AI, software and regulation terms, Indian and European.

A program that uses a language model to plan steps and carry them out, for example fetching a customer record, completing a form or calling an API. It can only use the tools and permissions it has been given, and each step can be logged for audit.

A data platform that keeps data in open file and table formats on inexpensive object storage, like a data lake, and adds warehouse capabilities: transactions, schemas, access control and SQL. Apache Iceberg and Delta Lake are the open table formats that enable it.

A data set run like a product, with a named owner, a documented structure, published quality measures, clear access rules and agreed refresh times, so any team can rely on it without needing to know how it was produced.

Structured testing of an AI system against a reference set of questions or documents, using agreed criteria such as correctness, use of sources, completeness and a refusal where no answer exists. It runs before go-live and again after any change to the model, the prompt or the data.

Controls placed around a language model to keep its use within set limits: input and output checks, topic limits, masking of personal data, permission checks before any tool call, and approval steps for actions with consequences.

AI output that reads as confident but has no support in the sources or the facts. Grounding answers in retrieved sources, demanding citations, allowing the system to say it does not know and measuring the rate during testing all reduce it; none of these removes it completely.

A design where a person checks, corrects or approves AI output before it takes effect. For high-risk AI systems, the EU AI Act requires effective oversight by people who are competent and empowered to step in; Indian banking practice knows the same idea as maker-checker.

Reading, sorting and extracting data from documents such as GST invoices, KYC forms, certificates and scanned letters, using text recognition, layout analysis and language models. Every extracted value has a confidence score, and values under the threshold are sent to a person to check.

A neural network trained on very large volumes of text to predict the next word. It drafts, summarises, classifies and extracts text in English and many other languages, but it does not store facts reliably. Unless it is anchored to your own documents, it may give a polished answer that is simply incorrect.

A control in which one person or system prepares a transaction, the maker, and a second, authorised person approves it, the checker, before it takes effect. Long established in Indian banking and finance, it is a natural way to put human approval around AI agents: the agent prepares, an officer decides.

Operating discipline for machine learning and LLM-based systems in production: version control for models, prompts and data, automated evaluation, release pipelines and tracking of quality, cost and response time.

A pattern where the system first finds relevant passages in approved sources, such as SOPs, circulars or case files, and the language model then answers from those passages alone. Answers can cite the document and section, and each user’s access rights are applied when passages are retrieved.

Search by meaning instead of exact wording. Text is turned into numeric vectors, called embeddings, and the system returns passages whose vectors lie close to the query. It is normally combined with keyword search, because codes, names, section numbers and IRNs need an exact match.

India’s digital identity, issued by the Unique Identification Authority of India (UIDAI), a statutory authority under the Aadhaar Act, 2016, within MeitY. In system design, Aadhaar-based authentication is a building block a public service can use to confirm who a resident is.

An approach where a system’s interface is designed and agreed before it is built, typically written as an OpenAPI or AsyncAPI document. Partners, front ends and other systems then use documented, versioned APIs instead of reaching into the database.

A cloud environment prepared in advance, with account structure, identity, networking, policies, logging and a security baseline in place before the first workload moves in. Later projects start faster and controls stay consistent; log settings can follow the CERT-In Directions from the outset.

The IEC family of standards (IEC 61968, IEC 61970 and IEC 62325) that describes electricity networks, assets and market messages in one shared data model. Network companies adopt it so that planning, operational and market systems share one description of the grid.

A flagship initiative of MeitY under the Digital India programme, run by the National e-Governance Division and Digital India Corporation, for storing, sharing and verifying documents and certificates. Public services can be designed to work with it rather than ask citizens for scanned copies.

A digital model of a physical asset, process or network, kept in step with data from the real thing. It is used to track condition, try out changes before making them and plan maintenance. Without live data, a 3D model is only a drawing, not a twin.

An architecture where systems publish events, such as “IRN received” or “payment approved”, to a broker, and other systems respond when they are ready. Systems are decoupled, so one can change or go down without halting the others.

buildingSMART’s open standard for building information modelling (BIM), also published as ISO 16739-1. Its version 4.3 extends it to infrastructure such as railways, roads, ports, waterways and bridges, so asset data can pass from design through construction into operation without re-keying.

A cloud service for building and operating integrations, with ready connectors, data mapping, orchestration and monitoring in one place. SAP Integration Suite and MuleSoft are two examples.

A machine-readable inventory of the components and dependencies inside a software product, typically in SPDX or CycloneDX. It shows quickly whether a newly disclosed vulnerability concerns you. Under the EU Cyber Resilience Act, manufacturers must prepare one for their products, including manufacturers in India that sell into the EU.

Cloud services where data location, service operation and the jurisdiction that applies stay under European or national control. Definitions vary by country. For an Indian organisation the comparable questions are where data is stored, which sectoral rules apply and whether the Central Government has restricted transfers to a country under section 16 of the DPDP Act.

A method for replacing a legacy system gradually. A facade is put in front of the old system, functions move one by one to new services behind it, and the old system is switched off once no traffic reaches it. It avoids one large, risky cut-over.

A manufacturing architecture pattern where a central event broker holds the plant’s current state, structured as site, area, line and machine. Each system reads from and writes to the broker, so no point-to-point links between systems are needed.

A security model that trusts no user, device or service because of where it sits on the network. Every request must prove who and what it is, based on identity, device condition and context, and receives only the access the task needs.

A person registered with the Data Protection Board of India who acts as a single point of contact through which a Data Principal can give, manage, review and withdraw consent. Registration under rule 4 of the DPDP Rules applies from November 2026, and only a company incorporated in India can qualify.

