: chatbot disclosure, deepfake labeling, and machine-readable marking. The EU's version, Article 50 of the AI Act, has applied since August 2, 2026.

Embedding a machine-detectable signal in AI-generated content. China requires both visible and embedded marks; California's Transparency Act requires latent disclosure from large generative providers.