In plain English: If a piece of software makes decisions or produces outputs that affect people or processes, it is probably an AI system under the law. That includes the chatbot on your website, the tool that screens CVs, and the software that flags fraud on your accounts.

In plain English: Most AI tools respond to a prompt and stop. Agentic AI keeps going. You give it a goal and it figures out the steps, takes actions, uses other tools, and reports back when it is done. That sounds useful and often is. It also means the AI is making a series of decisions you did not individually approve. The governance question with agentic AI is not just what it does, but what it does when something unexpected happens halfway through.

In plain English: Automation is not new. What is new is AI making judgment calls, not just following fixed rules. The question is not whether automation is good or bad. It is which decisions you are comfortable handing over, and whether a human is still in the loop when it matters.

In plain English: If you train an AI on hiring data from a company that mostly hired men, it will learn to favour men. The AI is not malicious. It is a mirror. The problem is what it reflects. Bias is one of the most documented risks in AI use and one of the most important things to check for before you deploy a tool that affects people.

In plain English: Imagine feeding an AI student deliberately wrong textbooks so that it learns the wrong answers. Data poisoning is that, but intentional and malicious. It is more relevant to AI developers than to most SMEs, but it is worth knowing it exists, especially if you are using AI tools that learn from data your customers or staff provide.

In plain English: If your business uses an AI tool, you are a deployer. That means you have legal responsibilities, even if you just bought a subscription and pressed go. This is the term that catches most SMEs off guard. You do not need to build AI to be regulated by it.

In plain English: A deepfake is a fabricated video or audio clip that is realistic enough to be believed. You have probably seen examples of politicians or celebrities appearing to say things they never said. For businesses, the risk is not just reputational. Deepfakes are increasingly used in fraud, with AI-generated voices and faces used to impersonate executives and authorise payments. The EU AI Act specifically requires that synthetic media be labelled as AI-generated. If your business creates or uses any AI-generated content of real people, even for marketing, this applies to you.

In plain English: If your AI tool rejects a loan application or flags a customer as high risk, can you explain why? Not just “the system said so,” but what factors led to that outcome. Explainability matters legally under GDPR and practically under the EU AI Act. If you cannot explain it, you probably should not be relying on it for decisions that affect people.

In plain English: Think of it like hiring someone with a general degree and then training them specifically for your industry. Fine-tuning takes a general AI and makes it more useful for a specific job. Some businesses fine-tune models on their own data, which raises additional questions about data privacy and what the model might learn and reproduce.

In plain English: A foundation model is the engine underneath most AI tools you use day to day. When you use ChatGPT, you are using a product built on top of a foundation model. You rarely interact with foundation models directly, but understanding they exist helps you ask better questions about where your AI tool’s capabilities and risks actually come from.

In plain English: Generative AI is what most people mean when they say “AI” now. ChatGPT, Midjourney, Copilot. It generates. It does not just look things up. This distinction matters for governance because generating content carries different risks from analysing it. A tool that writes your contracts or your job adverts on your behalf is doing something very different from a tool that searches your database.

In plain English: AI hallucination is the most important thing for any SME to understand before using AI for anything client-facing. The model will write a convincing, well-structured answer that is completely wrong. It will cite cases that do not exist. It will quote statistics it invented. This is why human review of AI outputs is not optional. It is the minimum.

In plain English: If your AI tool makes or influences decisions that significantly affect people’s lives, it is probably high-risk under the law. That comes with specific legal obligations around transparency, human oversight, and documentation. Most SMEs do not know whether their AI use falls into this category. Finding out is the first step.

In plain English: Human oversight does not mean ignoring what the AI produces. It means having someone who actually reads it, questions it, and can say no. A human in the loop who rubber-stamps everything without looking is not oversight. It is liability without protection.

In plain English: An LLM is a very sophisticated autocomplete. It has read an enormous amount of text and learned patterns in language so well that it can generate responses that sound authoritative and human. The catch is that sounding authoritative and being accurate are two very different things.

In plain English: The model is the engine. The product you use is the car. You might be using different cars built on the same engine, or the same car with a different engine underneath. Knowing which model powers your tool matters when you are assessing its risks and limitations.

In plain English: Open source sounds reassuring because it means transparent. But for governance purposes it also means that anyone, including your own team, can run a version of that model without the safety guardrails the original developer put in place. Free does not mean ungoverned. It often means you are responsible for the guardrails yourself.

In plain English: A prompt is what you type into an AI tool. “Write me a contract” is a prompt. So is “Summarise this document.” The reason AI outputs are often poor is not always the AI. It is often the prompt. Clear, specific instructions get better results. Vague ones get creative interpretations you did not ask for.

In plain English: Standard AI makes things up because it can only work from what it was trained on. RAG gives the AI access to your actual documents or data before it answers, so instead of guessing it looks it up first. It is why some AI tools can answer questions about your specific company or a recent document you uploaded. It does not eliminate hallucination entirely but it reduces it significantly. From a governance perspective, RAG also means the AI is now accessing your data, which raises questions about what it can see, who authorised that access, and how that data is handled.

In plain English: If you built the AI tool, you are the provider. If you are using someone else’s tool, you are the deployer. Most SMEs are deployers, not providers. But if you have built a custom AI tool for your own use or for clients, you may have provider obligations you are not aware of.

In plain English: A risk assessment is just asking: what could go wrong with this tool, how likely is it, how bad would it be, and what are we going to do about it? It does not need to be a 50-page document. For most SMEs it can be a structured conversation. But it needs to happen before you deploy the tool, not after something goes wrong.

In plain English: When an AI tool tells you it has run out of context or cannot process a document, it has hit its token limit. Think of it like a short-term memory limit. This matters practically because it means very long documents may get cut off, summarised inaccurately, or processed in chunks that lose context. Know the limits of the tool you are using.

In plain English: Training data is what the AI was taught on. If it was taught on biased, outdated, or narrow data, its outputs will reflect that. When you are evaluating an AI tool, one of the most useful questions you can ask the provider is: what was this trained on? If they cannot or will not tell you, that is information too.

In plain English: Transparency means not hiding the AI. If your customer service chatbot is AI-powered, say so. If an AI tool influenced a decision about someone, they have a right to know. Transparency is not just a legal requirement under the EU AI Act and GDPR. It is the foundation of trust. And trust, as any SME owner knows, is easier to lose than to rebuild.