AI and Automation Glossary.

A software system in which a language model selects and invokes external tools (database queries, API calls, code execution) to accomplish a multi-step task, with the model acting as the planner and the tools as the executors.

The maximum number of tokens a language model can attend to at once, encompassing both the input prompt and the generated output, with current frontier models offering windows from 128k up to 1M+ tokens.

The process of further training a pre-trained language model on domain-specific data to adapt its behaviour, terminology, or output format to a particular use case or organisation.

A large neural network pre-trained on broad data at scale, designed to be adapted (via fine-tuning, prompting, or RAG) to a wide range of downstream tasks rather than serving a single purpose.

A language model output that is fluent and plausible but factually incorrect, fabricated, or unsupported by source material, occurring when the model generates content based on training-data patterns rather than grounded evidence.

A neural network trained on large text corpora to predict the next token given context, used for text generation, summarisation, classification, and reasoning tasks across enterprise software.

AI systems that process and reason across multiple input types (text, image, audio, video, structured data) rather than a single modality, enabling tasks like document understanding, image-grounded QA, and meeting transcription.

The discipline of designing, structuring, and refining the input text passed to a language model to produce reliable, accurate, and properly-formatted output for a specific task.

An architecture pattern that grounds language model outputs in retrieved documents from a private corpus, reducing hallucination and enabling answers based on the firm's own data rather than the model's training set.

The process of splitting text into smaller units (tokens) that a language model treats as atomic, typically using subword algorithms like Byte-Pair Encoding (BPE) or SentencePiece.

A database optimised for storing and querying high-dimensional vector embeddings using approximate nearest-neighbour algorithms, used as the retrieval layer in RAG systems and semantic search.

A high-dimensional numerical representation of text, image, or other content that places semantically similar items close together in vector space, enabling similarity search and clustering.

An automated pipeline that ingests unstructured documents (PDFs, scans, emails, forms), extracts structured data using AI, validates it against business rules, and pushes clean records into target systems.

The classification and routing of incoming documents (clinical letters, legal correspondence, customer requests) by topic, urgency, and required action, with the AI handling routine cases and escalating exceptions.

AI automation built as custom software the client owns: code in the client's repository, deployment in the client's infrastructure, integrations against real APIs, with no per-seat licences and no third-party canvas in the data path.

A design pattern in which humans review and approve AI decisions at designated points in a workflow, used for high-stakes or low-confidence cases where full automation is inappropriate.

A category of document automation that combines OCR, layout analysis, language model extraction, and validation logic to handle complex unstructured documents at production scale.

Automation built by configuring a third-party platform (Zapier, Make, n8n, Power Automate, and similar) through a visual canvas rather than written code, with workflows running inside the platform vendor's infrastructure.

Automation that mimics user actions in legacy software (clicking, typing, copying, pasting) when no API is available, used to integrate systems that cannot otherwise be connected.

The use of software to execute a defined sequence of business operations (data extraction, validation, routing, action) end-to-end without human intervention except at designated review points.

The coordination layer that sequences AI-driven and human-driven steps in a multi-stage process, handling state, retries, error paths, and audit logging across the full workflow.

The process of running a trained AI model on input data to produce an output, distinguished from training (which produces the model) and fine-tuning (which adapts it).

AI deployed inside a network that has no connection to the public internet, used for the most security-sensitive workloads where any external connectivity is prohibited.

A language model accessed via a third-party provider's API (OpenAI, Anthropic, Google, others), where inference happens on the provider's infrastructure and content is sent to the provider for processing.

AI inference that runs on local devices (browsers, phones, embedded hardware) rather than in a server-side data centre, used for low-latency, offline-capable, or privacy-preserving deployments.

A retrieval architecture that combines keyword search (BM25 or similar) with semantic vector search, blending the two ranked results to capture both exact-match precision and semantic recall.

The infrastructure layer that exposes a trained AI model as a network endpoint, handling request batching, load balancing, autoscaling, observability, and version management.

AI deployed on hardware the client owns and operates inside their own data centre or office facility, with no dependency on external cloud or model providers for inference.

