I connect regulatory language to its source, business activity and practical governance implications. This public edition includes terms associated with the Financial services & insurance research set.
More below: choose filters, then scroll to the matching references.
178 public financial-services records. JavaScript adds filtering; the readable public subset follows.
Financial integrity & conduct
50 Percent Rule (OFAC)
OFAC ownership rule
The rule treating an entity as blocked when one or more blocked persons own, directly or indirectly, 50 percent or more in the aggregate, even if the entity is not separately listed.
Context, practical use & authoritative sources
Practical significance
Name screening alone is insufficient. Establish ownership relationships and distinguish ownership from control-only risk.
Definition context
US sanctions; aggregation, indirect ownership and specific program provisions require review.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
OFAC FAQ 398
Related financial-services research instruments
US economic sanctions / OFAC compliance
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Governance & assurance
Accountability
Assignment of responsibility for decisions and outcomes, together with mechanisms for explanation, review and corrective action.
Context, practical use & authoritative sources
Practical significance
An agent cannot replace the accountable business, model or risk owner.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
Delaware fiduciary oversight jurisprudence
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
California AB1405 - AI auditor registry and independence
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
New York Responsible AI Safety and Education (RAISE) Act
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Bank Secrecy Act / AML program requirements
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
NAIC model bulletin on insurer use of AI
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
General Data Protection Regulation
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
PIPEDA
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
APRA CPS 234 - Information Security
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Singapore Personal Data Protection Act
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Singapore PDPC guidance on AI use of personal data
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Brazil General Personal Data Protection Law
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
OECD AI Principles
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
NIST SP 800-218A: AI-model secure development profile
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
CISA / international partners: SBOM for AI minimum elements
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
CISA: 2026 minimum elements for an SBOM
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Governance & assurance
Action interlocks
Tool, MCP & Action Control
Place enforceable checks between a proposed operation and its side effects. Tool availability, a model request and transport-level access must not be mistaken for business authorization.
Context, practical use & authoritative sources
Practical significance
Approve a low-value test action, then change its amount or destination before dispatch. The changed request must require a new decision. Also test an unapproved MCP server and a retrieved instruction requesting a privileged tool.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
MCP authorization specification (2026-07-28)
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
AI security
Adversarial machine learning
AML
Study and practice of attacks against machine-learning systems and defenses against them, including manipulation during training or inference and privacy attacks.
Context, practical use & authoritative sources
Practical significance
Scope testing to attacker access, objectives and model/system lifecycle stages.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
MITRE ATLAS
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Financial regulation & resilience
Adverse action (Regulation B)
ECOA adverse action
A covered unfavorable credit decision or change within Regulation B's definition, subject to specific exclusions.
Context, practical use & authoritative sources
Practical significance
Assess the actual decision and required notice; a model score is not itself the full legal event.
Definition context
United States; Equal Credit Opportunity Act and Regulation B.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
12 CFR 1002.2(c)
Related financial-services research instruments
Equal Credit Opportunity Act / Regulation B
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
AI types
Agentic AI
AI agent
An operational system in which a model participates in selecting actions or plans, using tools and feedback to pursue an objective over one or more steps. Agency comes from the system's execution design, not text generation alone.
Context, practical use & authoritative sources
Practical significance
Set authority limits, step budgets, independent action checks and tested interruption paths.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
Interagency model risk management guidance - SR26-2
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
NCCoE: software and AI-agent identity and authorization
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Cybersecurity
AI bill of materials
AIBOM
A structured inventory of AI-related components such as models, datasets, software, tools and dependencies. Schemas and completeness expectations vary.
Context, practical use & authoritative sources
Practical significance
Define scope and provenance explicitly; a list without validation does not establish trustworthiness.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
CISA / international partners: SBOM for AI minimum elements
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
NIST SP 800-218A: AI-model secure development profile
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
CISA: 2026 minimum elements for an SBOM
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Governance & assurance
AI governance
The structures, roles, policies and decisions that direct and control AI use across its lifecycle, with accountable management of risks, outcomes and obligations.
Context, practical use & authoritative sources
Practical significance
Assign authority and evidence requirements before scaling deployment.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
Texas Responsible Artificial Intelligence Governance Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
NAIC model bulletin on insurer use of AI
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
ISO/IEC 42001 AI management systems
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
OECD AI Principles
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
California September 2026 AI oversight executive direction
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
AI regulation & lifecycle
AI literacy
AI competence
Skills, knowledge and understanding enabling providers, deployers and affected people to make informed decisions about AI and its opportunities, risks and possible harm.
Context, practical use & authoritative sources
Practical significance
Tailor training to the person's role, system and context; attendance alone is not evidence of competence.
Definition context
EU AI Act; Article 3 definitions. Commission display; consult the operative legal text.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
EU AI Act Article 3(56); Article 4
Related financial-services research instruments
European Union Artificial Intelligence Act
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
AI regulation & lifecycle
AI regulatory sandbox
regulatory sandbox
A supervised regulatory arrangement that enables development, testing and validation of AI systems under an agreed plan and conditions.
Context, practical use & authoritative sources
Practical significance
Do not confuse regulatory participation with a technical execution sandbox or an exemption from all applicable law.
Definition context
EU AI Act; Article 3 definitions. Commission display; consult the operative legal text.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
EU AI Act Article 3; Chapter VI
Related financial-services research instruments
European Union Artificial Intelligence Act
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Governance & assurance
AI risk management
The coordinated process of identifying, analyzing, evaluating, treating and monitoring AI-related risks to organizations and affected people.
Context, practical use & authoritative sources
Practical significance
Tie assessment to purpose, context, affected populations and actual authority.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
NIST AI Risk Management Framework 1.0
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
ISO/IEC 23894 AI risk management
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
NIST AI RMF critical-infrastructure profile - concept stage
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
AI types
Artificial intelligence
AI
A family of machine-based systems that infer from inputs how to produce predictions, content, recommendations or decisions for explicit or implicit objectives. Systems differ in autonomy, adaptiveness and impact; not every automated rule is legally classified as AI.
Context, practical use & authoritative sources
Practical significance
Inventory the deployed system and its decisions, not only a product label.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
Texas Responsible Artificial Intelligence Governance Act
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
California Transparency in Frontier Artificial Intelligence Act
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
European Union Artificial Intelligence Act
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Cybersecurity
Attack surface
The reachable interfaces, components and trust relationships through which an adversary can interact with a system.
Context, practical use & authoritative sources
Practical significance
Include prompts, retrieval sources, tools, credentials and suppliers in AI attack-surface reviews.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
OWASP AI security guidance
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Governance & assurance
Audience-bound token
A token intended for a specified receiving service or resource, rather than unrestricted use across tools and systems.
Context, practical use & authoritative sources
Practical significance
Validate issuer and audience and reject a token meant for another resource.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
MCP authorization specification (2026-07-28)
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Governance & assurance
Audit
A systematic examination of evidence against defined criteria by a suitably competent party, with independence appropriate to the engagement.
Context, practical use & authoritative sources
Practical significance
Avoid presenting self-assessment as an independent audit.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
FTC Act, Section 5
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
New York City Local Law 144 - automated employment decisions
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Interagency third-party relationship risk management
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Bank Secrecy Act / AML program requirements
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
ISO/IEC 42001 AI management systems
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
ISO/IEC 27001 information security management
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
California SB813 - independent AI verification organizations
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
California AB1405 - AI auditor registry and independence
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
AI regulation & lifecycle
Authorised representative (EU AI Act)
authorized representative
An EU-established person with a written mandate from the provider to perform specified regulatory tasks on its behalf.
Context, practical use & authoritative sources
Practical significance
Check the mandate and appointment duties; this is not the same as a reseller or a general agent.
Definition context
EU AI Act; Article 3 definitions. Commission display; consult the operative legal text.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Article 3(5)
Related financial-services research instruments
European Union Artificial Intelligence Act
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Governance & assurance
Authority lineage
Identity, Delegation & Authorization
Keep the initiating person, each delegated agent and the executing service attributable. A handoff should narrow or preserve authorized scope, not silently create new authority.
Context, practical use & authoritative sources
Practical significance
Give a child agent an out-of-scope target, an expired mandate and a token meant for a different audience. Verify denial at the enforcement point and verify that revoking the parent stops delegated and queued actions.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
NCCoE: software and AI-agent identity and authorization
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Cybersecurity
Authorization
AuthZ
Determining and enforcing the permissions an identified subject has for a resource or action under defined conditions.
Context, practical use & authoritative sources
Practical significance
Evaluate each consequential action, not merely whether a session is logged in.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
MCP authorization specification (2026-07-28)
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
NCCoE: software and AI-agent identity and authorization
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
China Data Security Law
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
NIST SP800-53 Rev.5 - security and privacy controls
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
NIST incident response recommendations
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
OpenTelemetry GenAI span conventions
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Frameworks & assurance practice
Authorization boundary
system boundary
The scope of components and services included in a system authorization decision and its associated assessment.
Context, practical use & authoritative sources
Practical significance
Identify inherited services and interfaces so responsibility does not disappear at the boundary.
Definition context
NIST technical/control vocabulary; binding force depends on adoption, law or contract.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
NIST risk-management/control vocabulary
Related financial-services research instruments
NIST SP800-53 Rev.5 - security and privacy controls
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
NIST Cybersecurity Framework
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
NIST Privacy Framework - final 1.0 / draft 1.1
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
NIST SSDF - SP800-218 v1.1 / v1.2 draft
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
NIST incident response recommendations
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
Privacy & data
Automated decision-making
ADM / ADMT
Use of computational outputs to make or materially influence decisions. Legal restrictions depend on the law, impact and degree of meaningful human involvement.
Context, practical use & authoritative sources
Practical significance
Identify consequential decisions and provide required notice, explanation, review and contestability.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
New York City Local Law 144 - automated employment decisions
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Colorado automated decisionmaking law - SB26-189
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
UK GDPR / Data Protection Act 2018 / DUAA 2025
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Quebec private-sector privacy law (Law 25 reforms)
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Singapore PDPC guidance on AI use of personal data
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Governance & assurance
Behavioral conformance
Runtime Behaviour & Inference Assurance
Evaluate the sequence of plans, tool requests, retries, delegations and outcomes against an approved operating envelope. A plausible final answer is not evidence that the route taken was authorized.
