LinkedIn infographics stop at 25 definitions. This glossary covers 50, including two categories they always overlook: AI security and AI Act compliance. And each term ends with what actually matters: the decision to make and the pitfall to avoid.
Understanding what is actually running.
6 termesLanguage model trained on massive amounts of text (Claude, GPT, Gemini, Mistral…).
The choice of model is reversible, the architecture around it is not, invest in abstraction, not the vendor.
Believing an LLM "knows": it predicts plausible text.
Basic unit of text processed by the model (≈ 0.75 words in English).
Your billing unit AND your technical limit, quantify your volumes before signing.
French consumes ~20% more tokens than English for equivalent content.
Instruction given to the model.
A versioned, tested system prompt is a corporate asset, not an individual's tinkering.
Critical prompts left lying around in ungoverned documents.
Maximum amount of information processed at once (200k+ tokens today).
It determines what you can analyse without RAG: an entire contract, yes; your whole document base, no.
Quality degrades before the stated limit is reached ("lost in the middle").
Phase in which the model generates a response, as opposed to training.
This is where your recurring costs and latency live, not in training.
Underestimating inference cost at scale (× 1,000 users).
Plausible but false response, generated with confidence.
No unverified LLM output should be used in a binding process (legal, customer-facing, financial) without human review or a source.
Hallucinations are more convincing than genuine human errors.
Adapting AI to your uses, at the right cost.
9 termesSpecialising an existing model on your data.
90% of use cases don't need it: start with prompt + RAG, fine-tune only as a last resort.
The maintenance cost every time the base model gets a new version.
Retrieval-Augmented Generation: the model searches your documents before answering.
The standard way to connect AI to your knowledge without exposing it to training.
A RAG built on outdated documents industrialises your errors.
Numerical representation of the meaning of a text or image.
The invisible building block of any RAG: it's what makes your data searchable by meaning.
Changing embedding models means re-vectorising everything.
Model that understands and generates text, image, audio, video.
Opens up field use cases: site photos, scanned invoices, recordings.
Images are an attack vector (instructions hidden within a visual).
Model that "thinks" through several steps before answering.
More reliable on complex problems, but slower and more expensive: reserve it for problems that warrant it.
Using it for tier-1 support: a Ferrari to pop to the corner shop.
Small specialised model (1–10 billion parameters), runnable on modest hardware.
On a repetitive, well-defined task, a well-chosen SLM beats a giant on cost, latency and confidentiality.
Expecting versatility from it.
Model whose weights can be downloaded and run on your own infrastructure.
Maximum sovereignty: your data never leaves your IT environment.
"Open-weight" ≠ "open-source", read the licence (Llama, Kimi: restrictions apply).
Transferring the capabilities of a large model to a smaller one.
This is how you get sold "almost as good, 10× cheaper", benchmark it on YOUR use cases.
Distilling competitors' models raises contractual questions.
Compressing a model (reduced precision) to run on less memory.
This is what decides whether a local model runs on a £5k server or requires a £40k GPU.
Below Q4, quality drops noticeably.
The only advantage nobody can copy.
5 termesYour internal data (customers, contracts, products): your only non-copyable AI advantage.
The model is a commodity, your data is not: that's where the budget effort should go.
Sending it to a vendor whose contract permits training on it.
Database optimised for similarity-of-meaning search.
pgvector on your PostgreSQL is sufficient in most cases, no need for yet another vendor.
A RAG that serves HR documents to everyone: an internal leak.
Reliability, freshness and structure of the data fed into the AI.
Garbage in, garbage out at industrial scale: audit before connecting.
AI makes bad data look credible.
Access, classification and compliance rules applied to data used by AI.
AI inherits (or tramples over) your existing RBAC: check how permissions propagate.
AI connectors that bypass your DLP policies.
Replacing direct identifiers before AI processing.
The mandatory airlock before sending personal data to an external LLM (GDPR).
Re-identification through cross-referencing: pseudonymised ≠ anonymous.
When AI stops answering and starts acting.
7 termesAI that chains decisions and actions to achieve a goal, without validation at every step.
The shift from "AI answers" to "AI acts": your access-authorisation processes must keep pace.
Giving an agent the rights of the human who launches it.
The model's ability to call external tools (API, database, browser).
Every connected tool is an attack surface and a blast radius that needs defining.
The "send an email" tool wired up with no safeguards.
Model Context Protocol: open standard for connecting AI to your tools and data: the "USB-C of AI".
Bet on the standard rather than proprietary connectors.
An unaudited third-party MCP server: a stranger holding the keys to your IT system.
Several AI agents collaborating: one plans, one executes, one verifies.
Powerful for complex tasks, but traceability becomes your number one problem.
Errors cascade between agents.
Layer that sequences, supervises and resumes AI workflows.
This is what turns a demo into a reliable production process.