EU law on the physical and organisational resilience of critical entities across eleven sectors, among them drinking water, health, energy, transport and digital infrastructure. Member States were to identify their critical entities by 17 July 2026, after which those entities assess their risks and take resilience measures.

The EU regulation setting cybersecurity requirements for hardware and software products with digital elements placed on the EU market, wherever they are made. Manufacturers must handle vulnerabilities throughout the support period. Reporting of actively exploited vulnerabilities has applied since 11 September 2026, and most other obligations follow on 11 December 2027.

EU rules, applicable since 12 September 2025, on who may access and use data. Users of connected products gain access to the data those products generate, switching between cloud and data processing services becomes easier, and unfair contract terms on data sharing are limited. This matters to Indian makers of connected devices sold in the EU.

The DPDP Act’s term for the person who, alone or with others, decides why and how personal data is processed; the GDPR calls this role the controller. A Significant Data Fiduciary, notified by the Central Government, must also appoint a Data Protection Officer based in India and an independent data auditor.

The individual to whom personal data relates, in the words of the DPDP Act; the GDPR says data subject. A Data Principal can ask for access, correction and erasure, can nominate another person, and must first use the Data Fiduciary’s grievance channel before complaining to the Data Protection Board of India.

The adjudicatory body set up under the DPDP Act. It works as a digital office, will receive breach intimations from May 2027, and its decisions can be appealed to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT). A Data Principal approaches it only after using the Data Fiduciary’s own grievance channel.

The EU regulation on digital operational resilience in the financial sector, applicable since 17 January 2025. It covers incident reporting, resilience testing, ICT risk management and the oversight of ICT third-party providers, with contract terms and a register of information. Indian IT firms that serve EU banks and insurers meet it through those contracts.

India’s law on digital personal data, Act No. 22 of 2023. It covers digital personal data processed in India and, under section 3(b), processing outside India that is connected with offering goods or services to Data Principals in India. Data Fiduciaries owe notice, consent, security safeguards, breach intimation and grievance redressal; the duties set out in the DPDP Rules apply from May 2027.

The EU regulation on artificial intelligence, Regulation (EU) 2024/1689. It ranks AI systems by risk: certain practices are banned, high-risk systems must meet requirements on data, documentation, human oversight and accuracy, and some systems carry transparency duties. It also reaches providers outside the EU whose systems or output are used in the Union. Bans have applied since 2 February 2025 and transparency duties since 2 August 2026; following the 2026 amendment, the Annex III high-risk obligations apply from 2 December 2027.

The EU directive requiring certain products and services to be accessible to people with disabilities, among them banking services for consumers, online shops, e-books, and ticketing websites and apps for passenger transport. It has applied through national laws since 28 June 2025, including to Indian companies that serve consumers in the EU.

An app, introduced by the revised eIDAS Regulation, that stores a person’s identity data and credentials such as degree certificates or driving licences. The holder discloses only the attributes a service asks for and can sign documents. All Member States must provide at least one, and a wide range of public and private services will be obliged to accept it. DigiLocker is the nearest Indian comparison for documents.

The EU regulation on personal data. Applicable since 25 May 2018, it rests on principles including data minimisation and purpose limitation, grants rights to individuals and assigns duties to controllers and processors. Under Article 3(2) it also covers businesses outside the EU that offer goods or services to people in the Union or monitor their behaviour there.

The online platform through which central ministries, departments and autonomous bodies buy the goods and services available on it, as rule 149 of the General Financial Rules, 2017 requires. Tenders are also published on the Central Public Procurement Portal (CPPP).

The reporting of B2B and export invoices by GST-registered businesses above the turnover threshold to the Invoice Registration Portal (IRP), which returns an Invoice Reference Number (IRN). It applies to an Indian GST registration only; invoices to customers in the EU follow different rules, often through Peppol.

International standards series on securing industrial automation and control systems. A site is split into zones linked by conduits, each with a target security level, and duties are assigned to product suppliers, system integrators and asset owners.

The national agency for cyber incident response under MeitY, with powers under section 70B of the Information Technology Act, 2000. Its Directions of 28 April 2022 require listed cyber incidents to be reported to CERT-In within six hours of being noticed, ICT system logs to be retained and system clocks to be synchronised.

EU rules for interoperability between public services across borders. Before creating or changing a digital public service used across borders in the EU, a public body must assess its effect on interoperability, and solutions can be shared and reused through a common portal.

The international standard for managing information security. Certification means an auditor has confirmed that the organisation identifies its security risks, selects controls and improves them continually. FromNine holds this certification.

The EU directive on cybersecurity for essential and important entities in sectors such as health, energy, transport, public administration and digital infrastructure. It requires risk management, supply-chain security and incident reporting, with a first warning within 24 hours and full notification within 72, and applies through national laws that differ per Member State. Indian suppliers usually meet it through their EU customers’ contracts.

A system created under the Single Digital Gateway Regulation that lets authorities in different Member States exchange official evidence when a citizen or business explicitly asks, so nobody has to submit a document that a government already holds. Its obligations have applied since 12 December 2023.

A network and set of specifications, used internationally, through which certified access points exchange structured documents such as orders and invoices. Indian GST e-invoices follow a different route, through the Invoice Registration Portal. Peppol matters for Indian firms that invoice EU customers: Belgium, for instance, has required structured electronic B2B invoices since 1 January 2026, and Peppol is the standard route there.

W3C’s guidelines for accessible web content, built from success criteria at three levels: A, AA and AAA. Level AA is the common target in law and procurement. The current version is WCAG 2.2; EN 301 549 in Europe and IS 17802 in India are aligned with these guidelines, and GIGW 3.0 requires WCAG 2.1 level AA for Indian government websites and apps.