Resource / AI glossary

Every AI term, explained in plain language.

The glossary collects the terms Aprex uses most in customer conversations: from RAG and agents to GDPR and the EU AI Act. Each term gets one to three sentences, with a link where a guide covers the topic in depth.

Contact Aprex →Jump to letter ↓

By Alexander Terje Loe Balsnes, CTO

Last updated: September 26, 2026

A

Access control: Rules and techniques for who may see and use what, in documents as well as AI answers. A prerequisite for internal AI with sensitive sources.
Agentic workflow: A workflow where an AI agent carries out several steps in sequence, such as fetching data, comparing options, and preparing an answer or draft. Each step should have clear boundaries and checkpoints where a person can step in.
AI agent: An AI system that does more than answer: it can use tools, fetch information, and carry out bounded tasks on its own. Typical for case handling, research, and follow-up where several steps connect.
AI assistant: A conversational AI tool that helps employees write, summarize, find information, and prepare tasks. Unlike an AI agent, it rarely takes actions on its own.
AI chatbot: A chatbot that uses a language model to hold conversations in plain language. Suits questions and answers, but should show sources and have limits on what it can promise or do.
AI model: A trained machine-learning program that recognizes patterns and produces text, images, audio, or decision support from input. The choice of model shapes quality, cost, privacy, and where the solution can run.
AI pilot: A scoped first project where an AI solution is tested on one work area, with clear goals, measurement, and a go/no-go decision. The point is to learn cheaply before anything scales to production.
AI policy: A company's own rules for how employees and vendors may use AI tools. Should cover which data can be pasted in, who is responsible, and how answers get checked.
API: A programmed interface that lets systems talk to each other, for example a webshop fetching stock levels from the ERP system. Most integrations between business systems are built on APIs.
API key: A secret password that gives a program access to an API. Keys should be stored safely, rotated when needed, and never shared over email or chat.
App: A program made for phones or tablets, either downloaded from an app store or run in the browser. Business apps are often used for registration, checklists, and lookups in the field.
Automation: Systems carrying out routine work without manual effort, such as notifications, record-keeping, or data flow between systems. Pays off first where volume is high and rules are clear.

B

Benchmark: A fixed test set that measures quality the same way every time, so models or solutions can be compared over time. Useful, but should be combined with evaluation on your own data.

C

Chunking: Splitting documents into smaller pieces before storing them for search in a RAG solution. Good chunks let the system retrieve precise context instead of whole documents.
Consent: Voluntary, specific, and informed acceptance from the data subject, which can be withdrawn. One of several possible lawful bases, not always the best one.
Context window: How much text a language model can consider at once, measured in tokens. A larger window helps little if the content is messy or irrelevant.
Custom software: Software built for one company's needs instead of standard off-the-shelf products. Gives full control over features, data, and integrations, at your own development cost.

D

Data controller: The party that decides the purpose and means of processing personal data, usually the company itself. The role carries responsibility for a lawful basis and meeting GDPR requirements.
Data minimisation: The principle of collecting and using as little personal data as possible for the purpose. In AI projects it means limiting which fields, documents, and logs the model can see.
Data ownership: Clarity on who owns and stewards data, who may change it, and what happens on vendor change. Unclear ownership is a common blocker in AI projects.
Data processing agreement: The contract between controller and processor on how personal data must be protected. It covers security, sub-processors, deletion, and audits, among other things.
Data processor: A vendor that processes personal data on behalf of a controller, such as a cloud provider or AI service. The relationship must be governed by a data processing agreement.
Dataset: A collection of data used for testing, evaluation, or training, such as questions with expected answers. Dataset quality decides how much the evaluation is worth.
DPIA: Data protection impact assessment: a legally required analysis before processing that may pose high risk to individuals. Settles risks and safeguards before the project starts.

E

Embedding: A numerical representation of text that captures meaning, so related content sits close together. The basis for semantic search in RAG solutions.
EU AI Act: The EU's artificial intelligence regulation, with risk-based requirements for developers and users of AI systems. Applies in stages and will matter for Norwegian companies through the EEA.
Evaluation: Systematic testing of AI quality with fixed questions and criteria, often called evals. Measures precision, source use, and how often the system should stop instead of guessing, among other things.

F

Fine-tuning: Further training of a ready-made language model on your own examples to adjust style or behavior. It does not reliably change model knowledge, and rarely replaces RAG for internal facts.

G

GDPR: The EU's data protection regulation, in force in Norway through the EEA agreement. Requires a lawful basis, transparency, security, and respect for data subjects' rights.
Generative AI: AI that creates new content such as text, images, audio, or code from an instruction. Language models are the most used form in business settings.
Go/no-go decision: The decision after a pilot on whether the solution moves forward, changes, or stops. Should be judged against criteria agreed before the pilot started.
Ground truth: The expected correct answer that AI output is compared against in evaluation. Good ground truth is written by domain experts and covers typical real-world questions.
Guardrails: Technical and procedural boundaries that keep AI within safe use, such as topic limits, source requirements, and blocking of sensitive disclosures.

