RegTech glossary

An open JSON-RPC protocol for addressing AI agents as services and exchanging tasks between them. Each agent describes itself through a public AgentCard listing its capabilities and endpoints. This lets agents from different systems connect in a controlled way without a custom interface for every pairing.

Operation in an environment with no connection to the internet. Models, data and regulatory updates are held locally; updates enter the system only through verified offline packages. Air-gapped operation is intended for organisations with the highest confidentiality requirements.

The umbrella term for duties that prevent money laundering and terrorist financing. In Germany they are set out in the Geldwäschegesetz (GwG): customer due diligence, internal safeguards and suspicious activity reporting. At EU level, the directly applicable Regulation (EU) 2024/1624 (AMLR) applies from 10 July 2027.

Complete, tamper-evident logging of decisions, changes and results. An audit trail shows who did what, when and on what basis. In an audit it is the bridge between a statement and its evidence.

Germany’s integrated financial supervisor for banks, financial services providers, insurers and securities trading. It specifies statutory requirements through circulars such as MaRisk and publishes guidance, for example on reporting procedures under DORA.

A BaFin circular setting requirements for banks’ IT governance, information security and IT operations. BAIT now applies only to institutions outside the scope of DORA and will be repealed on 31 December 2026. Where BAIT and DORA overlap, each requirement should be assessed only once.

A documented target process for a regulation, structured into process modules and grounded controls. Every step cites the underlying article and its source. A blueprint is the benchmark you map your current processes against.

Germany’s central cybersecurity authority and the competent body for NIS2 implementation under the BSIG. Entities in scope must register with the BSI and report significant security incidents to it. Operators of critical facilities additionally prove the implementation of their measures to the BSI on a regular basis.

The unique document number of a legal act in EUR-Lex. It encodes, among other things, the sector, year, document type and sequence number — DORA, for example, carries CELEX number 32022R2554. Because it is stable and language-independent, it is a reliable anchor for source citations.

A concrete, testable measure that fulfils a regulatory requirement — a policy, a technical safeguard or an approval step, for example. Controls connect the abstract obligation with what actually happens in the organisation. Their effectiveness is demonstrated through evidence.

The decision about the country or jurisdiction in which data is stored and processed. For regulated companies it is often a precondition for using AI at all. What matters is that data leaves that boundary only when your policy explicitly allows it.

Regulation (EU) 2022/2554 on digital operational resilience in the financial sector, applicable since 17 January 2025. It covers ICT risk management, reporting of major ICT incidents, resilience testing and the management of ICT third-party providers, among other things. The core technical standards (RTS/ITS) are final.

A two-step consent process: after signing up, for a newsletter for example, the person confirms their consent via a link in an email. This shows that consent really came from the owner of the address. Each step is usually logged with a timestamp so that consent can be demonstrated later.

The European regulation on artificial intelligence, in force since 1 August 2024 and applicable in stages. Bans on certain AI practices and the AI literacy duty have applied since February 2025, and transparency obligations since August 2026. Obligations for standalone high-risk systems under Annex III follow from 2 December 2027.

The official online portal for European Union law, including the Official Journal, regulations, directives and case law. It is one of the primary sources from which new regulatory requirements are detected. Every document there is uniquely addressable by its CELEX number.

Proof that a requirement is met — a document, a log, a configuration or a test result, for example. Good evidence is dated, mapped to a specific requirement and traceable to its source. Auditors do not assess intentions; they assess evidence.

An exportable package of all evidence for an audit subject. In Agentic360 this is, for example, the audit pack of a compliance scan: management report, findings, audit trail and control owners as PDF and CSV, with a manifest that lists a SHA-256 value for every file. Instead of gathering documents before the audit, you hand over a finished bundle.

The systematic comparison of your existing processes and controls with the requirements of a regulation. The result is a prioritised list of gaps that need closing. A grounded reference process, such as a blueprint, makes a good benchmark.

The EU regulation on the protection of personal data. It covers, among other things, the legal bases for processing, data subject rights such as access and erasure, data processing agreements and data protection impact assessments. For AI applications it matters most for training, input and output data.

A safeguard that checks at runtime what an AI system may output or do. Guardrails redact personal data, fend off manipulation attempts or block unsupported statements, for example. In Agentic360 they stop fabricated regulatory citations from leaving the platform.

Fabricated or unsupported output from a language model that sounds plausible but is wrong — a statutory article that does not exist, for example. In compliance this is especially risky, because false citations can flow into decisions and evidence. Remedies include grounding in sources (RAG), thresholds for uncertain answers and guardrails.

Continuous monitoring of legislators and supervisory authorities to detect new or changed requirements early. Good horizon scanning does not just report news; it maps changes to the affected regulations and business areas. It is the first step of the regulatory lifecycle.

The principle that consequential decisions are reviewed and approved by a person before they take effect. An AI system prepares, assesses and explains; accountability stays with the responsible person. Uncertain cases are escalated instead of being decided automatically.