Context, practical use & authoritative sources
Practical significance
Introduce access denial, a failed tool and an impossible task. Confirm the system stops or escalates within scope rather than silently widening permissions, fabricating completion or continuing indefinitely.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
OWASP Top 10 for Agentic Applications 2026
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Financial integrity & conduct
Beneficial owner (CDD Rule)
beneficial ownership
A natural person meeting the ownership or control prong for a covered legal entity customer under the CDD Rule.
Context, practical use & authoritative sources
Practical significance
Apply the specific definition, exemptions and current account-opening relief; do not import Corporate Transparency Act or sanctions definitions.
Definition context
US financial institutions; CDD rules and May 2026 updated FAQ. Entity-specific exceptions and relief apply.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
CDD FAQ B.5; 31 CFR 1010.230(d)
Related financial-services research instruments
Bank Secrecy Act / AML program requirements
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Privacy & data
Biometric data
Data from technical processing of physical, physiological or behavioral characteristics that can identify or confirm identity, with legal scope varying by jurisdiction.
Context, practical use & authoritative sources
Practical significance
Assess purpose, consent/authorization, retention and risks of immutable identifiers.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
Illinois Biometric Information Privacy Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Texas Responsible Artificial Intelligence Governance Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
AI regulation & lifecycle
Biometric identification
one-to-many matching
Automated identification of a person by comparing their biometric characteristics with biometric data held about multiple people.
Context, practical use & authoritative sources
Practical significance
Distinguish one-to-many identification from one-to-one identity verification; the legal treatment can differ.
Definition context
EU AI Act; Article 3 definitions. Commission display; consult the operative legal text.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
EU AI Act Article 3(35)
Related financial-services research instruments
European Union Artificial Intelligence Act
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
AI regulation & lifecycle
Biometric verification
one-to-one matching
Automated one-to-one checking of a person's claimed identity against previously provided biometric data.
Context, practical use & authoritative sources
Practical significance
Document the verification purpose and avoid silently repurposing it into identification or categorization.
Definition context
EU AI Act; Article 3 definitions. Commission display; consult the operative legal text.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
EU AI Act Article 3(36)
Related financial-services research instruments
European Union Artificial Intelligence Act
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Financial integrity & conduct
Blocked property
frozen assets
Property or an interest in property subject to a sanctions freeze prohibiting dealings without authorization; ownership is not simply transferred to the government.
Context, practical use & authoritative sources
Practical significance
Distinguish blocking from rejecting a transaction, and route potential matches for authorized review.
Definition context
US sanctions; terms must be read with the relevant sanctions program and applicable licenses.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
OFAC FAQ 9
Related financial-services research instruments
US economic sanctions / OFAC compliance
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Health & regulated records
Business associate (HIPAA)
BA
A non-workforce actor performing specified functions or services for a covered entity involving protected health information, including qualifying downstream subcontractors.
Context, practical use & authoritative sources
Practical significance
Analyze the actual service and information flow, not just whether a vendor signed a template contract.
Definition context
US HIPAA; 45 CFR 160.103. eCFR is an authoritative but unofficial compilation.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
45 CFR 160.103
Related financial-services research instruments
HIPAA Privacy and Breach Notification Rules
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
HIPAA Security Rule
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Resilience & cryptography
Business continuity
BC
The capability and planning needed to sustain prioritized operations during disruption at acceptable levels.
Context, practical use & authoritative sources
Practical significance
Link dependencies, manual alternatives and decision authority to critical AI-enabled processes.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
APRA CPS 230 - Operational Risk Management
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Frameworks & assurance practice
Compensating control
compensating safeguard
An alternative safeguard selected and justified to address a requirement or risk when the standard control cannot be used as specified, where the governing framework permits it.
Context, practical use & authoritative sources
Practical significance
Document equivalence, limitations, approvals and test evidence; it is not a universal waiver.
Definition context
NIST technical/control vocabulary; binding force depends on adoption, law or contract.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
NIST control tailoring concepts
Related financial-services research instruments
NIST SP800-53 Rev.5 - security and privacy controls
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
NIST Cybersecurity Framework
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
NIST Privacy Framework - final 1.0 / draft 1.1
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
NIST SSDF - SP800-218 v1.1 / v1.2 draft
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
NIST incident response recommendations
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
Cybersecurity
Confidentiality, integrity and availability
CIA
Confidentiality restricts unauthorized disclosure; integrity protects against improper modification or destruction; availability supports timely, reliable access. These objectives can require different controls.
Context, practical use & authoritative sources
Practical significance
Evaluate each objective against the business process, including AI-mediated actions.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
ePrivacy Directive and national implementing laws
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
AI regulation & lifecycle
Conformity assessment
conformity evaluation
The process used to demonstrate whether applicable legal requirements for a product or system have been met.
Context, practical use & authoritative sources
Practical significance
Record the applicable assessment route, scope and evidence; do not equate a general audit with statutory conformity.
Definition context
EU AI Act; Article 3 definitions. Commission display; consult the operative legal text.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
EU AI Act Article 3(20)
Related financial-services research instruments
European Union Artificial Intelligence Act
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
AI security
Confused deputy
A privileged component is induced to misuse its authority on behalf of a less-privileged requester. An agent may act with service-account permissions wider than the user's own.
Context, practical use & authoritative sources
Practical significance
Bind actions to the initiating user's entitlements as well as the workload's identity.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
OWASP Top 10 for Agentic Applications 2026
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Privacy & data
Consent
A permission mechanism whose required characteristics depend on the applicable law; GDPR requires a freely given, specific, informed and unambiguous indication in relevant circumstances.
Context, practical use & authoritative sources
Practical significance
Avoid bundled or coerced choices and make withdrawal effective where consent is relied on.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
California Consumer Privacy Act / CPRA
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Colorado Privacy Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Illinois Biometric Information Privacy Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
General Data Protection Regulation
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
ePrivacy Directive and national implementing laws
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Privacy and Electronic Communications Regulations
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
PIPEDA
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Australian Privacy Act and Australian Privacy Principles
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Singapore Personal Data Protection Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
India Digital Personal Data Protection Act and Rules
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
South Africa Protection of Personal Information Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Virginia Consumer Data Protection Act
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Connecticut Data Privacy Act
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Singapore PDPC guidance on AI use of personal data
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
China Personal Information Protection Law
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
China Interim Measures for Generative AI Services
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Privacy roles & rights
Consent Manager (India DPDP)
Consent Manager
A person registered with the Board to provide a single point for giving, managing, reviewing and withdrawing consent through an accessible, transparent and interoperable platform.
Context, practical use & authoritative sources
Practical significance
A cookie-consent tool is not automatically a registered Consent Manager; check registration and operative requirements.
Definition context
India DPDP Act 2023; Section 2. Definitions do not establish commencement of every substantive duty.
Section 2 of the official Gazette PDF was read. This is a definition review, not a current consolidated-law or commencement audit; phased duties require separate checking.
Section 2(g)
Related financial-services research instruments
India Digital Personal Data Protection Act and Rules
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Resilience & cryptography
Containment
Actions limiting the spread, access, effects or further harm of an incident while enabling investigation and recovery.
Context, practical use & authoritative sources
Practical significance
Pre-authorize appropriate actions and verify that credentials, tools and child processes are actually constrained.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
NIST incident response recommendations
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
MITRE ATLAS
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Resilience & cryptography
Content provenance
content credentials
Information about the origin and history of digital content, potentially protected by cryptographic assertions. Provenance alone does not establish the factual truth of the depicted content.
Context, practical use & authoritative sources
Practical significance
Verify signatures and trust chains while evaluating the content independently.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
California AI Transparency Act - SB942, AB853 and 2026 amendments
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
NIST Generative AI Profile
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Frameworks & assurance practice
Continuous monitoring
ISCM
Ongoing awareness of security, privacy or risk posture through the collection and assessment of defined information.
Context, practical use & authoritative sources
Practical significance
Define cadence, coverage and corrective action; continuous does not mean every event is observed or instantly prevented.
Definition context
NIST technical/control vocabulary; binding force depends on adoption, law or contract.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
NIST SP 800-53 CA-7
Related financial-services research instruments
NIST SP800-53 Rev.5 - security and privacy controls
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
NIST Cybersecurity Framework
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
NIST Privacy Framework - final 1.0 / draft 1.1
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
NIST SSDF - SP800-218 v1.1 / v1.2 draft
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
NIST incident response recommendations
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
Frameworks & assurance practice
Control assessment
security control assessment
Evaluation of whether controls are implemented correctly, operating as intended and producing the desired outcomes against defined criteria.
Context, practical use & authoritative sources
Practical significance
Specify criteria, method, sample, period and limitations; a screenshot of a setting is not complete operating evidence.
Definition context
NIST technical/control vocabulary; binding force depends on adoption, law or contract.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
NIST SP 800-53/800-53A
Related financial-services research instruments
NIST SP800-53 Rev.5 - security and privacy controls
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
NIST Cybersecurity Framework
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
NIST Privacy Framework - final 1.0 / draft 1.1
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
NIST SSDF - SP800-218 v1.1 / v1.2 draft
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
NIST incident response recommendations
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
Frameworks & assurance practice
Control inheritance
inherited control
Reliance on controls supplied by another organizational function or service, with responsibilities and evidence identified.
Context, practical use & authoritative sources
Practical significance
Obtain the provider evidence and document what the customer still must implement.
Definition context
NIST technical/control vocabulary; binding force depends on adoption, law or contract.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
NIST common-control framework
Related financial-services research instruments
NIST SP800-53 Rev.5 - security and privacy controls
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
NIST Cybersecurity Framework
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
NIST Privacy Framework - final 1.0 / draft 1.1
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
NIST SSDF - SP800-218 v1.1 / v1.2 draft
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
NIST incident response recommendations
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
Governance & assurance
Control objective
The intended risk-reduction or compliance outcome a control is meant to achieve, separate from a particular product or procedure.
Context, practical use & authoritative sources
Practical significance
State the objective so independent testing can determine whether it was achieved.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
NIST SP800-53 Rev.5 - security and privacy controls
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Health & regulated records
Covered entity (HIPAA)
HIPAA covered entity
A health plan, health care clearinghouse, or health care provider that electronically transmits health information in a transaction covered by HIPAA.
Context, practical use & authoritative sources
Practical significance
Do not assume every health app, employer or health-data recipient is a HIPAA covered entity.
Definition context
US HIPAA; 45 CFR 160.103. eCFR is an authoritative but unofficial compilation.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
45 CFR 160.103
Related financial-services research instruments
HIPAA Privacy and Breach Notification Rules
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
HIPAA Security Rule
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Financial regulation & resilience
Covered entity (NYDFS Part 500)
NYDFS covered entity
A person operating, or required to operate, under specified authorization in New York's Banking, Insurance or Financial Services Law.
