Glossary

Retrieval-augmented generation is a way of building a language-model application so that, before it answers, it searches an approved collection of documents and writes its answer from what it found. It matters in government and regulated work because the answer can cite its source, and because the documents can be updated without retraining a model.

Source: Lewis et al., 2020 (arXiv)

Agentic AI describes systems in which a language model does not only answer but plans a sequence of steps and carries them out through tools: searching, calling an API, filling a form, handing work to another agent. It matters because the system now acts inside business processes, so permissions, logging and a way for a person to stop it become design requirements rather than afterthoughts.

A large language model is a neural network trained on very large amounts of text to predict the next piece of text, which lets it draft, summarise, translate and answer questions in natural language. On its own it has no access to an organisation's documents and can state things that are not true, which is why production systems pair it with retrieval, rules and review.

AI governance is the set of roles, policies, controls and records through which an organisation decides which AI systems it builds or buys, what they may do, who is accountable for them, and how they are monitored once live. It matters because regulators and auditors increasingly ask to see it, and because without it every new use case is approved by whoever happens to be asked.

Policy as code means writing an organisation's rules, such as who may access what or which changes need review, as machine-readable code that is versioned, tested and evaluated automatically. It matters because an approval that used to wait in a person's inbox can be checked in seconds, and because every decision leaves a record an auditor can read.

Source: Open Policy Agent documentation

ISO/IEC 42001 is the international standard, published in 2023, that specifies requirements for an AI management system: the policies, objectives, risk and impact assessments and controls an organisation maintains for the AI it develops, provides or uses. It matters because it is certifiable, which gives a buyer or regulator an external way to check that governance exists beyond a document.

Source: ISO/IEC 42001:2023

The EU AI Act, Regulation (EU) 2024/1689, is the European Union's law on artificial intelligence. It classifies AI systems by risk, prohibits some practices outright, sets obligations for high-risk systems and for general-purpose AI models, and applies in stages. It matters outside Europe because it covers systems placed on the EU market or whose output is used there, and because other jurisdictions borrow its structure.

Source: Regulation (EU) 2024/1689, EUR-Lex

The NIST AI Risk Management Framework is voluntary guidance from the US National Institute of Standards and Technology, released in January 2023, for managing the risks of AI systems. It organises the work into four functions: Govern, Map, Measure and Manage. It matters because it is practical and free to adopt, and it maps well onto the controls that ISO/IEC 42001 asks for.

Source: NIST AI RMF

Enterprise architecture is the discipline of describing how an organisation's capabilities, processes, data, applications and technology fit together, and of steering changes to them so that they stay coherent. It matters for AI because a model is only as useful as the data it can reach and the systems it can act on, and those are architecture decisions.

TOGAF, the Open Group Architecture Framework, is a widely used standard for enterprise architecture. Its core is the Architecture Development Method, a repeatable cycle for moving from a business vision to an architecture and then to planned change. It matters because it gives architects, programme leads and executives a shared vocabulary for decisions that otherwise stay implicit.

Source: The Open Group, TOGAF