The terms behind AI, software and EU digital regulation.

Software that uses a language model to plan and carry out steps towards a goal, such as looking up a record, filling in a form or calling an API. An agent acts within the permissions and tools it is given, and every step can be logged.

A data platform that stores data in open file and table formats on low-cost object storage, as a data lake does, and adds warehouse features on top: transactions, schemas, access control and SQL. Open table formats such as Apache Iceberg and Delta Lake make this possible.

A dataset managed like a product: it has a named owner, a documented schema, published quality measures, clear access rules and agreed refresh times, so other teams can use it without asking how it was built.

Systematic testing of an AI system against a reference set of questions or documents with agreed criteria, such as correctness, grounding in sources, completeness and refusal when the answer is unknown. Evaluation runs before go-live and again after every change to the model, prompt or data.

Controls around a language model that keep its use within agreed limits: checks on input and output, topic restrictions, masking of personal data, permission checks before a tool is called and approval steps for consequential actions.

An AI output that sounds confident but is not supported by the sources or the facts. It is reduced, not eliminated, by grounding answers in retrieved sources, requiring citations, letting the system say it does not know, and measuring the rate in evaluation.

A design in which a person reviews, corrects or approves an AI output before it takes effect. For high-risk AI systems, the AI Act requires effective human oversight by people with the competence and authority to intervene.

Reading, classifying and extracting data from documents such as forms, invoices, certificates and scanned letters, by combining text recognition, layout analysis and language models. Each extracted value carries a confidence score, and values below the threshold go to a person for review.

A neural network trained on very large amounts of text to predict the next word. It can draft, summarise, classify and extract text in many languages, but it is not a database of facts: without grounding in your own sources it can produce fluent answers that are wrong.

The practices that keep machine learning and language model systems reliable in production: versioning of models, prompts and data, automated evaluation, deployment pipelines, and monitoring of quality, cost and latency.

A pattern in which the system first retrieves relevant passages from approved sources, such as procedures, policies or case files, and then lets the language model answer from those passages only. The answer can cite document and section, and the access rights of the user are respected at retrieval time.

Search on meaning rather than exact words. Text is converted into numeric vectors (embeddings), and the system finds passages whose vectors are close to the question. In practice it is usually combined with keyword search, because codes, names and article numbers need exact matching.

An approach in which the interface of a system is designed and agreed first, usually as an OpenAPI or AsyncAPI specification, and implemented afterwards. Other systems, partners and front ends then integrate through documented, versioned APIs instead of direct database access.

A prepared cloud environment with the account or subscription structure, identity, networking, policies, logging and security baseline in place before the first workload arrives. It makes every later project faster and keeps controls consistent.

The family of IEC standards (IEC 61970, IEC 61968 and IEC 62325) that describes electricity networks, assets and market communication in one shared data model. Grid operators use it so that planning, operations and market systems describe the network the same way.

A digital representation of a physical asset, process or network that is kept in step with data from the real one. It is used to monitor condition, test changes before they are made and plan maintenance. A 3D model without live data is not a twin.

An architecture in which systems publish events, facts such as “application received” or “meter reading validated”, to a broker, and other systems react to them in their own time. It decouples systems, so one can change or fail without stopping the others.

The open data standard for building information modelling (BIM), published by buildingSMART and as ISO 16739-1. Version IFC 4.3 adds infrastructure: rail, roads, ports, waterways and bridges, so asset data can move between design, construction and operation without being retyped.

A cloud-hosted platform for building and running integrations, with ready-made connectors, data mapping, orchestration and monitoring in one place. SAP Integration Suite and MuleSoft are examples.

A machine-readable list of the components and dependencies in a piece of software, usually in the SPDX or CycloneDX format. It shows quickly whether a newly published vulnerability affects you. The Cyber Resilience Act requires manufacturers to draw one up for their products.