Context, practical use & authoritative sources
Practical significance
Establish the legal entity and authorization; an industry code or New York customer alone does not decide coverage.
Definition context
New York Part 500 definitions; DFS labels this reading copy unofficial. Consult the operative compilation for legal reliance. These are not HIPAA or GLBA definitions.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
23 NYCRR 500.1(e)
Related financial-services research instruments
NYDFS Cybersecurity Regulation
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Financial regulation & resilience
Credit scoring system (Regulation B)
credit scoring
A system that evaluates creditworthiness mechanically using assigned numerical scores, including a distinct category for empirically derived, demonstrably and statistically sound systems.
Context, practical use & authoritative sources
Practical significance
Do not label every AI decision system a qualifying scoring system without examining the regulatory criteria.
Definition context
United States; Equal Credit Opportunity Act and Regulation B.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
12 CFR 1002.2(p)
Related financial-services research instruments
Equal Credit Opportunity Act / Regulation B
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Financial regulation & resilience
Critical or important function (DORA)
CIF
A function whose disruption or deficient performance would materially affect specified financial performance, service continuity or compliance with financial-services obligations.
Context, practical use & authoritative sources
Practical significance
Classify the function case by case; the supplier's marketing tier does not make the determination.
Definition context
EU DORA; Commission answer explaining Article 3(22).
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
DORA Article 3(22); Commission Q&A
Related financial-services research instruments
Digital Operational Resilience Act
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Privacy roles & rights
Cross-context behavioral advertising
CCBA
Targeting advertising using personal information obtained from a consumer's activity across businesses or distinctly branded services under the CCPA definition.
Context, practical use & authoritative sources
Practical significance
Review advertising pixels and recipients; a website's lack of an explicit ad banner does not resolve its data flows.
Definition context
California CCPA/CPRA; official guidance, with statutory definitions and exceptions controlling.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
California Civil Code 1798.140
Related financial-services research instruments
California Consumer Privacy Act / CPRA
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
California Delete Act / DROP data-broker deletion system
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
Resilience & cryptography
Cryptographic agility
crypto-agility
The ability to replace or adjust cryptographic algorithms, parameters and implementations without unacceptable operational disruption.
Context, practical use & authoritative sources
Practical significance
Maintain inventories, abstraction, migration testing and rollback plans.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
NIST post-quantum cryptography standards
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Financial integrity & conduct
Customer due diligence
CDD
Procedures for understanding customers and the nature and purpose of relationships, verifying relevant identities and maintaining risk-based monitoring and information.
Context, practical use & authoritative sources
Practical significance
Distinguish applicable CDD rules from generic KYC terminology; do not apply bank requirements automatically to every nonbank business.
Definition context
US financial institutions; CDD rules and May 2026 updated FAQ. Entity-specific exceptions and relief apply.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
CDD FAQ A and F
Related financial-services research instruments
Bank Secrecy Act / AML program requirements
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Financial regulation & resilience
Customer information (FTC Safeguards Rule)
GLBA customer information
A record containing nonpublic personal information about a financial institution's customer that is handled or maintained by, or on behalf of, the regulated institution.
Context, practical use & authoritative sources
Practical significance
Identify service-provider copies and records in every medium covered by the rule.
Definition context
US FTC Safeguards Rule; entity and information scope are rule-specific.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
16 CFR 314.2(d)
Related financial-services research instruments
GLBA and FTC Safeguards Rule
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Financial integrity & conduct
Customer risk profile
customer risk assessment
The risk-based understanding of a customer's nature and purpose used to support ongoing monitoring and due diligence.
Context, practical use & authoritative sources
Practical significance
Record input provenance and review AI risk scores for data quality and inappropriate proxies.
Definition context
US financial institutions; CDD rules and May 2026 updated FAQ. Entity-specific exceptions and relief apply.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
CDD FAQ F; AML program requirements
Related financial-services research instruments
Bank Secrecy Act / AML program requirements
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Financial regulation & resilience
Cybersecurity event (NYDFS)
Part 500 event
An actual or attempted unauthorized access, disruption or misuse of an information system or its information, whether successful or not.
Context, practical use & authoritative sources
Practical significance
Distinguish the broad event population from the narrower reportable-incident tests.
Definition context
New York Part 500 definitions; DFS labels this reading copy unofficial. Consult the operative compilation for legal reliance. These are not HIPAA or GLBA definitions.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
23 NYCRR 500.1(f)
Related financial-services research instruments
NYDFS Cybersecurity Regulation
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Financial regulation & resilience
Cybersecurity incident (NYDFS)
Part 500 incident
A cybersecurity event satisfying Part 500's specified impact, notification, material-harm or ransomware conditions for the covered entity, affiliates or third-party providers.
Context, practical use & authoritative sources
Practical significance
Apply the incident definition and notice rules separately; not every blocked attack is reportable.
Definition context
New York Part 500 definitions; DFS labels this reading copy unofficial. Consult the operative compilation for legal reliance. These are not HIPAA or GLBA definitions.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
23 NYCRR 500.1(g)
Related financial-services research instruments
NYDFS Cybersecurity Regulation
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Privacy & data
Data controller
The entity determining the purposes and means of personal-data processing under GDPR and related frameworks. The contractual label alone does not determine the role.
Context, practical use & authoritative sources
Practical significance
Document actual decisions and shared responsibilities across AI providers and deployers.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
Virginia Consumer Data Protection Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Colorado Privacy Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Texas Data Privacy and Security Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
General Data Protection Regulation
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
UK GDPR / Data Protection Act 2018 / DUAA 2025
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Brazil General Personal Data Protection Law
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Privacy roles & rights
Data Fiduciary (India DPDP)
Data Fiduciary
A person determining, alone or with others, the purpose and means of processing personal data under India's DPDP Act.
Context, practical use & authoritative sources
Practical significance
Do not equate this statutory role with a corporate director's fiduciary duty or import GDPR obligations wholesale.
Definition context
India DPDP Act 2023; Section 2. Definitions do not establish commencement of every substantive duty.
Section 2 of the official Gazette PDF was read. This is a definition review, not a current consolidated-law or commencement audit; phased duties require separate checking.
Section 2(i)
Related financial-services research instruments
India Digital Personal Data Protection Act and Rules
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Privacy & data
Data lineage
provenance
Lineage records how data moves or is transformed; provenance concerns origin and history. Both help connect outputs to sources, permissions and changes.
Context, practical use & authoritative sources
Practical significance
Carry provenance through chunks, model versions, prompts, tools and resulting evidence.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
California AI Transparency Act - SB942, AB853 and 2026 amendments
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Equal Credit Opportunity Act / Regulation B
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
China Interim Measures for Generative AI Services
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
New Zealand Privacy Act
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
NIST Generative AI Profile
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
NIST SSDF - SP800-218 v1.1 / v1.2 draft
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
NIST SP 800-218A: AI-model secure development profile
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
CISA / international partners: SBOM for AI minimum elements
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
CISA: 2026 minimum elements for an SBOM
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Privacy & data
Data minimization
Limiting personal-data collection and use to what is adequate, relevant and necessary for the stated purpose.
Context, practical use & authoritative sources
Practical significance
Apply to telemetry, prompts, embeddings, evidence exports and test data.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
HIPAA Privacy and Breach Notification Rules
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Singapore PDPC guidance on AI use of personal data
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
NIST Privacy Framework - final 1.0 / draft 1.1
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Privacy & data
Data portability
A right under defined conditions to receive certain personal data in a structured, commonly used, machine-readable form or transmit it to another controller.
Context, practical use & authoritative sources
Practical significance
Distinguish statutory portability from a general requirement to export every internal model artifact.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
California Consumer Privacy Act / CPRA
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Privacy roles & rights
Data Principal (India DPDP)
Data Principal
The individual to whom personal data relates; the definition includes specified parental or guardian representation.
Context, practical use & authoritative sources
Practical significance
Identify the relevant person and representation rules without treating the term as a separate class of corporate customer.
Definition context
India DPDP Act 2023; Section 2. Definitions do not establish commencement of every substantive duty.
Section 2 of the official Gazette PDF was read. This is a definition review, not a current consolidated-law or commencement audit; phased duties require separate checking.
Section 2(j)
Related financial-services research instruments
India Digital Personal Data Protection Act and Rules
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Privacy & data
Data processor
An entity processing personal data on a controller's behalf, within applicable legal and contractual constraints.
Context, practical use & authoritative sources
Practical significance
Control instructions, subprocessors, security and assistance with individual rights.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
Virginia Consumer Data Protection Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
General Data Protection Regulation
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
UK GDPR / Data Protection Act 2018 / DUAA 2025
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Privacy roles & rights
Data Processor (India DPDP)
DPDP processor
A person processing personal data on behalf of a Data Fiduciary under the DPDP Act.
Context, practical use & authoritative sources
Practical significance
Keep processor instructions, contracts and actual processing roles distinct from the GDPR's independently applicable requirements.
Definition context
India DPDP Act 2023; Section 2. Definitions do not establish commencement of every substantive duty.
Section 2 of the official Gazette PDF was read. This is a definition review, not a current consolidated-law or commencement audit; phased duties require separate checking.
Section 2(k)
Related financial-services research instruments
India Digital Personal Data Protection Act and Rules
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Privacy & data
Data protection impact assessment
DPIA
A structured assessment of personal-data processing likely to create high risks to individuals, including necessity, proportionality, risks and safeguards under GDPR.
Context, practical use & authoritative sources
Practical significance
Complete before deployment where required and revisit material changes.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
Colorado Privacy Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
General Data Protection Regulation
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Swiss Federal Act on Data Protection
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Privacy & data
Data residency
The geographic location where data is stored or processed. Residency differs from legal transfer rules, access by foreign entities and confidentiality guarantees.
Context, practical use & authoritative sources
Practical significance
Map remote access, support, telemetry and backups as well as the primary hosting region.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
China Data Security Law
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Privacy & data
Data subject
The person to whom personal data relates, particularly in GDPR terminology.
Context, practical use & authoritative sources
Practical significance
Design rights handling across source data, logs, vectors and downstream processors.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
Brazil General Personal Data Protection Law
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Connecticut Data Privacy Act
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Privacy & data
Data subject access request
DSAR / right of access
A request to exercise access rights to personal information and related processing details, within the applicable regime's scope and limits.
