Speak the language
GRC and AI governance, in plain English.
The terms you will use every week. The full glossary lives inside the platform, one click from any page.
- Qualifying profile
- The plain-English questions on the client record. The applicability engine reads the answers and works out which regulations apply, with reasons.
- Obligation
- A specific duty a rule creates: a filing, review, notice, or renewal, each with a deadline and an owner. Obligations are the what; tasks are the steps.
- Control
- A repeatable routine that keeps a client compliant, re-checked (tested) on a schedule to prove it still happens.
- Evidence
- The proof behind the work: reports, signed forms, exports. Examiners ask for evidence; stale evidence is almost as bad as none.
- Finding
- A problem spotted by a regulator, auditor, or the client's own team, logged and tracked until the fix is confirmed.
- Attestation
- A person's recorded acknowledgment that they read and will follow a policy. The record is never deleted, though a signature made in error can be cleared.
- Waived
- An obligation status meaning "does not apply to us." Waiving stops all tracking and overdue alerts until someone changes it back, so waive only when confirmed.
- Posture score
- The 0 to 100 health grade. Overdue items, untreated high risks, and missed fix dates pull it down. A compass, not a regulator's grade.
- Preliminary assessment
- The free pre-sales engagement for a prospect: profile, no-login self-assessment, Readiness Snapshot. One click converts them to a client.
- Readiness Snapshot
- The co-branded prospect briefing: what applies, the untracked duties and penalty exposure, top gaps, a peer comparison once five industry peers are aboard, and the 90-day path.
- AI intake
- The front door for any new AI tool or use. Submitted before use; approved, added to the approved list, or sent into review.
- Shadow AI
- An AI tool already in use that never went through intake. Not a scandal, a blind spot: register it so it gets oversight.
- Risk tier
- How much oversight an AI system needs: Low, Medium, or High. Systems that influence decisions about people are High.
- The four gates
- Gate 1 Prioritize, Gate 2 Fund, Gate 3 Validate, Gate 4 Deploy, in order. Gate 3 has three honest outcomes: Scale, Extend, or Stop.
- Fundamental Impact Assessment (FIA)
- A structured look at what could go wrong before an AI system touches real people. Required for High-risk and lending systems; a frozen copy rides with each gate decision that used it.
- AI incident
- A wrong, unsafe, biased, or harmful AI outcome, or a data exposure. Severity runs S1 (worst) to S4 (minor), tracked to resolution.
- Maturity
- Five domains, scored two ways: attested (what the client says in the self-assessment) and evidenced (what control tests prove).
- Grace AI
- The platform's assistant. Drafts policies, model cards, and narratives from the client's own records, with citations. A human always signs off.
Every term on this page maps to a screen.
A 30-minute walkthrough with the team that builds and runs ClarityGRC. Bring the terms your clients keep asking about.
Not ready for a demo? Get the 2026 US AI regulation guide
Pricing is published. Partner onboarding runs through a short demo, no quote runaround.