Cloud services in which the location of data, the operation of the service and the legal jurisdiction that applies to it stay under European or national control. Definitions differ: national schemes such as SecNumCloud in France add explicit requirements on protection against non-EU law.

A way to replace a legacy system step by step. A facade is placed in front of the old system, functions are moved one at a time to new services behind it, and the old system is retired once nothing routes to it any more. It avoids a single high-risk cut-over.

An architecture pattern in manufacturing in which a central event broker holds the current state of the plant, organised by site, area, line and machine. Systems publish to it and subscribe to it, instead of being connected to each other one by one.

A security model in which no user, device or service is trusted because of its network location. Every request is authenticated, authorised and evaluated on identity, device state and context, and access is limited to what the task needs.

The EU regulation on artificial intelligence. It sorts AI systems by risk: some practices are prohibited, high-risk systems must meet requirements on data, documentation, human oversight and accuracy, and some systems carry transparency duties. Prohibitions apply since 2 February 2025, transparency duties from 2 August 2026, and the high-risk obligations of Annex III from 2 December 2027 under the 2026 amendment.

The EU directive on the physical and organisational resilience of critical entities in eleven sectors, including energy, transport, health, drinking water and digital infrastructure. Member States identify their critical entities by 17 July 2026; those entities then assess risks and take resilience measures.

The EU regulation that sets cybersecurity requirements for products with digital elements, hardware and software, placed on the EU market. Manufacturers must handle vulnerabilities over the support period and report actively exploited ones from 11 September 2026; the main obligations apply from 11 December 2027.

The EU regulation on fair access to and use of data, in application since 12 September 2025. It gives users of connected products access to the data those products generate, makes switching between cloud and data processing services easier, and limits unfair contract terms on data sharing.

The EU regulation on the digital operational resilience of the financial sector, in application since 17 January 2025. It covers ICT risk management, incident reporting, resilience testing and the management of ICT third-party providers, including contract requirements and a register of information.

The EU directive that requires certain products and services to be accessible to people with disabilities, including e-commerce, consumer banking, e-books and websites, apps and e-tickets of passenger transport services. It applies through national laws since 28 June 2025.

A wallet app, provided under the revised eIDAS Regulation, in which people can hold their identity data and attestations such as diplomas or licences, share only what a service needs and sign documents. Every Member State has to offer at least one wallet, and many public and private services will have to accept it.

The EU regulation on the processing of personal data, in application since 25 May 2018. It sets principles such as purpose limitation and data minimisation, rights for the people concerned, and duties for controllers and processors, including impact assessments for high-risk processing.

The series of international standards for the security of industrial automation and control systems. It divides a site into zones connected by conduits, sets security levels, and assigns responsibilities to asset owners, system integrators and product suppliers.

The EU regulation on cross-border interoperability of public sector services. Public bodies have to assess the interoperability impact of new or changed trans-European digital public services, and they can share and reuse interoperability solutions through a common portal.

The international standard for information security management systems. An organisation certified to it has an audited system for identifying security risks, choosing controls and improving them over time. FromNine is certified to ISO/IEC 27001.

The EU directive on cybersecurity for essential and important entities in sectors such as energy, transport, health, digital infrastructure and public administration. It requires risk management measures, supply-chain security and incident reporting: an early warning within 24 hours and a notification within 72 hours. It applies through national laws, which differ per country.

The EU system, set up under the Single Digital Gateway Regulation, through which public authorities exchange official evidence across borders at the explicit request of a citizen or company, so that people do not have to supply documents a government already holds. Its obligations apply since 12 December 2023.

An international network and set of specifications for exchanging structured business documents, such as invoices and orders, through certified access points. Belgium requires structured electronic invoices between businesses since 1 January 2026, with Peppol as the default channel.

The W3C guidelines for accessible web content, organised in success criteria at levels A, AA and AAA. Level AA is the usual target in procurement and law; the current version is WCAG 2.2, and the European standard EN 301 549 builds on these guidelines.