Context, practical use & authoritative sources
Practical significance
Locate relevant records across AI workflows while protecting others' rights and confidential material.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
California Delete Act / DROP data-broker deletion system
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Health & regulated records
Data use agreement (HIPAA)
DUA
The agreement governing a limited data set's permitted uses, recipients and safeguards, including restrictions on identification and contact.
Context, practical use & authoritative sources
Practical significance
Specify the allowed purpose and downstream terms before using a limited data set in analytics or AI.
Definition context
US HIPAA; 45 CFR 164.514. Legal exceptions and permitted purposes matter.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
45 CFR 164.514(e)(4)
Related financial-services research instruments
HIPAA Privacy and Breach Notification Rules
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Governance & assurance
Decision evidence
Execution Provenance & Forensics
Create an independently protected record connecting the mandate, relevant inputs, versions, policy decisions, actions and observed outcomes. Make uncertainty and missing evidence explicit.
Context, practical use & authoritative sources
Practical significance
Attempt to modify evidence from the agent role, drop a collector feed and produce a false success message. Verify denial, a visible evidence-gap alert and an outcome report that distinguishes assertion from corroborated state.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
OpenTelemetry GenAI span conventions
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Governance & assurance
Delegated authority chain
Delegation chain
A record linking the initiating principal, delegated agents and executing services to the mandate and permissions for a task.
Context, practical use & authoritative sources
Practical significance
Track onward delegation and the scope retained at each handoff.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
NCCoE: software and AI-agent identity and authorization
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Agentic architecture
Delegation
Assigning a subtask or authority to another agent, person or service. Delegation should not enlarge privileges or remove the originating owner's accountability.
Context, practical use & authoritative sources
Practical significance
Bind scope, duration and permitted onward delegation to each handoff.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
NCCoE: software and AI-agent identity and authorization
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
AI regulation & lifecycle
Deployer (EU AI Act)
AI deployer
An actor using an AI system under its authority, other than for a personal, non-professional activity.
Context, practical use & authoritative sources
Practical significance
Separate the deploying organization's duties from those of the developer and an individual end user.
Definition context
EU AI Act; Article 3 definitions. Commission display; consult the operative legal text.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Article 3(4)
Related financial-services research instruments
European Union Artificial Intelligence Act
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Financial regulation & resilience
Digital operational resilience
DORA resilience
A financial entity's ability to maintain operational integrity and reliability through the capabilities needed to manage ICT-related disruption and support financial services.
Context, practical use & authoritative sources
Practical significance
Assess business-service continuity and third-party dependencies, not uptime alone.
Definition context
EU DORA; overview and linked technical standards. Definitions below are explanatory summaries.
Official EIOPA overview and linked-standard index reviewed; direct EUR-Lex retrieval was restricted. Explanatory orientation, not clause-level validation.
DORA Article 3(1)
Related financial-services research instruments
Digital Operational Resilience Act
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Financial regulation & resilience
Disclosure controls and procedures
disclosure controls
Processes designed to ensure required issuer disclosures are recorded, processed, summarized and reported, with information communicated for timely decisions.
Context, practical use & authoritative sources
Practical significance
Connect technical incident escalation to the disclosure decision makers and preserve the basis for their assessment.
Definition context
United States public-company reporting; materiality and filing duties are context-specific.
SEC official adoption summary supports orientation; use the operative rules and filing instructions for an actual issuer decision.
Exchange Act Rules 13a-15(e), 15d-15(e)
Related financial-services research instruments
SEC cybersecurity disclosure rules
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
SEC Regulation S-P
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
Resilience & cryptography
Distributed trace
trace ID / span
A correlated record of a request across components; spans represent individual operations within the trace.
Context, practical use & authoritative sources
Practical significance
Preserve correlation across model, retrieval, policy and tool calls with privacy-appropriate logging.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
OpenTelemetry GenAI span conventions
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
AI regulation & lifecycle
Distributor (EU AI Act)
AI distributor
A supply-chain actor, other than provider or importer, that makes an AI system available on the Union market.
Context, practical use & authoritative sources
Practical significance
Distinguish distribution from use and identify any verification or corrective-action duties.
Definition context
EU AI Act; Article 3 definitions. Commission display; consult the operative legal text.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Article 3(7)
Related financial-services research instruments
European Union Artificial Intelligence Act
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Health & regulated records
Electronic protected health information
ePHI
Protected health information maintained or transmitted in the electronic media covered by the HIPAA definition.
Context, practical use & authoritative sources
Practical significance
Include electronic copies, system integrations and covered processing environments in the Security Rule scope.
Definition context
US HIPAA; 45 CFR 160.103. eCFR is an authoritative but unofficial compilation.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
45 CFR 160.103
Related financial-services research instruments
HIPAA Privacy and Breach Notification Rules
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
HIPAA Security Rule
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
AI regulation & lifecycle
Emotion recognition system
emotion inference
An AI system intended to identify or infer people's emotions or intentions from biometric data.
Context, practical use & authoritative sources
Practical significance
Establish the source data, use context and any prohibition or exception before deploying it.
Definition context
EU AI Act; Article 3 definitions. Commission display; consult the operative legal text.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
EU AI Act Article 3(39)
Related financial-services research instruments
European Union Artificial Intelligence Act
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Resilience & cryptography
Encryption
A transformation using cryptography to protect confidentiality, with keys controlling recovery of the original information.
Context, practical use & authoritative sources
Practical significance
Govern key access, algorithms, implementations and data handling before and after encryption.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
GLBA and FTC Safeguards Rule
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
PCI DSS v4.0.1
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Privacy & data
Erasure
right to deletion
A right to deletion under specified conditions, with exceptions such as legal obligations or legal claims. It is not an unconditional right to erase every record.
Context, practical use & authoritative sources
Practical significance
Map records, backups, retrieval indexes and processor copies, and document any lawful retention.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
California Delete Act / DROP data-broker deletion system
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
AI security
Excessive agency
Risk arising from unnecessary functionality, permissions or autonomy given to an AI-enabled system.
Context, practical use & authoritative sources
Practical significance
Minimize executable capabilities and require independent authorization for material effects.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
OWASP AI security guidance
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
OWASP Top 10 for Agentic Applications 2026
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Health & regulated records
Expert determination (HIPAA)
expert de-identification
A qualified expert's documented finding that the risk of identification is very small under the specified data, recipient and anticipated-use conditions.
Context, practical use & authoritative sources
Practical significance
Retain the analysis and evaluate changes to linkage data or recipients; the finding is not universal anonymity.
Definition context
US HIPAA; 45 CFR 164.514. Legal exceptions and permitted purposes matter.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
45 CFR 164.514(b)(1)
Related financial-services research instruments
HIPAA Privacy and Breach Notification Rules
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Governance & assurance
Explainability
Providing information about the mechanisms or factors contributing to a system's output in a way useful to the relevant audience.
Context, practical use & authoritative sources
Practical significance
Match explanations to users' decisions; a fluent narrative may not reflect the true mechanism.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
Equal Credit Opportunity Act / Regulation B
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Governance & assurance
Fairness
A context-dependent set of considerations concerning harmful bias and equitable treatment. Different statistical fairness criteria can conflict.
Context, practical use & authoritative sources
Practical significance
Choose and justify criteria with legal, domain and affected-stakeholder input.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
Title VII and employment discrimination
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Americans with Disabilities Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Equal Credit Opportunity Act / Regulation B
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
NAIC model bulletin on insurer use of AI
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
FCA Consumer Duty
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
China Personal Information Protection Law
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Governance & assurance
Fiduciary oversight
The responsibilities of directors and relevant officers to exercise oversight under applicable corporate law. In Delaware, oversight claims involve demanding, context-specific standards; an adverse outcome alone is not a breach.
Context, practical use & authoritative sources
Practical significance
Maintain reasonable reporting systems and respond in good faith to significant warnings within assigned responsibilities.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
SEC cybersecurity disclosure rules
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Delaware fiduciary oversight jurisprudence
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Financial regulation & resilience
Financial institution (FTC Safeguards Rule)
Safeguards financial institution
An institution within the rule's defined financial-activity and FTC-jurisdiction scope, not merely an organization using finance software.
Context, practical use & authoritative sources
Practical significance
Check the statutory activity test, examples and jurisdictional boundaries before treating a firm as covered.
Definition context
US FTC Safeguards Rule; entity and information scope are rule-specific.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
16 CFR 314.2(h)
Related financial-services research instruments
GLBA and FTC Safeguards Rule
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
AI types
Foundation model
FM
A model trained on broad data at scale that can be adapted to many downstream tasks. A foundation model is an underlying capability, not a finished governed business process.
Context, practical use & authoritative sources
Practical significance
Assess shared-model concentration and the controls added by each downstream application.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
California Transparency in Frontier Artificial Intelligence Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
New York Responsible AI Safety and Education (RAISE) Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
AI types
General-purpose AI model
GPAI
An EU AI Act category for models with significant generality capable of competently performing a wide range of distinct tasks and integration into many systems. It is a legal category, not a synonym for AGI.
Context, practical use & authoritative sources
Practical significance
Determine provider, downstream and systemic-risk roles against the actual statutory definition.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
European Union Artificial Intelligence Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
AI types
Generative AI
GenAI / GAI
AI that produces synthetic content such as text, code, images, audio or video based on learned patterns. It may generate plausible content that is inaccurate, harmful or unsupported.
Context, practical use & authoritative sources
Practical significance
Require validation, provenance and approval appropriate to the consequences of publication or execution.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
California AI Transparency Act - SB942, AB853 and 2026 amendments
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
China Interim Measures for Generative AI Services
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
NIST Generative AI Profile
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Interagency model risk management guidance - SR26-2
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
OpenTelemetry GenAI span conventions
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Governance & assurance
Governance, risk and compliance
GRC
Coordinated governance of objectives and authority, management of risk, and fulfillment of applicable obligations.
Context, practical use & authoritative sources
Practical significance
Connect the legal requirement to the actual control owner, test and decision record.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
NIST Cybersecurity Framework
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Models & learning
Hallucination
confabulation
Generated content presented plausibly but unsupported or false in the relevant context. It can include invented facts, citations, conclusions or assertions about actions performed.
Context, practical use & authoritative sources
Practical significance
Require evidence checks where decisions affect rights, finances, safety or public statements.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
NIST Generative AI Profile
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Health & regulated records
Health care clearinghouse
healthcare clearinghouse
An entity that converts or facilitates conversion between nonstandard health information and standard transaction formats or data elements.
Context, practical use & authoritative sources
Practical significance
Include claims-processing intermediaries in the entity and data-flow inventory.