AI deployed on infrastructure the client controls (on-premise, in the client's cloud tenancy, or air-gapped), with no third-party LLM provider in the data path and no inference-time data export.

Search that ranks results by meaning rather than exact keyword match, using vector embeddings to retrieve semantically-similar content even when no terms overlap.

UK government procurement frameworks operated by the Crown Commercial Service, including RM6200 (AI Dynamic Purchasing System) and RM6173 (Automation Marketplace), which allow public-sector buyers to direct-award without re-tender.

A UK government-backed certification scheme covering five baseline technical security controls: boundary firewalls, secure configuration, user access control, malware protection, and patch management.

The hands-on tested version of Cyber Essentials, requiring an independent assessor to verify the five technical controls through external vulnerability scanning and configuration audit rather than self-assessment alone.

A formal assessment required under UK GDPR before processing personal data in ways likely to result in high risk to individuals, documenting the necessity, proportionality, and mitigation of identified risks.

The geographic location where data is stored and processed, with regulatory requirements (UK GDPR, sector-specific rules) often constraining where personal or regulated data can travel.

The Financial Conduct Authority's outcomes-based regulation requiring regulated firms to act to deliver good outcomes for retail customers across products, services, price, value, understanding, and support.

The UK's independent supervisory authority for data protection, responsible for enforcing UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations.

The international standard for information security management systems (ISMS), specifying a framework of policies, controls, risk assessment, and continuous improvement for protecting information assets.

US regulations governing the export and handling of defence-related articles, services, and technical data, with significant implications for UK aerospace, defence-adjacent, and dual-use engineering firms.

The annual self-assessment NHS organisations and their suppliers must complete to demonstrate compliance with the data security standards required to handle NHS patient data and connect to NHS systems.

The Solicitors Regulation Authority's rules governing UK solicitors and law firms, including outcome-focused regulation on confidentiality, conflict of interest, accountability, and client protection.

A legal right under UK GDPR for an individual to request a copy of the personal data an organisation holds about them, with a one-month statutory response deadline.

The UK's data protection regime as established by the Data Protection Act 2018, retaining the substantive requirements of EU GDPR after Brexit, governing how personal data is collected, processed, stored, and shared.

An organisational unit responsible for AI strategy, architecture standards, governance, and capability-building across the business, typically reporting to the CTO, COO, or a dedicated executive.

A framework for assessing where a business sits on the spectrum from no-AI to fully-integrated AI capability, used to guide investment, hiring, and strategy decisions.

A commercial structure in which a business pays a monthly fee for committed AI engineering capacity over a 12-month minimum term, rather than paying per-project or per-seat.

A documented plan covering which workflows to automate, in what order, on what architecture, with what governance, against which business outcomes, typically across a 12 to 24 month horizon.

The full cost of running an AI system over its useful life, including build, hosting, model API or compute, ongoing engineering, monitoring, and the operational burden of integration drift and regulatory updates.

The commercial decision between commissioning custom AI software (build) and licensing an off-the-shelf AI product (buy), with the right answer depending on workflow specificity, regulatory constraints, integration depth, and total cost of ownership.

AI capability delivered as bespoke software tailored to a specific business's systems, workflows, regulatory context, and integration requirements, rather than a generic SaaS product.

The measurable financial return from an AI automation engagement, typically calculated as administrative time recovered, error rates reduced, throughput increased, or revenue unlocked, against the cost of the build and operation.

A system that eliminates GPU-CPU data transfer overhead by retaining intermediate results in GPU storage buffers between consecutive operations, fusing multi-step pipelines into a single dispatch sequence.

Massively parallel data processing pipelines that execute within the browser security sandbox, enabling GPU-accelerated computation without native application installation or server round-trips.

A non-comparison sorting algorithm that transforms floating-point bit patterns into sort-order-preserving unsigned integers, enabling linear-time radix sort on real-valued numerical data.

A pattern matching method that uses a character frequency histogram pre-filter to reduce the candidate set before applying brute-force matching on the GPU, achieving sub-linear average-case performance on large document collections.

A dispatch mechanism that assigns a penalty value of negative infinity to categorically prevent GPU execution for workloads that would cause SIMD branch divergence or atomic contention, routing them to CPU instead.