Orchestration "baked into the prompt": invisible, untestable, unauditable.
A human validates the AI's critical actions.
Put in writing which actions require validation: payment, external sending, deletion.
Validation fatigue: a human clicking OK without reading protects nothing.
Gradual drift of an agent's behaviour away from its original mission.
An agent that works in a demo can drift in production: continuous oversight is not optional.
Nobody notices until the incident happens.
The category the infographics forget.
7 termesUse of AI tools by employees, outside any framework approved by IT.
It's already inside your walls: the question isn't banning it but channelling it: internal offering + charter.
An outright ban pushes usage towards personal, invisible accounts.
Malicious instructions hidden in content the AI will read: an email, a web page, a PDF.
The number-one vulnerability of agentic systems, unresolved to date, only mitigated.
Believing a good system prompt provides protection.
Bypassing a model's safeguards to make it produce prohibited content.
Your public chatbot WILL be jailbroken: prepare the media response, not just the technical one.
The vendor's safeguards don't cover your business rules.
Data leakage via AI: responses, vendor logs, connected tools, booby-trapped links.
Map out where your data goes with every AI call, telemetry included.
The agent that "summarises" a confidential document to a public channel.
Technical rules governing AI inputs and outputs: filters, validations, boundaries.
To be defined by the enterprise, as a layer above the model, never delegated to the vendor alone.
Guardrails tested once, never re-run with each model change.
Deliberately attacking your own AI systems to find flaws before others do.
Mandatory before any exposed production release, and required by the AI Act for certain systems.
"One-shot" red teaming: every model update reopens the issue.
Corruption of a model or its training data (AI supply chain).
Treat downloaded models like software dependencies: source, checksum, approved registry.
The "free" model pulled from a hub with no verification.
What's becoming mandatory, and when.
6 termesEuropean regulation on AI, phased application 2025–2027.
GPAI obligations are already running, high-risk requirements arrive in August 2026: an inventory of your systems is step zero.
Thinking it only concerns providers, deployers have their own obligations.
AI Act category (Annex III): HR, credit, education, critical infrastructure…
Your AI-boosted CV screening is probably in there: assess it before someone assesses you.
The vendor who swears "they're the one responsible": the deployer remains liable.
General-purpose AI models (the large LLMs), subject to a specific regime under the AI Act.
Your vendors have transparency obligations: demand their documentation.
Fine-tuning a GPAI model can make you a provider under the regulation.
Data protection impact assessment, required by GDPR for high-risk processing.
Near-mandatory as soon as AI processes personal data at scale, must be done BEFORE deployment.
The DPIA written after the fact, just for form's sake.
Obligation to disclose interaction with an AI and to label generated content.
Chatbots, deepfakes, synthetic content: your disclosures and terms of use must be up to date in 2026.
The chatbot posing as "Julie from customer service".
Obligation to train staff who use AI systems, in force since February 2025.
One of the cheapest obligations to meet and the most visible in an inspection: start here.
"Training" that amounts to an email with a charter attached.
Managing value, not hype.
6 termesSystematic tests to measure the quality and reliability of an AI system.
No AI in production without evals: this is your pre-production recipe, AI version.
Evaluating on ten examples handpicked by whoever built the system.
Developing by describing in natural language what you want to build.
10× faster prototyping, but the generated code enters your IT system with your security requirements attached.
Unreviewed code going into production because "it works".
Designing products, processes and organisation around AI from the outset.
The real question isn't "where to add AI" but "what would a competitor starting from scratch with it do".
Sprinkling AI onto broken processes.
Turning human services into scalable products through AI.
The model that threatens (or supercharges) consulting, legal and accounting professions.
Selling software with a service-based cost structure.
Developing in-house or purchasing an off-the-shelf AI solution.
Buy for the generic; build only where your proprietary data creates an advantage.
Building an HR chatbot that forty vendors already sell, and better.
Measuring AI value use case by use case, not overall.
Three measured use cases are worth more than an "AI strategy": time saved × volume × hourly cost.
The eternal pilot that never scales, for lack of measurement.
Running in production without surprises.
4 termesOperational practices for AI systems: prompt versioning, deployment, rollback.
Your DevOps processes don't cover AI: non-determinism changes the rules of the game.
The prompt changed in production on a Friday, with no trace.
Tracing every call: inputs, outputs, costs, latency, tools triggered.
Without AI call logs, you can neither debug, nor audit, nor prove your compliance.
Logs that themselves contain unpurged personal data.
The economic unit of generative AI, billed on both input AND output.
The same use case can vary ×100 depending on the model: decide per task, not by locking into a single vendor.
Agents multiply invisible calls: the £3 POC becomes £3,000/month in production.
Response time of the AI system.
Beyond a few seconds, adoption collapses: latency is a product feature, not a technical detail.
Stacking RAG + agent + validation and discovering a 30-second response time in production.