Definition context
US HIPAA; 45 CFR 160.103. eCFR is an authoritative but unofficial compilation.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
45 CFR 160.103
Related financial-services research instruments
HIPAA Privacy and Breach Notification Rules
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
HIPAA Security Rule
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Agentic architecture
Human oversight
Organizational and technical arrangements enabling qualified people to understand, monitor, challenge or stop an AI system as required by its risk and applicable law.
Context, practical use & authoritative sources
Practical significance
Assign named owners, escalation routes and tested override authority.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
Americans with Disabilities Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
European Union Artificial Intelligence Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
FCA Consumer Duty
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Web Content Accessibility Guidelines
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Financial regulation & resilience
ICT concentration risk
concentration risk
Exposure created when multiple services or entities rely on a small set of ICT providers or on providers that are difficult to replace.
Context, practical use & authoritative sources
Practical significance
Map substitutability and common dependencies; a list of direct suppliers alone can miss concentration.
Definition context
EU DORA; overview and linked technical standards. Definitions below are explanatory summaries.
Official EIOPA overview and linked-standard index reviewed; direct EUR-Lex retrieval was restricted. Explanatory orientation, not clause-level validation.
DORA Article 3; Article 29
Related financial-services research instruments
Digital Operational Resilience Act
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Financial regulation & resilience
ICT third-party risk
ICT supplier risk
Risk arising from reliance on externally provided information and communication technology services, including relevant subcontracting dependencies.
Context, practical use & authoritative sources
Practical significance
Identify concentration, access, continuity and exit risks through the service chain.
Definition context
EU DORA; overview and linked technical standards. Definitions below are explanatory summaries.
Official EIOPA overview and linked-standard index reviewed; direct EUR-Lex retrieval was restricted. Explanatory orientation, not clause-level validation.
DORA Article 3; Chapter V
Related financial-services research instruments
Digital Operational Resilience Act
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Governance & assurance
Impact containment
Resilience, Containment & Economic Abuse
Bound the operational, financial and physical consequences of a failed or manipulated workflow. Make interruption, isolation and safe recovery enforceable outside the agent.
Context, practical use & authoritative sources
Practical significance
Trigger a bounded retry storm and create a test child job. Withdraw the mandate. Verify spend and tool use stop across the chain, the child cannot restart it, and an authorized operator can restore a validated safe state.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
NIST AI Risk Management Framework 1.0
author application context: An author-defined organizing concept applied to financial-sector AI oversight. Not NIST terminology or a binding requirement.
Financial regulation & resilience
Impact tolerance
tolerance for disruption
The maximum tolerable level of disruption to an important business service under the applicable UK framework.
Context, practical use & authoritative sources
Practical significance
Distinguish the limit on tolerable harm from an internal recovery target; test severe but plausible scenarios.
Definition context
United Kingdom; FCA operational-resilience rules for firms in scope.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
FCA operational resilience rules
Related financial-services research instruments
FCA operational resilience rules
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
FCA Consumer Duty
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
Financial regulation & resilience
Important business service
IBS
A service provided to external users whose disruption could cause the harm identified by the applicable UK operational-resilience rules.
Context, practical use & authoritative sources
Practical significance
Identify the service as the customer experiences it, then map its people, processes, technology and dependencies.
Definition context
United Kingdom; FCA operational-resilience rules for firms in scope.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
FCA operational resilience rules
Related financial-services research instruments
FCA operational resilience rules
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
FCA Consumer Duty
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
AI regulation & lifecycle
Importer (EU AI Act)
AI importer
An EU-established actor placing on the Union market an AI system bearing the name or trademark of an actor established outside the Union.
Context, practical use & authoritative sources
Practical significance
Analyze placement and branding instead of treating every cloud customer as an importer.
Definition context
EU AI Act; Article 3 definitions. Commission display; consult the operative legal text.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Article 3(6)
Related financial-services research instruments
European Union Artificial Intelligence Act
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Models & learning
Inference
Using a trained model to produce an output from inputs. Ordinary inference does not necessarily update weights, but outputs can still change with context, sampling and external data.
Context, practical use & authoritative sources
Practical significance
Log the model version and consequential context without indiscriminately retaining sensitive payloads.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
HIPAA Privacy and Breach Notification Rules
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
AI regulation & lifecycle
Intended purpose (EU AI Act)
intended use
The use envisaged by the provider, including the relevant context and conditions, as expressed in instructions, documentation and promotional or sales materials.
Context, practical use & authoritative sources
Practical significance
Reconcile marketing claims, instructions and actual deployment before classifying the system.
Definition context
EU AI Act; Article 3 definitions. Commission display; consult the operative legal text.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Article 3(12)
Related financial-services research instruments
European Union Artificial Intelligence Act
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Privacy & data
International data transfer
A transfer of personal data subject to applicable cross-border rules, which may include remote access depending on the regime.
Context, practical use & authoritative sources
Practical significance
Identify the transfer mechanism, destination risks and supplementary measures where required.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
Japan Act on the Protection of Personal Information
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
China Personal Information Protection Law
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Agentic architecture
Kill switch
emergency stop
A mechanism to interrupt an unsafe process. For agents, stopping the user interface alone may not stop child processes, credentials, scheduled jobs or external actions.
Context, practical use & authoritative sources
Practical significance
Test coordinated revocation and termination in an independent control domain.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
California September 2026 AI oversight executive direction
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Governance & assurance
Knowledge stewardship
Data, Retrieval & Memory Integrity
Govern source material, retrieved passages and persistent memory as related but distinct stores. Carry permissions, origin, quality and lifecycle obligations through their transformations.
Context, practical use & authoritative sources
Practical significance
Plant a benign test instruction in a retrieved document, revoke a source permission and inject a false memory into a test session. Confirm that action authority does not expand, access changes propagate and the memory can be identified and isolated.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
NIST AI Risk Management Framework 1.0
author application context: An author-defined organizing concept applied to financial-sector AI oversight. Not NIST terminology or a binding requirement.
Privacy & data
Lawful basis
The legal ground permitting a particular processing operation under the relevant data-protection regime. Consent is one possible basis, not a universal requirement or cure.
Context, practical use & authoritative sources
Practical significance
Record the basis separately for training, deployment, logging and onward sharing.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
General Data Protection Regulation
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
UK GDPR / Data Protection Act 2018 / DUAA 2025
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Cybersecurity
Least privilege
Granting only the permissions necessary for an authorized function, for an appropriate duration.
Context, practical use & authoritative sources
Practical significance
Apply it to agents, administrators, APIs and suppliers, with periodic review.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
MAS Technology Risk Management Guidelines
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
NIST SP800-53 Rev.5 - security and privacy controls
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Financial integrity & conduct
Legal entity customer (CDD Rule)
legal-entity customer
A covered organization such as a corporation, limited liability company or general partnership opening an account, subject to the rule's exclusions.
Context, practical use & authoritative sources
Practical significance
Resolve legal form and exclusions instead of equating every business customer with a covered legal entity customer.
Definition context
US financial institutions; CDD rules and May 2026 updated FAQ. Entity-specific exceptions and relief apply.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
CDD FAQ E; 31 CFR 1010.230(e)
Related financial-services research instruments
Bank Secrecy Act / AML program requirements
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Privacy roles & rights
Legitimate interests (EU GDPR)
legitimate interest assessment / LIA
A possible processing basis requiring a legitimate purpose, necessity and a balance against the individual's overriding interests, rights and freedoms.
Context, practical use & authoritative sources
Practical significance
Document the purpose and balancing assessment; it is not a general permission for any useful analytics.
Definition context
European Union GDPR; regulator guide rather than a replacement for statutory text.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
GDPR Article 6(1)(f)
Related financial-services research instruments
General Data Protection Regulation
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Governance & assurance
Lifecycle accountability
Governance, Supply Chain & Lifecycle
Keep use cases, dependencies, obligations, control owners and material changes under accountable governance from procurement through retirement. Repeatable evidence supports decisions; it does not transfer accountability.
Context, practical use & authoritative sources
Practical significance
Change a model version, tool schema or upstream source. Verify that the material change triggers the required review and regression tests, including delegation, memory, action gates and evidence capture.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
NIST SP 800-218A: AI-model secure development profile
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
CISA / international partners: SBOM for AI minimum elements
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
CISA: 2026 minimum elements for an SBOM
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Health & regulated records
Limited data set (HIPAA)
LDS
Protected health information from which specified direct identifiers have been removed, available under a compliant data use agreement for limited purposes.
Context, practical use & authoritative sources
Practical significance
A limited data set remains PHI; it is not automatically de-identified information or unrestricted training data.
Definition context
US HIPAA; 45 CFR 164.514. Legal exceptions and permitted purposes matter.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
45 CFR 164.514(e)
Related financial-services research instruments
HIPAA Privacy and Breach Notification Rules
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Financial regulation & resilience
Material cybersecurity incident
material cyber incident
A cybersecurity incident determined material under applicable securities-law principles and the relevant disclosure framework.
Context, practical use & authoritative sources
Practical significance
Consider qualitative and quantitative effects; a severity label from a security tool is not the legal materiality determination.
Definition context
United States public-company reporting; materiality and filing duties are context-specific.
SEC official adoption summary supports orientation; use the operative rules and filing instructions for an actual issuer decision.
SEC Form 8-K Item 1.05; Regulation S-K Item 106
Related financial-services research instruments
SEC cybersecurity disclosure rules
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
SEC Regulation S-P
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
Governance & assurance
Materiality
A threshold for significance under a particular legal, financial, safety or governance context. Different regimes can apply different tests.
Context, practical use & authoritative sources
Practical significance
Do not use a single technical severity score as every legal materiality decision.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
SEC cybersecurity disclosure rules
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Interagency model risk management guidance - SR26-2
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
OWASP Top 10 for Agentic Applications 2026
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Health & regulated records
Minimum necessary (HIPAA)
minimum-necessary standard
The requirement to reasonably limit specified uses, disclosures and requests to the PHI needed for their purpose, subject to stated exceptions.
Context, practical use & authoritative sources
Practical significance
Test access and retrieval limits; do not apply the rule mechanically where an exception governs.
Definition context
US HIPAA; 45 CFR 164.514. Legal exceptions and permitted purposes matter.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
45 CFR 164.514(d); 164.502(b)
Related financial-services research instruments
HIPAA Privacy and Breach Notification Rules
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Resilience & cryptography
ML-DSA
The Module-Lattice-Based Digital Signature Algorithm standardized in FIPS 204.
