{ "$comment": "The vocabulary of AI trust, defined once. Every definition here is the definition used everywhere else on lunarasociety.com — glossary.html is generated from this file and tools/verify-seo.mjs fails the deploy if they diverge. Terms marked authority:'lunara' are ours and we say so; terms marked authority:'field' are the field's, defined as neutrally as we can manage; terms marked authority:'legal' come from an instrument and cite it. Where a term is commonly used to mean something it does not mean, that is recorded in confused_with rather than left for the reader to discover.", "version": "1.0.0", "updated": "2026-08-29", "license": "https://creativecommons.org/licenses/by/4.0/", "canonical": "https://lunarasociety.com/glossary.html", "terms": [ { "id": "ai-trust", "term": "AI trust", "authority": "field", "short": "The degree to which claims made about an AI system or its operator can be checked by someone other than the party making them.", "note": "Used loosely to mean a feeling a user has. That usage is not useful operationally: a feeling cannot be audited and cannot be withdrawn. The version worth building on is a property of the evidence, not of the audience.", "see": ["ai-verification", "ai-assurance", "ai-trust-standard"] }, { "id": "ai-verification", "term": "AI verification", "authority": "field", "short": "Checking a specific factual claim about an AI system or the entity operating it against evidence, and recording the result somewhere the checked party does not control.", "note": "Verification is narrow by nature. \"We verified this company\" is not a statement; \"we verified this company's legal registration and its control of this domain, on this date\" is.", "confused_with": "Validation, which asks whether a system does what it should. Verification asks whether a stated claim is true.", "see": ["ai-certification", "third-party-verification", "self-attestation"] }, { "id": "ai-certification", "term": "AI certification", "authority": "field", "short": "A decision by a body other than the operator that a defined set of criteria has been met, published so third parties can rely on it, and revocable if it stops being true.", "note": "The three properties that make it a certification rather than a receipt: someone else decided, the decision is published, and it can be withdrawn. Remove any one and what remains is a graphic.", "confused_with": "Accreditation, which is certification of the certifier. Almost nothing sold as AI certification today is accredited, including Lunara Shield.", "see": ["shield-certification", "revocation", "trust-badge"] }, { "id": "ai-assurance", "term": "AI assurance", "authority": "field", "short": "The broader discipline of producing justified confidence about an AI system's behaviour, of which certification, audit, testing, red-teaming and documentation are all instruments.", "note": "Assurance is the umbrella; certification is one tool under it and one of the weaker ones on its own. A company with a certification and no testing regime has bought the label of the thing.", "see": ["ai-certification", "ai-conformity-assessment", "ai-risk-assessment"] }, { "id": "ai-governance", "term": "AI governance", "authority": "field", "short": "The internal structures by which an organisation decides what its AI systems may do, who is accountable when they do it, and what happens when something goes wrong.", "note": "Governance is what an organisation does; certification is what someone else says about it. They are frequently sold together and are not the same purchase.", "confused_with": "Compliance, which is meeting an external legal requirement. An organisation can be compliant and ungoverned, and vice versa.", "see": ["ai-accountability", "ai-risk-assessment"] }, { "id": "ai-conformity-assessment", "term": "Conformity assessment", "authority": "legal", "short": "The formal process, defined in EU product legislation and applied to high-risk AI systems by the EU AI Act, of demonstrating that a system meets the requirements set for it.", "note": "A legal term of art, not a marketing one. For most high-risk categories it is performed by the provider itself; for some it requires a notified body. No private trust standard is a conformity assessment.", "source": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng", "see": ["notified-body", "ai-certification"] }, { "id": "notified-body", "term": "Notified body", "authority": "legal", "short": "An organisation designated by an EU member state to carry out conformity assessment where the law requires an independent one.", "note": "Designation is a legal act by a state. An organisation is either notified or it is not, and it is a matter of public record. Lunara Society is not a notified body.", "source": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng", "see": ["ai-conformity-assessment"] }, { "id": "ai-trust-standard", "term": "AI trust standard", "authority": "field", "short": "A published set of criteria plus the mechanism that determines whether an organisation meets them and makes the answer checkable by outsiders.", "note": "The criteria are the easy half and the part everyone publishes. The mechanism — who decides, where the decision lives, how it is withdrawn — is what makes the criteria mean anything.", "see": ["ai-certification", "ai-trust-registry", "revocation"] }, { "id": "ai-trust-registry", "term": "AI trust registry", "authority": "field", "short": "A public record of which entities hold a given credential, queryable by anyone, that can return a negative or withdrawn answer as well as a positive one.", "note": "A register that can only confirm is a customer list. The ability to answer \"not registered\" and \"revoked\" is what distinguishes a register from a directory, and it is the property to check first.", "see": ["ai-trust-standard", "revocation", "trust-badge"] }, { "id": "third-party-verification", "term": "Third-party verification", "authority": "field", "short": "Verification performed by a party with no commercial interest in the outcome, as distinct from the operator checking itself or a customer checking its supplier.", "note": "Strictly, a body paid by the entity it certifies is second-party in economic substance whatever it is called, which is why the withdrawal mechanism matters more than the label.", "confused_with": "Independent verification, used interchangeably in marketing. Independence is a claim about incentives; third-party is a claim about who performed the check.", "see": ["ai-verification", "self-attestation"] }, { "id": "self-attestation", "term": "Self-attestation", "authority": "field", "short": "A statement an organisation makes about itself, with