H

Hallucination: A language model answering confidently without grounding in sources. Countered with RAG, source display, evaluation, and clear stopping criteria.
High-risk AI: AI systems the EU AI Act places its strictest requirements on, typically where failures can harm health, safety, or rights. Requires risk management, documentation, and human oversight, among other things.
Human-in-the-loop: A person approving, monitoring, or able to override AI suggestions and actions. Required in sensitive processes.

I

Inference: Using a trained model to answer or compute something new. Distinct from training, the expensive phase where the model learns.
Integration: A connection that lets two or more systems share data automatically, with no copy-paste between them. Cuts errors and frees time in manual routines.

K

Knowledge base: The collection of documents, articles, and answers an AI solution retrieves information from. Should have clear ownership, update routines, and access rules.

L

Lawful basis: The legal ground that must exist before personal data may be processed, such as a contract, consent, or legitimate interests. Without one, processing is unlawful.
LLM: Large language model: an AI model trained on large volumes of text to understand and produce language. The engine inside chatbots, assistants, and RAG solutions.
Logging: Storing events from a solution, such as questions, answers, sources, and errors. Needed for debugging, evaluation, security, and documentation in production.

M

Machine learning: Computer programs learning patterns from data instead of following hand-written rules. Language models are one type of machine learning, trained on text.
MCP: Model Context Protocol: an open standard for connecting AI systems to data sources and tools in a uniform way. An alternative to custom integrations per system.
Monitoring: Continuous watch over a solution in production: quality, errors, response time, cost, and misuse. Catches deviations before users do.
Multimodal: An AI model understanding or producing several content types, such as text, images, and audio in one solution. Useful where documents mix text and figures.

O

OCR: Optical character recognition: reading machine-readable text out of images, scanned PDFs, and photos. The first step before older documents can be used in AI search.
Off-the-shelf software: Ready-made software bought or rented as is, with standard features and shared development cost. Fast to start, but customisation happens on the vendor's terms.

P

Parameters: The adjustable numerical values in a model learned during training. More parameters do not automatically mean better results for a specific business task.
Personal data: Any information that can be linked to an individual, directly or indirectly. Covers far more than names and ID numbers, including logs and data combinations.
Privacy: Individuals' right to control their own information. In AI projects it means a lawful basis, minimisation, access control, deletion, and transparency.
Production deployment: Taking a solution from pilot to daily operations with real users and real data. Requires monitoring, access control, logging, error handling, and clear ownership.
Prompt: The instruction or question sent to a language model. Clear prompts with context and format give consistently better answers than vague requests.
Prompt injection: Attacks where hidden instructions in text, documents, or web pages trick AI into breaking its rules. Countered by distrusting foreign content, limiting permissions, and keeping humans in control.
Prototype (PoC): An early, simple version testing whether something is technically feasible (proof of concept). Unlike a pilot, it does not run against real use and operations.

R

RAG: Retrieval-augmented generation: AI fetching relevant content from your own sources before answering. Gives fresher answers with source display, without retraining the model.
Red-teaming: Testing an AI solution systematically with adversarial questions and scenarios to expose weaknesses before launch. Reveals leaks, bypasses, and unwanted behavior, among other things.
Retrieval: The retrieval step in RAG: finding the most relevant pieces from the knowledge base for a question. Quality here often decides answer quality.
Right of access: The right to know which personal data a company holds about you and how it is used. AI solutions must be able to explain the data behind answers about individuals.
Right to erasure: The right to have your personal data deleted when conditions are met. AI solutions must be able to remove data from sources, logs, and search indexes.

S

Semantic search: Search that understands meaning instead of matching exact words. Finds relevant documents even when the question words differ from the sources.
SLA: Service level agreement: contracted requirements for uptime, response time, and support. Should also cover what happens on breach.
Source citation: AI answers showing which documents or passages they build on. Lets users verify the answer and builds trust.
System prompt: The fixed instructions governing an AI assistant's role, tone, and boundaries in every conversation. Should stay hidden from end users and be version-controlled.

T

Temperature: A setting controlling how predictable or varied a language model's answers get. Low temperature gives stable answers, high temperature more variety and more risk of errors.
Token: The smallest text unit a language model computes with, roughly a word or word part. Both context windows and usage cost are measured in tokens.
Tool calling: A language model calling defined functions or tools, such as lookups, calculations, or storage. How AI moves from answering to doing tasks.
Training data: The data a model learns from during training. Its quality, representativeness, and rights shape everything the model later produces.
Transparency obligation: Requirements to disclose that and how AI is used, especially towards affected people. Applies under both privacy rules and the EU AI Act.

V

Vector database: A database built to store embeddings and search them by meaning similarity. A standard RAG building block alongside chunking and retrieval.

W

Webhook: Automatic notification from one system to another when something happens, such as a new order or changed status. A simple building block in many integrations.
Workflow: The sequence of steps that completes a task, from trigger to delivered and documented result. Good automations start by mapping the workflow as it actually runs.

Running into terms nobody explains?

Describe your workflow and systems, and Aprex will answer what the glossary does not cover.

Contact Aprex →