Context, practical use & authoritative sources
Practical significance
Use signatures within a verifiable trust and key-management system; a signed artifact can still be unsafe.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
NIST post-quantum cryptography standards
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Resilience & cryptography
ML-KEM
The Module-Lattice-Based Key-Encapsulation Mechanism standardized in FIPS 203 for establishing shared secret keys. It is not a digital signature algorithm.
Context, practical use & authoritative sources
Practical significance
Combine with an approved protocol, symmetric encryption and sound key lifecycle controls.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
NIST post-quantum cryptography standards
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Agentic architecture
Model Context Protocol
MCP
An open protocol for connecting AI applications with tools, resources and prompts through defined client-server interactions. Compatibility does not establish trustworthiness of a server or tool.
Context, practical use & authoritative sources
Practical significance
Approve servers, scopes, authentication and input/output handling as supply-chain dependencies.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
MCP authorization specification (2026-07-28)
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Models & learning
Model evaluation
evals
Structured measurement of a model or system against defined tasks, criteria and conditions. Evaluation results are bounded by the tested population and environment.
Context, practical use & authoritative sources
Practical significance
Include adversarial, subgroup, operational and change-regression tests, not a single headline score.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
Interagency model risk management guidance - SR26-2
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
AI security
Model supply-chain compromise
Insertion or alteration of unsafe models, datasets, packages, adapters or tools through upstream dependencies.
Context, practical use & authoritative sources
Practical significance
Use provenance, integrity verification, version pinning and supplier assessment.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
NIST SP 800-218A: AI-model secure development profile
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Financial integrity & conduct
Money services business
MSB
An actor conducting one or more covered money-services activities under the BSA definition, subject to activity-specific thresholds and exceptions.
Context, practical use & authoritative sources
Practical significance
Determine each performed activity and the relevant registration, AML and reporting rules rather than relying solely on a NAICS label.
Definition context
US BSA; MSB categories, thresholds and exceptions depend on the activity.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
31 CFR 1010.100(ff); FinCEN MSB overview
Related financial-services research instruments
Bank Secrecy Act / AML program requirements
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Cybersecurity
Multi-factor authentication
MFA
Authentication using factors from different categories, such as something known, possessed or inherent to the subject. Two passwords do not constitute two factors.
Context, practical use & authoritative sources
Practical significance
Prefer phishing-resistant methods for material access and test bypass/recovery paths.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
NYDFS Cybersecurity Regulation
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
PCI DSS v4.0.1
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Agentic architecture
Non-human identity
NHI / workload identity
An identity assigned to software, services, agents or devices rather than a person. It still needs an accountable human owner and a defined lifecycle.
Context, practical use & authoritative sources
Practical significance
Track issuance, purpose, privilege, delegation, rotation and revocation.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
NCCoE: software and AI-agent identity and authorization
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Financial regulation & resilience
Nonpublic information (NYDFS)
NYDFS NPI
The defined electronic business, identifying and health information protected by Part 500 when not publicly available.
Context, practical use & authoritative sources
Practical significance
Apply each statutory category; the term is broader than a shorthand list of customer personal data.
Definition context
New York Part 500 definitions; DFS labels this reading copy unofficial. Consult the operative compilation for legal reliance. These are not HIPAA or GLBA definitions.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
23 NYCRR 500.1(k)
Related financial-services research instruments
NYDFS Cybersecurity Regulation
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Financial regulation & resilience
Notification event (FTC Safeguards Rule)
Safeguards notification event
Unauthorized acquisition of unencrypted customer information as defined by the rule, including its encryption-key and presumed-acquisition provisions.
Context, practical use & authoritative sources
Practical significance
Apply the separate notice threshold and timing requirements; do not equate this term with every detected incident.
Definition context
US FTC Safeguards Rule; entity and information scope are rule-specific.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
16 CFR 314.2(m)
Related financial-services research instruments
GLBA and FTC Safeguards Rule
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
AI regulation & lifecycle
Notified body
notified assessment body
A conformity-assessment body formally notified under the applicable EU regime to perform specified third-party assessment activities.
Context, practical use & authoritative sources
Practical significance
Confirm designation and scope, not merely the assessor's brand or certification claims.
Definition context
EU AI Act; Article 3 definitions. Commission display; consult the operative legal text.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
EU AI Act Article 3(22)
Related financial-services research instruments
European Union Artificial Intelligence Act
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Resilience & cryptography
Observability
Ability to understand system behavior using outputs such as logs, metrics and traces. Visibility is not equivalent to effective detection or control.
Context, practical use & authoritative sources
Practical significance
Define which signals establish authority, outcome and control effectiveness.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
India CERT-In cybersecurity directions
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
OpenTelemetry GenAI span conventions
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Governance & assurance
Operating effectiveness
Whether a control is implemented and performs as intended over the relevant period or sample of operations.
Context, practical use & authoritative sources
Practical significance
Use current evidence rather than policy existence or vendor assertions alone.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
APRA CPS 234 - Information Security
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Privacy roles & rights
Opt-out preference signal
Global Privacy Control / GPC
A user-enabled signal communicating a privacy choice that an applicable rule requires covered businesses to recognize.
Context, practical use & authoritative sources
Practical significance
Test signal handling and downstream effect; the recognized technical and legal requirements vary.
Definition context
California CCPA/CPRA; official guidance, with statutory definitions and exceptions controlling.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
CCPA guidance and regulations
Related financial-services research instruments
California Consumer Privacy Act / CPRA
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
California Delete Act / DROP data-broker deletion system
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
Privacy & data
Personal data
personal information
Information relating to an identified or identifiable person under the applicable legal definition. Identifiability can be indirect and depends on context and available means.
Context, practical use & authoritative sources
Practical significance
Assess inference, linkage and metadata, not only names or account numbers.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
California Consumer Privacy Act / CPRA
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Connecticut Data Privacy Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Texas Data Privacy and Security Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Fair Credit Reporting Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Privacy and Electronic Communications Regulations
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
PIPEDA
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Australian Privacy Act and Australian Privacy Principles
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Singapore Personal Data Protection Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Japan Act on the Protection of Personal Information
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
India Digital Personal Data Protection Act and Rules
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
South Africa Protection of Personal Information Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Swiss Federal Act on Data Protection
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
New Zealand Privacy Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Quebec private-sector privacy law (Law 25 reforms)
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Singapore PDPC guidance on AI use of personal data
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
China Personal Information Protection Law
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
China Data Security Law
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
China Interim Measures for Generative AI Services
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Brazil General Personal Data Protection Law
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Privacy & data
Personal data breach
A security breach leading to accidental or unlawful destruction, loss, alteration, disclosure of or access to personal data under the applicable definition.
Context, practical use & authoritative sources
Practical significance
Assess notification triggers and clocks separately for each affected jurisdiction and sector.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
New York SHIELD Act and breach notification
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
SEC Regulation S-P
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
New Zealand Privacy Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Frameworks & assurance practice
Plan of action and milestones
POA&M / POAM
A managed record of identified weaknesses, planned corrective actions, resources, milestones and completion dates.
Context, practical use & authoritative sources
Practical significance
Track evidence of remediation and independent retest; do not treat the plan as remediation itself.
Definition context
NIST technical/control vocabulary; binding force depends on adoption, law or contract.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
NIST SP 800-53 CA-5
Related financial-services research instruments
NIST SP800-53 Rev.5 - security and privacy controls
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
NIST Cybersecurity Framework
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
NIST Privacy Framework - final 1.0 / draft 1.1
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
NIST SSDF - SP800-218 v1.1 / v1.2 draft
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
NIST incident response recommendations
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
AI regulation & lifecycle
Post-market monitoring system
post-market monitoring
Provider activities to collect and evaluate operating experience after market placement or service entry, so necessary corrective or preventive action can be identified.
Context, practical use & authoritative sources
Practical significance
Define data sources, escalation thresholds, accountable owners and evidence retention after deployment.
Definition context
EU AI Act; Article 3 definitions. Commission display; consult the operative legal text.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
EU AI Act Article 3(25)
Related financial-services research instruments
European Union Artificial Intelligence Act
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Resilience & cryptography
Post-quantum cryptography
PQC
Cryptographic algorithms designed to resist known attacks by both conventional and quantum computers. The term concerns algorithmic security, not immunity of an entire system.
Context, practical use & authoritative sources
Practical significance
Inventory dependencies, plan migration and validate protocol and implementation support.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
NIST post-quantum cryptography standards
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Privacy & data
Privacy impact assessment
PIA
A broader assessment of how information processing affects privacy and how resulting risks should be managed. Legal forms and triggers vary.
Context, practical use & authoritative sources
Practical significance
Include inference, surveillance and inappropriate use even without a security breach.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
Quebec private-sector privacy law (Law 25 reforms)
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
NIST Privacy Framework - final 1.0 / draft 1.1
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Privacy & data
Profiling
Automated processing that evaluates personal aspects such as behavior, preferences or performance, within the applicable legal definition.
Context, practical use & authoritative sources
Practical significance
Assess discriminatory effects, transparency and secondary use of inferred attributes.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
Virginia Consumer Data Protection Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Colorado Privacy Act
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Privacy and Electronic Communications Regulations
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Models & learning
Prompt
Instructions or other input supplied to a model, potentially including user text, system messages, examples and retrieved material. Prompt content is not a substitute for external access control.
Context, practical use & authoritative sources
Practical significance
Treat prompts as controlled inputs and protect sensitive material included in them.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
OpenTelemetry GenAI span conventions
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
AI security
Prompt injection
An attempt to make an AI system follow unauthorized instructions supplied in a prompt or in material it processes. It can redirect outputs or tool use without changing model weights.
Context, practical use & authoritative sources
Practical significance
Treat untrusted content as data and enforce consequential restrictions outside the model.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
OWASP AI security guidance
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Privacy & data
Protected health information
PHI / ePHI
Individually identifiable health information within HIPAA's defined scope and exceptions; ePHI is its electronic form. Not all health-related data is HIPAA-covered.
Context, practical use & authoritative sources
Practical significance
Identify covered-entity or business-associate status and applicable non-HIPAA rules.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
HIPAA Privacy and Breach Notification Rules
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
HIPAA Security Rule
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
AI regulation & lifecycle
Provider (EU AI Act)
AI provider
The actor that develops an AI system or general-purpose AI model, or has it developed, and places it on the market or puts the system into service under its own name or trademark.
Context, practical use & authoritative sources
Practical significance
Determine the actual legal role; a purchaser may assume provider obligations after specified changes or rebranding.