no external check.", "note": "Legitimate, fast, cheap, and better than nothing — but it is a description rather than a verification, and displaying it as a badge is where it becomes misleading. If nobody checked, the artefact should say nobody checked.", "see": ["third-party-verification", "trust-badge"] }, { "id": "trust-badge", "term": "Trust badge", "authority": "field", "short": "A visual mark displayed by an organisation to signal a credential. On its own it proves nothing, because it is an image file that anyone can copy.", "note": "The badge is never the evidence. The issuer's register is. A badge worth displaying is one that queries that register when the page renders, so a withdrawn credential stops displaying without the certified party's involvement.", "see": ["ai-trust-registry", "revocation"] }, { "id": "revocation", "term": "Revocation", "authority": "field", "short": "Withdrawal of a credential by its issuer, without the holder's consent, served thereafter to everyone who queries.", "note": "The single property that decides whether a credential carries information. A status that cannot be taken away says only what was true on the day it was granted, to whoever paid for it.", "see": ["ai-certification", "ai-trust-registry"] }, { "id": "ai-risk-assessment", "term": "AI risk assessment", "authority": "field", "short": "A structured examination of what an AI system could do wrong, how likely that is, how bad it would be, and what reduces it.", "note": "Distinct from a regulatory applicability check, which asks a narrower question: which obligations reach this deployment. The two are routinely sold as one product and answer different questions.", "see": ["ai-governance", "ai-assurance"] }, { "id": "ai-transparency", "term": "AI transparency", "authority": "field", "short": "Making it discoverable that AI was involved, what it did, and on what basis — to users, to affected parties, or to regulators, depending on the obligation.", "note": "Under the EU AI Act this has a specific and much narrower meaning than in general usage: Article 50 duties to inform people they are interacting with an AI system and to mark certain generated content machine-readably.", "source": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng", "see": ["machine-readable-marking", "ai-accountability"] }, { "id": "machine-readable-marking", "term": "Machine-readable marking", "authority": "legal", "short": "Marking generated or manipulated content so that another system can detect it was produced by AI, rather than only a person reading a label.", "note": "A visible disclosure to a human does not satisfy a machine-readable marking duty. The distinction catches out a lot of otherwise careful implementations.", "source": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng", "see": ["ai-transparency"] }, { "id": "ai-accountability", "term": "AI accountability", "authority": "field", "short": "The existence of an identifiable party who answers for what an AI system did, and a route by which an affected person can reach them.", "note": "Accountability requires a name. An organisation that will not attach a person to a decision has arranged, deliberately or not, not to be blamed for it.", "see": ["ai-governance", "ai-agent-accountability"] }, { "id": "ai-agent", "term": "AI agent", "authority": "field", "short": "An AI system that takes actions in the world on behalf of a principal — sending messages, making requests, transacting — rather than only producing output for a person to act on.", "note": "The distinction that matters for trust is not autonomy but consequence: an agent that can commit its principal to something is a party to a transaction, and parties to transactions need identity.", "see": ["ai-agent-identity", "ai-agent-credential"] }, { "id": "ai-agent-identity", "term": "AI agent identity", "authority": "field", "short": "Whether the party you are dealing with is the same agent across interactions, and whether it can prove it.", "note": "Cryptographically simple and rarely deployed. Distinct from principal identity, which asks which real legal entity the agent acts for — that is the question a register can answer today.", "see": ["ai-agent", "ai-agent-credential"] }, { "id": "ai-agent-credential", "term": "AI agent credential", "authority": "field", "short": "A checkable statement that a specific autonomous system is operated by a specific verified principal, and optionally what it is permitted to do.", "note": "No widely adopted scheme exists. Anything offered as one today is either self-issued, which proves nothing to a third party, or a design document. A credential for a machine acting for an unverified entity certifies nothing.", "see": ["ai-agent-identity", "ai-certification"] }, { "id": "ai-agent-accountability", "term": "AI agent accountability", "authority": "field", "short": "The ability to reach a human or legal entity that answers for what an agent did, after it has done it.", "note": "The hardest of the agent problems and the least discussed, because it is the one that cannot be solved with a protocol. It requires somebody to have accepted liability in advance.", "see": ["ai-accountability", "ai-agent-credential"] }, { "id": "ai-vendor-due-diligence", "term": "AI vendor due diligence", "authority": "field", "short": "The checks a buyer runs on an AI supplier before purchase: that the entity exists, controls its domain, has a named accountable party, holds any credential it displays, and cites its factual claims.", "note": "None of it costs money and it takes about fifteen minutes. The check almost nobody runs — whether the supplier publishes its own corrections — is the most informative one.", "see": ["ai-verification", "third-party-verification"] }, { "id": "shield-certification", "term": "Shield Certification", "authority": "lunara", "short": "Lunara's human-reviewed verification that a business is legally registered and controls the domain it operates from, published to a free public register and revocable.", "note": "It checks two things carefully rather than everything vaguely. It does not audit a model, and it is not a regulatory approval — no private certification discharges a legal obligation.", "see": ["ai-certification", "revocation", "ai-trust-registry"] }, { "id": "evidence-mark", "term": "Evidence mark", "authority": "lunara", "short": "The label Lunara attaches to every published claim recording how it is known: verified, reported, interpretation or hypothesis.", "note": "Applied to our own claims first. A claim read from a cited instrument and a claim we inferred are different objects and should not be printed in the same typeface.", "see": ["ai-transparency"] } ] }