Compliance glossary: SOC 2, GDPR, the EU AI Act and more
Plain-language definitions of the terms that come up in security, privacy and AI-governance work.
The ComplyEasyAI glossary defines 16 core compliance terms, from SOC 2 and ISO 27001 to DPIAs, risk registers and the EU AI Act. Each entry opens with a one-paragraph definition you can quote, then explains how the term works in practice and links to related terms.
TL;DR
- The first sentence of every entry is the definition.
- Each entry lists key takeaways and answers common follow-up questions.
- Every term links to related terms and to a deeper guide.
Reviewed by the ComplyEasyAI compliance teamLast reviewed
Which terms does the glossary define?
AI Compliance
AI compliance is the practice of making sure AI systems meet the laws, standards and ethical policies that apply to them across their lifecycle. It covers an inventory of AI systems, risk classification, data governance, documentation, bias testing, human oversight and monitoring, under rules such as the EU AI Act, NIST AI RMF and ISO/IEC 42001.
Read definition →Audit Readiness
Audit readiness is the state of having controls implemented, evidence current and known gaps fixed, so an organization can start an audit at any time without a last-minute scramble. It results from continuous monitoring and automated evidence collection, and it also speeds up customer security reviews and recertification.
Read definition →Continuous Compliance
Continuous compliance is the practice of monitoring controls and collecting evidence all the time, not just before an audit, so an organization knows its compliance posture on any given day. Integrations watch source systems, alerts fire when a control drifts, and issues are fixed close to when they occur, which matters most for SOC 2 Type II.
Read definition →Control Mapping
Control mapping links each internal control to every framework requirement it satisfies, so one piece of evidence can support several frameworks at once. For example, an access-review control can satisfy SOC 2 CC6, ISO 27001 Annex A 5.15 to 5.18, and HIPAA’s access-control safeguard. Adding a framework then means covering only the gaps.
Read definition →DPIA
A Data Protection Impact Assessment (DPIA) is a structured review, required by Article 35 of the GDPR, that an organization completes before starting processing likely to pose a high risk to people’s rights. It describes the processing, tests necessity and proportionality, identifies risks, and records the measures that reduce them.
Read definition →EU AI Act
The EU AI Act (Regulation (EU) 2024/1689) is the European Union’s law on artificial intelligence. It bans some practices outright, sets strict duties for high-risk systems, and requires transparency for chatbots and synthetic content. As amended in 2026, high-risk duties apply from 2 December 2027, or 2 August 2028 for AI in regulated products.
Read definition →Evidence Collection
Evidence collection is gathering the records that prove compliance controls are designed well and operating as intended, such as access reviews, configuration exports, change tickets, scan results and policy acknowledgements. Auditors sample this evidence across the audit period. Automated collection pulls it from source systems on a schedule instead of relying on screenshots.
Read definition →GDPR
The General Data Protection Regulation (GDPR) is the EU law, applying since 25 May 2018, that governs how organizations process the personal data of people in the EU. It requires a lawful basis, transparency and security, gives individuals rights such as access and erasure, and allows fines of up to €20 million or 4% of worldwide turnover.
Read definition →GRC
GRC stands for governance, risk and compliance: the combined practice of setting direction and accountability, managing risks to objectives, and proving adherence to laws, standards and internal policies. Running the three together, with one control library, risk register and evidence base, avoids the duplicated work of separate security, legal and audit processes.
Read definition →HIPAA
HIPAA is the US Health Insurance Portability and Accountability Act, which sets national standards for protecting health information. Its Privacy Rule limits how protected health information is used and shared, its Security Rule requires safeguards for electronic records, and its Breach Notification Rule sets reporting duties for covered entities and their business associates.
Read definition →ISO 27001
ISO/IEC 27001 is the international standard for an information security management system (ISMS). The current 2022 edition, amended in 2024, requires a risk assessment, a Statement of Applicability covering 93 Annex A controls, internal audits and management review. Accredited certification bodies certify organizations for three years, with annual surveillance audits in between.
Read definition →NIST AI RMF
The NIST AI Risk Management Framework (AI RMF 1.0) is a voluntary US framework, published in January 2023, for managing the risks of AI systems. It organizes the work into four functions, Govern, Map, Measure and Manage, and defines seven characteristics of trustworthy AI. NIST is revising it as part of the White House AI Action Plan.
Read definition →Risk Register
A risk register is the central record of an organization’s identified risks. Each entry describes the risk, its likelihood and impact, the resulting rating, the owner, and the treatment decision: mitigate, transfer, accept or avoid. ISO 27001, the NIST AI RMF and most other frameworks expect one, kept current and linked to controls.
Read definition →RoPA
A Record of Processing Activities (RoPA) is the inventory of personal-data processing that Article 30 of the GDPR requires most organizations to keep. For each activity it records the purpose, categories of people and data, recipients, international transfers, retention periods and security measures, and it must be shown to regulators on request.
Read definition →SOC 2
SOC 2 is an AICPA attestation that reports how a service organization protects customer data against the Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy. An independent CPA firm issues it, either as a Type I report on control design or a Type II report on operating effectiveness over a period, typically three to twelve months.
Read definition →Vendor Risk Management
Vendor risk management (VRM) is the process of identifying, assessing and monitoring the security, privacy and operational risks that suppliers and service providers bring. A typical program inventories vendors, tiers them by criticality and data access, reviews questionnaires and attestations such as SOC 2 reports, and tracks remediation and contract terms over time.
Read definition →