Definition context
EU AI Act; Article 3 definitions. Commission display; consult the operative legal text.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Article 3(3)
Related financial-services research instruments
European Union Artificial Intelligence Act
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Privacy roles & rights
Public-interest task
public task
Processing necessary for a task in the public interest or exercise of official authority vested in the controller under the required legal basis.
Context, practical use & authoritative sources
Practical significance
Identify the law conferring the task; being beneficial to the public does not alone establish the ground.
Definition context
European Union GDPR; regulator guide rather than a replacement for statutory text.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
GDPR Article 6(1)(e); Article 6(3)
Related financial-services research instruments
General Data Protection Regulation
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Privacy & data
Purpose limitation
Restricting collection and subsequent processing to specified, legitimate purposes, with rules governing compatible reuse.
Context, practical use & authoritative sources
Practical significance
Assess whether reusing operational data for training introduces a new purpose.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
Singapore Personal Data Protection Act
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Financial regulation & resilience
Qualified Individual (FTC Safeguards Rule)
Qualified Individual
The person designated to oversee, implement and enforce the institution's information-security program under the rule.
Context, practical use & authoritative sources
Practical significance
Document competence, reporting, service-provider arrangements and retained institutional responsibility.
Definition context
US FTC Safeguards Rule; 16 CFR 314.4.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
16 CFR 314.4(a)
Related financial-services research instruments
GLBA and FTC Safeguards Rule
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Cybersecurity
Ransomware
Malicious activity that denies access, encrypts data or combines disruption with extortion, often including data theft.
Context, practical use & authoritative sources
Practical significance
Exercise restoration, isolation, evidence preservation and decision authority before an incident.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
Cyber Incident Reporting for Critical Infrastructure Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
AI regulation & lifecycle
Reasonably foreseeable misuse
foreseeable misuse
Use outside an AI system's intended purpose that can reasonably follow from predictable human behavior or interaction with other systems.
Context, practical use & authoritative sources
Practical significance
Include realistic misuse in scenario testing without suggesting that every conceivable abuse is foreseeable.
Definition context
EU AI Act; Article 3 definitions. Commission display; consult the operative legal text.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
EU AI Act Article 3(13)
Related financial-services research instruments
European Union Artificial Intelligence Act
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Privacy roles & rights
Recognised legitimate interest (UK)
recognized legitimate interest
A separate UK processing basis introduced by DUAA for specified recognized purposes, subject to its statutory conditions.
Context, practical use & authoritative sources
Practical significance
Keep this distinct from the ordinary purpose-necessity-balancing analysis; do not export the UK basis into EU GDPR advice.
Definition context
United Kingdom; UK GDPR guidance updated for DUAA.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
UK GDPR as amended; ICO legitimate-interest guidance
Related financial-services research instruments
UK GDPR / Data Protection Act 2018 / DUAA 2025
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Resilience & cryptography
Recovery
Restoring operations to an acceptable, validated state after disruption or compromise, including monitoring for recurrence.
Context, practical use & authoritative sources
Practical significance
Require evidence of restored integrity and control before resuming consequential AI actions.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
NYDFS Cybersecurity Regulation
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
OSFI B-13 - technology and cyber risk
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
MAS Technology Risk Management Guidelines
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
NIST incident response recommendations
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Resilience & cryptography
Recovery time objective
RTO
The target elapsed time for restoring a system or capability after disruption, as defined by the recovery plan.
Context, practical use & authoritative sources
Practical significance
Verify that the entire process, including dependencies and human decisions, meets the target.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
FCA operational resilience rules
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Financial regulation & resilience
Register of information (DORA)
RoI
The structured record of contractual arrangements for ICT services required for the relevant entity, sub-consolidated and consolidated levels.
Context, practical use & authoritative sources
Practical significance
Use the applicable templates; a generic supplier spreadsheet may omit required identifiers and service relationships.
Definition context
EU DORA; overview and linked technical standards. Definitions below are explanatory summaries.
Official EIOPA overview and linked-standard index reviewed; direct EUR-Lex retrieval was restricted. Explanatory orientation, not clause-level validation.
DORA Article 28(3); register ITS
Related financial-services research instruments
Digital Operational Resilience Act
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
AI regulation & lifecycle
Remote biometric identification
RBI
Identification without a person's active involvement, typically at a distance, by comparing biometric data with a reference database.
Context, practical use & authoritative sources
Practical significance
Assess real-time versus post-event use and sector-specific restrictions; a camera alone does not establish this classification.
Definition context
EU AI Act; Article 3 definitions. Commission display; consult the operative legal text.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
EU AI Act Article 3(41)-(43)
Related financial-services research instruments
European Union Artificial Intelligence Act
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Governance & assurance
Residual risk
Risk remaining after implemented controls or responses, subject to their actual effectiveness and uncertainty.
Context, practical use & authoritative sources
Practical significance
Identify who may accept it and what conditions trigger reconsideration.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
ISO/IEC 23894 AI risk management
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
NIST AI Risk Management Framework 1.0
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Privacy roles & rights
Right to correct
rectification request
An individual's ability under an applicable privacy law to request correction of inaccurate personal information, subject to its scope and verification rules.
Context, practical use & authoritative sources
Practical significance
Trace corrections into relevant systems and derived records; check each jurisdiction's exceptions.
Definition context
California CCPA/CPRA; official guidance, with statutory definitions and exceptions controlling.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
CCPA consumer rights
Related financial-services research instruments
California Consumer Privacy Act / CPRA
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
California Delete Act / DROP data-broker deletion system
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
Health & regulated records
Safe Harbor de-identification (HIPAA)
HIPAA Safe Harbor
A de-identification route requiring removal of listed identifiers and no actual knowledge that remaining information can identify an individual.
Context, practical use & authoritative sources
Practical significance
Validate every required removal; replacing names alone is not this method.
Definition context
US HIPAA; 45 CFR 164.514. Legal exceptions and permitted purposes matter.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
45 CFR 164.514(b)(2)
Related financial-services research instruments
HIPAA Privacy and Breach Notification Rules
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Privacy roles & rights
Sale of personal information (CCPA)
CCPA sale
A defined exchange or making available of personal information for monetary or other valuable consideration, subject to statutory exceptions.
Context, practical use & authoritative sources
Practical significance
Evaluate the actual recipient arrangement and exception conditions; absence of a cash payment does not settle the question.
Definition context
California CCPA/CPRA; official guidance, with statutory definitions and exceptions controlling.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
California Civil Code 1798.140
Related financial-services research instruments
California Consumer Privacy Act / CPRA
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
California Delete Act / DROP data-broker deletion system
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
Financial integrity & conduct
SAR confidentiality
SAR nondisclosure
Restrictions protecting a suspicious activity report and information that would reveal its existence, subject to permitted disclosures.
Context, practical use & authoritative sources
Practical significance
Keep SAR information out of unapproved AI services and avoid implying that every underlying business record is itself secret merely because a SAR exists.
Definition context
US BSA reporting; the cited overview concerns specified MSB activities. Different institutions have different triggers.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
MSB SAR disclosure prohibition; 31 CFR 1022.320
Related financial-services research instruments
Bank Secrecy Act / AML program requirements
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Financial regulation & resilience
Senior governing body (NYDFS)
senior governing body
The board, appropriate committee or equivalent governing body, with specified alternatives where no such body exists and for adopted affiliate programs.
Context, practical use & authoritative sources
Practical significance
Identify who receives reporting and exercises oversight; delegation does not erase the defined responsibilities.
Definition context
New York Part 500; DFS reading copy, not the official compilation. Defined terms are not interchangeable with other regimes.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
23 NYCRR 500.1(q)
Related financial-services research instruments
NYDFS Cybersecurity Regulation
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Interagency third-party relationship risk management
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
Privacy & data
Sensitive personal data
special-category data
Personal information subject to heightened protection under an applicable law. Categories differ; GDPR special categories include health, genetics and specified biometric or belief-related data.
Context, practical use & authoritative sources
Practical significance
Do not transplant one jurisdiction's category list or legal basis into another.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
Connecticut Data Privacy Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
China Personal Information Protection Law
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
General Data Protection Regulation
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
UK GDPR / Data Protection Act 2018 / DUAA 2025
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
AI regulation & lifecycle
Serious incident (EU AI Act)
AI serious incident
An AI-system incident or malfunction leading to specified serious consequences for health, critical infrastructure, fundamental-rights obligations, property or the environment.
Context, practical use & authoritative sources
Practical significance
Assess the Act's categories and reporting rules; this is not interchangeable with every cyber alert or other laws' incident definitions.
Definition context
EU AI Act; Article 3 definitions. Commission display; consult the operative legal text.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Article 3(49)
Related financial-services research instruments
European Union Artificial Intelligence Act
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Privacy roles & rights
Service provider (CCPA)
CCPA service provider
An entity processing personal information for a business under the CCPA's contract, purpose and use restrictions.
Context, practical use & authoritative sources
Practical significance
Do not equate any vendor or GDPR processor with a qualifying CCPA service provider.
Definition context
California CCPA/CPRA; official guidance, with statutory definitions and exceptions controlling.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
California Civil Code 1798.140
Related financial-services research instruments
California Consumer Privacy Act / CPRA
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
California Delete Act / DROP data-broker deletion system
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
Financial regulation & resilience
Severe but plausible scenario
severe-but-plausible testing
A challenging but credible disruption used to assess resilience against the relevant service impact tolerance.
Context, practical use & authoritative sources
Practical significance
Document the scenario assumptions and response evidence instead of selecting only easy-to-pass tests.
Definition context
United Kingdom; FCA operational-resilience rules for firms in scope.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
FCA scenario-testing expectations
Related financial-services research instruments
FCA operational resilience rules
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
FCA Consumer Duty
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
Privacy roles & rights
Sharing (CCPA)
CCPA sharing
Making personal information available for cross-context behavioral advertising as defined by the CCPA, whether or not payment is involved.
Context, practical use & authoritative sources
Practical significance
Distinguish sharing in this specific sense from ordinary internal data sharing.
Definition context
California CCPA/CPRA; official guidance, with statutory definitions and exceptions controlling.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
California Civil Code 1798.140
Related financial-services research instruments
California Consumer Privacy Act / CPRA
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
California Delete Act / DROP data-broker deletion system
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
Privacy roles & rights
Significant Data Fiduciary
SDF
A Data Fiduciary or class notified by India's Central Government under the statutory designation process.
Context, practical use & authoritative sources
Practical significance
Do not self-assign this status based solely on company size or presume designation without the relevant notification.
