AI terms, briefly explained

A method in which an AI system searches a knowledge base of its own for relevant passages before answering (retrieval) and then bases its answer solely on those passages (generation) — rather than answering from what it learned during training. That keeps answers current and verifiable: every statement can be traced back to a specific document. KOSMO works on this principle.

A database that stores text not as words but as numerical vectors (embeddings). Content with similar meaning ends up close together, which makes semantic search possible: a question about “holiday entitlement” also finds a passage on “annual leave”, even though the exact term never appears. In RAG systems, the vector database is the component that supplies the matching passages.

An operating model in which software runs on the organisation's own hardware or in its own data centre — as opposed to running at a cloud provider. Data never leaves your network, and updates and access stay under your control. For organisations handling particularly sensitive data, this is the most far-reaching form of data sovereignty.

An umbrella term for AI systems operated entirely within an environment the organisation controls — on-premise or in a dedicated data centre covered by contract. Inputs and documents are not passed to third parties and are not used to train anyone else's models. By contrast, public AI services process requests on the provider's infrastructure.

An authorisation model in which access rights are assigned to roles rather than to individual people (for example “Accounting” or “HR”). Users inherit their rights from their role. This removes a common source of error when people join or leave, and it is what allows an AI assistant to answer only from content the person asking is actually cleared to see.

Short for the “Conference of the Independent Federal and State Data Protection Supervisory Authorities of Germany”. The DSK coordinates how data protection law is interpreted across Germany and publishes guidance — including guidance on the data-protection-compliant use of AI applications, which organisations can use as a practical reference when introducing AI.

Regulation (EU) 2024/1689 establishes common rules for artificial intelligence across the EU. It entered into force on 1 August 2024; most obligations apply from 2 August 2026. The approach is risk-based: AI systems are grouped into risk classes from minimal to unacceptable, with requirements for transparency, documentation and oversight scaled accordingly. Internal knowledge systems typically fall into the lower risk classes — the actual classification depends on the intended use.