The staged duty to report significant security incidents to the supervisor within fixed deadlines. Under NIS2 and the BSIG that means an early warning within 24 hours, a notification within 72 hours and a final report after one month. DORA requires, for major ICT incidents, an initial notification after 4 or 24 hours, an intermediate report after 72 hours and a final report after one month.

The combination of policies, processes, roles and controls through which an organisation steers its information security. Risk treatment, policy ownership and management review remain the organisation’s responsibility. A RegTech platform does not replace the ISMS; it provides evidence for it.

The international standard for information security management systems (ISMS). It describes how an organisation systematically plans, implements, monitors and improves information security. Agentic360 is ISO 27001-aligned and supports evidence collection, but is not itself ISO 27001-certified and does not issue certifications.

The German umbrella term for facilities whose failure would have serious consequences for society, for example in energy, water, health or finance. Operators of critical facilities face additional duties under the BSIG: they run attack detection systems and prove the implementation of their measures to the BSI every three years.

Identifying and verifying customers before a business relationship begins. This includes verifying identity from reliable, independent sources, determining beneficial owners and screening against sanctions lists. KYC is a core building block of anti-money laundering.

A large model that understands and generates text. LLMs can run in the cloud or locally on your own infrastructure — often decisive for sensitive data. For compliance tasks their outputs should be bound to cited sources.

A BaFin circular setting minimum requirements for credit institutions’ risk management, currently in the version of circular 06/2024. MaRisk is modular (AT, BT, BTO, BTR) and ranges from risk-bearing capacity (ICAAP) through outsourcing to interest rate risk in the banking book (IRRBB). For DORA institutions its IT requirements overlap with DORA.

An open standard for connecting AI agents to external tools and data sources. An MCP server exposes tools that an agent is allowed to call. In regulated environments these calls should be authorised, rate-limited and logged per tenant.

The central orchestration service of Agentic360. It detects the intent of a request, selects the right specialist agent and coordinates several agents for complex tasks. Every routing decision stays traceable.

A group of specialist AI agents instead of a single do-everything AI. Each agent handles a clearly defined task, such as compliance assessment, research or audit preparation. This improves accuracy and control, because every subtask can be checked on its own.

The EU directive for a high common level of cybersecurity, transposed in Germany by the BSIG, in force since 6 December 2025. It requires essential and important entities to take risk management measures, register with the BSI and follow a staged reporting chain. Management must implement and oversee the measures.

A structured inventory of every regulatory obligation that applies to an organisation — each with its source, owner, deadline and mapped controls. It is the link between legal text and implementation. Without one, it remains unclear which requirement is met by what.

Running software entirely in your own data centre, behind your own firewall. Models, vector store and workflows run on infrastructure you control. Organisations choose this model when their data must not leave the building.

An open-source policy engine that evaluates rules written in the Rego language and derives access or approval decisions from them. OPA separates decision logic from application code. This makes policies versionable, testable and reviewable.

The practice of writing policies as machine-readable code rather than as documents alone. Such a policy is evaluated automatically on every request, is versioned and can be tested like software.

An attack that smuggles manipulated instructions into a language model’s input to change its behaviour. In the indirect variant, the instructions hide in documents or web pages the system processes. Defences strictly separate trusted instructions from external content.

The verifiable origin of an output: which agent produced it, with which model and based on which sources. In Agentic360 every answer names its sources – the document and, where available, section or page, excerpt and document version – and can be exported as an audit PDF with agent, model and guardrail status. Provenance turns an AI answer into auditable evidence.

A technique in which a language model retrieves relevant documents before answering and grounds its answer in them. The answer therefore points to concrete, verifiable passages instead of general model knowledge. RAG is the foundation of source-cited answers.

The inventory of all contractual arrangements with ICT third-party providers that DORA makes mandatory. Its form and content are set out in implementing standard ITS 2024/2956. The register is the basis for managing third-party risk and for concentration checks.

Software that helps organisations detect, assess and implement regulatory requirements and prove that they are met. Modern RegTech platforms combine regulatory knowledge, automation and AI. What matters is that every result stays traceable to its source.

The recurring sequence through which a requirement moves from legal text to evidence: detect, assess, implement, prove. Every new requirement passes through these steps, and every change starts the cycle again. RegTech platforms address each of the four steps.

Second-level (Level 2) legal acts that specify the technical details of a basic act. They define, for example, how incidents are classified or registers are kept. For DORA all core mandates are final, such as RTS 2024/1774 on ICT risk management.

AI applications used in an organisation without being recorded, assessed or owned — freely available chat tools or autonomous agents, for example. Shadow AI is a governance and data protection risk because nobody knows which data flows where. The first step is a complete AI inventory.

The strict separation of the data, users, agents and policies of different customers on a shared platform. In Agentic360 every tenant gets its own key, its own index and its own audit log. No tenant can access another tenant’s data.