The Enterprise AI Governance Glossary: 15+ Acronyms Every Leader Should Know
Enterprise AI adoption has produced a wave of new terminology almost as fast as it has produced new tools. Analyst firms like Gartner tend to coin or formalize a term first, vendors build categories around it, and within a few quarters it becomes shorthand that security, IT, and business leaders are expected to already know.
This glossary breaks down the acronyms and terms you’ll run into most often when researching AI governance, AI security, and AI usage management – organized by theme, written in plain English, with notes on where each term comes from and why it matters.
Foundational Governance Terms
AI TRiSM (AI Trust, Risk, and Security Management)
Coined by Gartner, AI TRiSM is the umbrella framework most of the market now builds around. It groups together model governance, explainability, data protection, and runtime security into a single operating model, with the goal of keeping AI systems trustworthy, compliant, and secure throughout their lifecycle. Gartner has forecast that organizations operationalizing AI TRiSM will see meaningful gains in AI adoption and user acceptance – which is a big reason the term shows up in nearly every AI security vendor’s messaging today.
AIUC (AI Usage Control)
AIUC describes the practice of monitoring and governing how employees and applications actually use AI – which tools, what data goes into prompts, and what policies apply in real time. Unlike static access permissions, AIUC is typically context-aware: it can adapt controls based on the sensitivity of the data, the user’s role, or the specific AI tool involved. It’s a natural complement to AI TRiSM: TRiSM is the framework, AIUC is one of the operational controls that puts it into practice.
AI GRC (AI Governance, Risk, and Compliance)
An extension of traditional GRC into the AI domain – the policies, controls, and reporting structures organizations use to manage AI-related risk and demonstrate compliance with internal standards and external regulation.
AI-BOM (AI Bill of Materials)
A centralized inventory of every AI model, service, SDK, dataset, and pipeline in use across an organization – similar in spirit to a software bill of materials (SBOM), but built for AI assets. An accurate AI-BOM is treated as foundational: you can’t govern, secure, or audit what you haven’t inventoried.
NIST AI RMF (NIST AI Risk Management Framework)
A voluntary framework published by the U.S. National Institute of Standards and Technology for managing risks tied to AI design, development, and deployment. It’s frequently referenced as a baseline for enterprise AI risk programs, even outside the U.S.
Security & Risk Terms
Shadow AI
Unsanctioned or unmanaged use of AI tools by employees – outside IT visibility or approval. It’s the AI-era equivalent of “shadow IT,” and it’s currently one of the most-cited risks in enterprise security research: multiple 2026 industry reports put the share of employees bypassing approved channels well above a third of the workforce, often through personal accounts that sidestep corporate data controls entirely.
Shadow Agents
An emerging subset of Shadow AI: autonomous AI agents that have been deployed, connected, or granted access without security team visibility or approval. As agentic AI spreads through the enterprise, detecting these unauthorized agents, not just unauthorized chat tools, is becoming its own discipline.
AI-SPM / AISPM (AI Security Posture Management)
Tools and practices for continuously discovering AI models, agents, and their associated data pipelines, then assessing the risk that infrastructure creates. AI-SPM is often described as the AI-specific sibling of DSPM and CSPM (below) – it answers “what AI do we have, and how exposed is it?” rather than focusing on any single model’s accuracy or bias.
NHI (Non-Human Identity)
Refers to the machine identities – service accounts, API keys, and now AI agents – that act inside enterprise systems without a human directly at the keyboard. As agentic AI scales, governing NHIs (who they are, what they can access, and what they’re doing) has become a distinct security priority, since these identities don’t fit neatly into traditional human-centric identity and access management.
DSPM (Data Security Posture Management)
Focuses on discovering where sensitive data lives and who (or what) can access it. Increasingly converging with AI-SPM, since so much AI risk is really data-exposure risk in a new form.
CNAPP (Cloud-Native Application Protection Platform)
A broader cloud security category that AI-SPM capabilities are increasingly being folded into, as vendors consolidate AI risk management with existing cloud security investments.
ITDR (Identity Threat Detection and Response)
The practice of detecting and responding to threats targeting identities, increasingly extended to cover non-human and agent identities as well as human accounts.
Agentic AI Terms
MCP (Model Context Protocol)
Coined by Gartner, AI TRiSM is the umbrella framework most of the market now builds around. It groups together model governance, explainability, data protection, and runtime security into a single operating model, with the goal of keeping AI systems trustworthy, compliant, and secure throughout their lifecycle. Gartner has forecast that organizations operationalizing AI TRiSM will see meaningful gains in AI adoption and user acceptance – which is a big reason the term shows up in nearly every AI security vendor’s messaging today.
Agentic AI
AI systems that can plan, reason, use tools, and take multi-step actions autonomously – rather than simply responding to a single prompt. Gartner has projected that a significant share of enterprise applications will feature task-specific AI agents by the end of 2026, which is the main driver behind nearly every other term in this glossary: agents are expanding the attack surface and the governance burden faster than most organizations can track.
Guardian Agents
A concept introduced by Gartner describing AI agents whose specific job is to oversee and enforce the behavior of other AI agents at runtime. As enterprises deploy fleets of autonomous agents, Gartner’s premise is that manual review can’t keep pace – so oversight itself needs to become automated and machine-speed.
LLM (Large Language Model)
The foundation model type behind most generative AI tools – included here because it’s the base unit most governance and security controls are ultimately built around.
RAG (Retrieval-Augmented Generation)
A technique where an LLM retrieves relevant information from an external knowledge source before generating a response, rather than relying solely on its trained knowledge. Relevant to governance because RAG pipelines introduce their own data-access and data-leakage considerations.
New acronyms will keep arriving, that’s just a sign of how fast enterprise AI is moving. But underneath the alphabet soup, the goal stays the same: know what AI is running in your organization, understand the risk it carries, and prove the value it’s delivering. Get those three things right, and the terminology takes care of itself.
If you’re building out your own AI governance program and want a second set of eyes on where you stand, get in touch with the Portal26 team, we’re happy to help you cut through the jargon and focus on what actually moves the needle.