Definition context
India DPDP Act 2023; Section 2. Definitions do not establish commencement of every substantive duty.
Section 2 of the official Gazette PDF was read. This is a definition review, not a current consolidated-law or commencement audit; phased duties require separate checking.
Sections 2(z), 10
Related financial-services research instruments
India Digital Personal Data Protection Act and Rules
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Resilience & cryptography
SLH-DSA
A stateless hash-based digital signature algorithm standardized in FIPS 205, with different performance and security-design tradeoffs from ML-DSA.
Context, practical use & authoritative sources
Practical significance
Evaluate artifact size, signing cost and interoperability against the assurance use case.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
NIST post-quantum cryptography standards
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Cybersecurity
Software bill of materials
SBOM
A structured inventory describing software components and their relationships. It enables transparency but is not itself evidence that software is secure.
Context, practical use & authoritative sources
Practical significance
Link the inventory to version, vulnerability, supplier and runtime evidence.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
NIST SP 800-218A: AI-model secure development profile
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
CISA / international partners: SBOM for AI minimum elements
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
CISA: 2026 minimum elements for an SBOM
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Cybersecurity
Software composition analysis
SCA
Analysis of third-party software components and dependencies for issues such as known vulnerabilities and licensing obligations.
Context, practical use & authoritative sources
Practical significance
Track transitive dependencies and deployment context alongside component lists.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
NIST SSDF - SP800-218 v1.1 / v1.2 draft
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
CISA: 2026 minimum elements for an SBOM
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Privacy roles & rights
Special categories of personal data
special-category data
The sensitive categories identified by GDPR Article 9, whose processing requires an applicable Article 9 condition as well as a lawful basis where required.
Context, practical use & authoritative sources
Practical significance
Distinguish this list from criminal-offence data and from another jurisdiction's sensitive-data definition.
Definition context
European Union GDPR; regulator guide rather than a replacement for statutory text.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
GDPR Article 9
Related financial-services research instruments
General Data Protection Regulation
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Privacy roles & rights
Specified purpose (India DPDP)
specified purpose
The purpose stated in the notice given by the Data Fiduciary in accordance with the DPDP Act and its rules.
Context, practical use & authoritative sources
Practical significance
Align the notice with actual processing and separately check commencement and any permitted-use provision.
Definition context
India DPDP Act 2023; Section 2. Definitions do not establish commencement of every substantive duty.
Section 2 of the official Gazette PDF was read. This is a definition review, not a current consolidated-law or commencement audit; phased duties require separate checking.
Section 2(za)
Related financial-services research instruments
India Digital Personal Data Protection Act and Rules
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Privacy & data
Storage limitation
retention
Keeping identifiable personal data only as long as justified by purpose and applicable obligations, subject to specific lawful exceptions.
Context, practical use & authoritative sources
Practical significance
Set deletion triggers, legal-hold exceptions and backup handling rather than retaining everything indefinitely.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
California Consumer Privacy Act / CPRA
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Illinois Biometric Information Privacy Act
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Colorado automated decisionmaking law - SB26-189
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
SEC Regulation S-P
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Quebec private-sector privacy law (Law 25 reforms)
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Singapore Personal Data Protection Act
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
India CERT-In cybersecurity directions
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
New Zealand Privacy Act
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
OpenTelemetry GenAI span conventions
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
AI regulation & lifecycle
Substantial modification (EU AI Act)
substantial change
An unplanned change after market placement or service entry that affects compliance with high-risk requirements or changes the assessed intended purpose.
Context, practical use & authoritative sources
Practical significance
Review model, tool and purpose changes against the legal test; not every software update qualifies.
Definition context
EU AI Act; Article 3 definitions. Commission display; consult the operative legal text.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Article 3(23)
Related financial-services research instruments
European Union Artificial Intelligence Act
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Financial integrity & conduct
Suspicious activity report
SAR
A regulated report to FinCEN about activity meeting the applicable institution-specific suspicion, transaction and reporting criteria.
Context, practical use & authoritative sources
Practical significance
A monitoring alert is not itself a SAR. Keep human review, rationale and filing responsibility explicit when AI assists.
Definition context
US BSA reporting; the cited overview concerns specified MSB activities. Different institutions have different triggers.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
31 CFR Chapter X; MSB SAR overview
Related financial-services research instruments
Bank Secrecy Act / AML program requirements
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Frameworks & assurance practice
System security plan
SSP
A document describing the system, its security requirements and the controls in place or planned to meet them.
Context, practical use & authoritative sources
Practical significance
Align the plan with the actual authorization boundary and deployed configuration.
Definition context
NIST technical/control vocabulary; binding force depends on adoption, law or contract.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
NIST SP 800-53 PL-2
Related financial-services research instruments
NIST SP800-53 Rev.5 - security and privacy controls
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
NIST Cybersecurity Framework
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
NIST Privacy Framework - final 1.0 / draft 1.1
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
NIST SSDF - SP800-218 v1.1 / v1.2 draft
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
NIST incident response recommendations
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
Cybersecurity
Tactics, techniques and procedures
TTPs
Tactics describe adversary objectives, techniques how they are pursued, and procedures their concrete implementations.
Context, practical use & authoritative sources
Practical significance
Map detection and testing to relevant behavior rather than relying only on static indicators.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
MITRE ATLAS
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Financial regulation & resilience
Third-party service provider (NYDFS)
TPSP
A non-affiliate, non-governmental service provider meeting Part 500's conditions, including access to nonpublic information through its services.
Context, practical use & authoritative sources
Practical significance
Review subcontracted AI and technology arrangements against the definition rather than every vendor in accounts payable.
Definition context
New York Part 500; DFS reading copy, not the official compilation. Defined terms are not interchangeable with other regimes.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
23 NYCRR 500.1(s)
Related financial-services research instruments
NYDFS Cybersecurity Regulation
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Interagency third-party relationship risk management
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
Cybersecurity
Threat
A circumstance or event with potential to adversely affect operations, assets or individuals through unauthorized access, disruption, disclosure or other harm.
Context, practical use & authoritative sources
Practical significance
Separate the threat from the vulnerability it could exploit.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
NIST Generative AI Profile
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
OWASP AI security guidance
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
MITRE ATLAS
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Cybersecurity
Threat modeling
Structured analysis of assets, architecture, trust boundaries, threats and controls before and during system development.
Context, practical use & authoritative sources
Practical significance
Model unsafe authorized actions as well as external intrusion.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
NIST SSDF - SP800-218 v1.1 / v1.2 draft
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
OWASP AI security guidance
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Financial regulation & resilience
Threat-led penetration testing
TLPT
A controlled assessment using threat intelligence to test relevant live production systems and functions under the prescribed DORA framework for selected entities.
Context, practical use & authoritative sources
Practical significance
Require scope, safeguards, qualified testers and oversight; this is not a routine vulnerability scan.
Definition context
EU DORA; overview and linked technical standards. Definitions below are explanatory summaries.
Official EIOPA overview and linked-standard index reviewed; direct EUR-Lex retrieval was restricted. Explanatory orientation, not clause-level validation.
DORA Articles 26-27; TLPT RTS
Related financial-services research instruments
Digital Operational Resilience Act
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Models & learning
Token
A unit used by a model's tokenizer, which may represent part of a word, a whole word, punctuation or another encoded element. Token counts are not the same as word counts.
Context, practical use & authoritative sources
Practical significance
Test input-length handling and avoid assuming that character limits equal model limits.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
MCP authorization specification (2026-07-28)
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Models & learning
Training
Fitting a model's parameters or decision structure using data, objectives and an optimization process. It is distinct from simply sending a request to an already deployed model.
Context, practical use & authoritative sources
Practical significance
Retain data provenance, training configuration, evaluation results and release approval.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
China Interim Measures for Generative AI Services
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Governance & assurance
Transparency
Making appropriate information about AI purpose, operation, limitations and governance available to relevant parties.
Context, practical use & authoritative sources
Practical significance
Balance disclosure with privacy, security and legitimate confidentiality.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
FTC Act, Section 5
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Colorado automated decisionmaking law - SB26-189
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
OECD AI Principles
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
California Transparency in Frontier Artificial Intelligence Act
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
California AI Transparency Act - SB942, AB853 and 2026 amendments
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
New York Responsible AI Safety and Education (RAISE) Act
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
European Union Artificial Intelligence Act
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Quebec private-sector privacy law (Law 25 reforms)
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
China Personal Information Protection Law
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Brazil General Personal Data Protection Law
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
California AB1405 - AI auditor registry and independence
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Governance & assurance
Validation
Assessing whether a system, model or process is suitable for its intended purpose in the relevant context.
Context, practical use & authoritative sources
Practical significance
Validate business consequences and affected populations, not only technical correctness.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
FTC Act, Section 5
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Title VII and employment discrimination
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Interagency model risk management guidance - SR26-2
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Fair Credit Reporting Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
US economic sanctions / OFAC compliance
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Governance & assurance
Verification
Checking whether specified requirements have been met, often by inspection or testing.
Context, practical use & authoritative sources
Practical significance
Do not confuse compliance with a specification with fitness for the real-world use.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
Web Content Accessibility Guidelines
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
California SB813 - independent AI verification organizations
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
California September 2026 AI oversight executive direction
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Privacy roles & rights
Vital interests
vital-interest basis
A lawful-processing ground associated with protecting a person's life or essential interests, within the law's conditions.
Context, practical use & authoritative sources
Practical significance
Do not treat ordinary commercial importance or convenience as vital interests.
Definition context
European Union GDPR; regulator guide rather than a replacement for statutory text.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
GDPR Article 6(1)(d); Article 9 where relevant
Related financial-services research instruments
General Data Protection Regulation
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Cybersecurity
Vulnerability
A weakness in a system, process or control that a threat could exploit or that could lead to adverse outcomes.
Context, practical use & authoritative sources
Practical significance
Prioritize exploitability, exposure and business impact, not score alone.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
PCI DSS v4.0.1
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
FCA Consumer Duty
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
NIST SSDF - SP800-218 v1.1 / v1.2 draft
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Financial regulation & resilience
Written information security program
WISP
A documented program of administrative, technical and physical safeguards designed for the institution's risks and the applicable rule's requirements.
Context, practical use & authoritative sources
Practical significance
A policy document without operating safeguards and evidence is not the whole program.
Definition context
US FTC Safeguards Rule; 16 CFR 314.4.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
16 CFR 314.3-314.4
Related financial-services research instruments
GLBA and FTC Safeguards Rule
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.