Glossary: buying terms for AI software

The contract the GDPR requires whenever a vendor processes personal data on your behalf. Article 28(3) sets out what it must contain: the subject, duration and purpose of the processing, the types of data and of people affected, processing only on your documented instructions, confidentiality, security measures, rules for subprocessors, help with data subject requests, deletion or return of the data at the end, and the information you need for audits.

On ai-toolfinder: Profiles show whether the vendor publishes its DPA, makes it part of the terms you accept, or sends it on request.

Sources: GDPR, Article 28

A company your vendor engages to process your personal data, for example its cloud host or the provider of the AI model behind a feature. Under Article 28(2) GDPR the vendor needs your prior written authorisation, specific or general. With a general authorisation it must tell you before it adds or replaces a subprocessor, so you can object.

On ai-toolfinder: Where the vendor publishes a subprocessor list, the profile links it.

Sources: GDPR, Article 28

Customer data is stored in data centres inside the European Union. That keeps the data under the GDPR, but access from outside the EU is a separate question. A company outside the EU may be able to access the data, for example the vendor's parent company or a subprocessor. According to the European Data Protection Board, that access can count as a transfer under Chapter V of the GDPR, even if the data only appears on a screen for support.

On ai-toolfinder: We mark a tool as EU hosting when the vendor says it stores customer data in the EU or in Germany, or lets you choose an EU region.

Sources: EDPB Guidelines 05/2021 on the interplay between Article 3 and Chapter V GDPR

An adequacy decision of the European Commission that entered into force on 10 July 2023. Personal data can go from the EU to US companies that have certified themselves under the framework without further safeguards such as standard contractual clauses. The official list on dataprivacyframework.gov shows whether a company is certified. It also shows whether the certification covers HR data, which the framework treats under its own principle.

On ai-toolfinder: For US vendors that process employee data, check on the official list that the certification includes HR data.

Sources: Data Privacy Framework, program overview, Data Privacy Framework, Supplemental Principle 9: Human Resources Data

An examination report by a CPA firm on a service company's controls, measured against the AICPA's trust services criteria for security, availability, processing integrity, confidentiality and privacy. The auditor evaluates how the controls are designed and whether they are effective. Reports come as Type 1 or Type 2, and the AICPA publishes separate templates for each.

On ai-toolfinder: Profiles list SOC 2 when the vendor states it on its own pages. The report itself usually comes only under a non-disclosure agreement, so ask for it and check which type it is and which period it covers.

Sources: AICPA, SOC 2 guide

The international standard for an information security management system. A certification body audits the company against it. ISO points out that a certificate from an accredited body carries more weight, because an accreditation body has confirmed that the certifier is competent. The current edition is ISO/IEC 27001:2022.

On ai-toolfinder: Ask who issued the certificate and check that it covers the product you are buying.

Sources: ISO, ISO/IEC 27001:2022

The international standard for an AI management system, published in December 2023, which ISO calls the world's first of its kind. It sets requirements for companies that provide or use AI-based products or services, including how they manage the risks and opportunities of AI.

On ai-toolfinder: Profiles list ISO/IEC 42001 when the vendor names the certification on its own pages.

Sources: ISO, ISO/IEC 42001:2023

Staff sign in to the tool with their company account from an identity provider such as Microsoft Entra ID, Okta or Google Workspace, instead of with a separate password. Two common protocols are SAML 2.0 and OpenID Connect, an authentication protocol built on OAuth 2.0.

On ai-toolfinder: Profiles show whether SSO comes with all plans, with paid plans, only with higher plans or as an add-on.

Sources: OpenID Foundation, OpenID Connect

A standard protocol, defined in RFC 7643 and RFC 7644, that lets your identity provider create, change and remove user accounts in the tool automatically. SSO decides how people sign in. SCIM decides who has an account at all.

On ai-toolfinder: Our profiles do not have a field for it yet. Ask for it if accounts in the tool should follow joiners and leavers in your HR system.

Sources: IETF, RFC 7644

Regulation (EU) 2024/1689, the EU's law on artificial intelligence. It sorts AI by risk: some practices are banned, high-risk systems carry strict duties, and systems that talk to people must tell them they are dealing with AI. It applies to providers, who develop an AI system or bring it to market under their own name, and to deployers, the companies that use it.

On ai-toolfinder: Profiles quote the vendor's own statement on the AI Act where it published one.

Sources: Regulation (EU) 2024/1689

AI systems listed in Annex III of the AI Act. Point 4 covers work: AI used to recruit or select people, to decide on promotion or termination, to allocate tasks based on behaviour or personal traits, or to monitor and evaluate workers. After the Digital Omnibus, Regulation (EU) 2026/1744, these duties apply from 2 December 2027. Employers that use such systems must, among other duties, assign trained human oversight, keep the logs for at least six months and inform workers' representatives before use.

On ai-toolfinder: Profiles of tools used in the EU carry a note on whether AI in their category can count as high-risk under Annex III. EU AI Act high-risk rules for HR tools: what is covered, what is banned, and a checklist

Sources: Regulation (EU) 2024/1689, Annex III and Article 26, Regulation (EU) 2026/1744 (Digital Omnibus on AI)

Under section 87(1) no. 6 of the German Works Constitution Act (BetrVG), the works council must agree before a company introduces or uses technical systems designed to monitor employees' behaviour or performance. The Federal Labour Court reads this broadly: it is enough that a system can objectively record such data. That is why HR and AI software in a company with a works council usually needs a works agreement before rollout.

On ai-toolfinder: Where a vendor publishes material for works councils, the profile links it.

Sources: BetrVG, section 87, Federal Labour Court, 1 ABR 7/15

An open standard that Anthropic released as open source in November 2024 for connecting AI assistants to the systems where data lives. An MCP server offers functions, for example searching a CRM, that compatible AI clients can call.

On ai-toolfinder: MCP servers have their own entry type in the directory. ai-toolfinder runs one as well: connect your client to https://ai-toolfinder.com/mcp.

Sources: Anthropic, Introducing the Model Context Protocol

A method in which the AI first searches your documents and then writes its answer from the passages it found, instead of relying only on what the model learned in training. The term comes from a 2020 paper by Patrick Lewis and colleagues. How well it answers depends heavily on how the documents are parsed, split and searched.

On ai-toolfinder: Our guide compares document parsers for RAG on tables, scans and cost per page. Document parsers for RAG: what they do with tables and scans and what a page costs

Sources: Lewis et al., Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks (2020)