Glossary

Regulation or directive?

The most common source of confusion in EU law. Both are passed by the EU legislature, but they work in completely different ways. A regulation applies directly, the same across the whole EU and from its first day of applicability; a Czech act only adds supervision and penalties on top. A directive is an assignment for the states; in practice it reaches you only through the Czech act that implements it within the deadline. That is why GDPR and the AI Act are read straight from EUR-Lex, while for directives you look for the Czech implementing act.

EU law

Continental (civil-law) system

The legal tradition of the Czech Republic and most of continental Europe, and the background to everything on this site. The rules live in written, systematic codes: a civil code, a criminal code, procedural codes. A court's task is to apply the code. Court decisions guide how it is read, and the higher courts carry real weight, but a single decision does not bind future cases the way precedent binds in common law. That is why the law here is cited by section (§) of a code, not by case name, and why "case law" (judikatura) means a line of decisions read together rather than a rule in its own right.

Regulation

An EU act that applies directly and uniformly across the whole EU, without being converted into a national act. Rights and obligations follow from it directly (GDPR, AI Act); national acts only accompany it.

Directive

It binds the states to a result; each state chooses the path through its own act within a set deadline. In practice, what governs is therefore the wording of the Czech transposition act, not the directive itself.

Decision

A binding act addressed to a specific recipient, a state or a particular entity. For example, a Commission decision on adequate protection for data transfers under Art. 45 GDPR.

Direct applicability

A property of a regulation. Courts and authorities apply it with no intermediary, and an individual can invoke it directly.

Transposition

Converting a directive into national law through a state's own act within the deadline the directive sets.

Adaptation act

A national supplement to a regulation. A regulation is not transposed; the state only adds authorities, procedures and penalties. For GDPR this is Act No. 110/2019 Coll.; the Czech act for the AI Act is still going through the legislature (state of the Czech adaptation).

Recital

The numbered preamble of an act. It is not a binding rule, but it is the main guide for interpreting the articles.

Delegated act

A Commission act adopted on an authorisation given in a regulation; it amends or supplements less essential parts (for example, Annex III of the AI Act under Art. 7). Parliament and the Council can veto it.

Implementing act

A Commission act for uniform implementation (templates, procedures), adopted through committees of the member states (comitology).

Official Journal of the EU

The official place where EU law is published. Publication in the Journal starts the clock on the dates of entry into force and of applicability.

EUR-Lex and CELEX

The EU law database and the single identifier of a document. The AI Act has CELEX 32024R1689, GDPR 32016R0679.

Trilogue

Informal negotiation between Parliament, the Council and the Commission over the final wording of an act. This is where the “political agreements” are struck that the two institutions then formally approve (most recently the digital omnibus package, agreed 7 May 2026, published 24 July 2026).

AI Act

AI system

Software that infers outputs from inputs with some degree of autonomy and possible adaptiveness (Art. 3). This definition decides whether a tool falls under the AI Act at all.

Provider

Whoever develops a system (or has it developed) and places it on the market under their own name. Carries the largest bundle of obligations (Art. 16).

Deployer

Whoever uses a system in the course of a professional activity. The most common role for an ordinary business (Art. 26).

General-purpose AI model (GPAI)

A foundation model usable for a wide range of tasks (GPT, Claude). It has its own regime in Chapter V (Art. 53).

Systemic risk

A property of the most capable general-purpose models: a training-compute threshold of 10^25 FLOPs or designation by the Commission (Art. 51). It triggers stricter obligations.

High-risk system

A use listed in Annex III (recruitment, credit, justice and more) or a safety component of a product from Annex I. It may reach the market only with risk management, documentation, human oversight and a conformity assessment (Art. 6).

Prohibited practices

Uses of AI that are banned outright, from subliminal manipulation to social scoring (Art. 5). Regulation (EU) 2026/1744 added two more, so from 2 December 2026 there are ten.

Transparency (Art. 50)

The duty to disclose a chatbot, to mark synthetic content in a machine-readable way, and to label deepfakes (Art. 50).

Deepfake

An image, sound or video created or altered by AI so that it appears genuine. Whoever deploys one must disclose its artificial origin.

Regulatory sandbox

A controlled environment for developing and testing AI under the supervision of the authorities, producing records usable in a conformity assessment (Art. 57).

Conformity assessment and CE marking

Verifying the requirements before a system reaches the market, either by internal checks or with a notified body, ending in the CE marking (Art. 43 and Art. 48).

Harmonised standard

A technical standard whose adoption creates a presumption of compliance with the legal requirements (Art. 40). The standards for the AI Act are written by the European committee JTC 21.

FRIA

A fundamental-rights impact assessment before deploying a high-risk system, mandatory for public bodies and, among others, banks and insurers (Art. 27). The younger sibling of the GDPR's DPIA.

AI Office

A department of the European Commission: direct supervision of general-purpose models and the centre for uniform interpretation (Art. 64).

Digital omnibus package

Regulation (EU) 2026/1744 of 8 July 2026, published on 24 July 2026. It pushed back the start of the high-risk obligations, rewrote Art. 4 on AI literacy and added two new prohibitions to Art. 5 (timeline).

GDPR

Personal data

Any information about an identified or identifiable natural person, including indirectly (Art. 4). A photo, an e-mail, an IP address, a voice.

Special categories of data

Sensitive data (health, biometrics for identification, beliefs, orientation and more). Processing it is prohibited in principle; Art. 9 lists the exceptions.

Data subject

The person whose data is at stake. The holder of the rights in Chapter III (access, rectification, erasure, objection and more).

Controller

Determines the purposes and means of the processing and carries the main responsibility (Art. 24).

Processor

Processes data for the controller under a contract per Art. 28 (an external accountant, hosting, an agency).

Legal basis

One of the six grounds that make processing lawful (Art. 6). The first question in any analysis of processing.

Legitimate interest and the balancing test

A legal basis conditioned on a written weighing of the controller's interest against the rights of data subjects (an LIA). A template for the test is among the GDPR templates.

Consent

A freely given, specific and informed expression of will, demonstrable and as easy to withdraw as it was to give (Art. 7). You reach for it only when no other legal basis fits.

DPIA

A data protection impact assessment for processing that is likely to be high-risk (Art. 35).

Data protection officer (DPO)

Independent oversight of data protection inside an organisation, mandatory for public authorities and for large-scale monitoring (Art. 37).

Personal data breach

An incident involving personal data (a leak, a loss, unauthorised access). It is reported to the ÚOOÚ within 72 hours (Art. 33).

Data portability

The right to receive your data in a machine-readable format and transfer it to another controller (Art. 20).

ÚOOÚ

The Office for Personal Data Protection, the Czech supervisory authority (Pplk. Sochora 27, 170 00 Prague 7). It accepts complaints free of charge.

EDPB

The European Data Protection Board. It unifies interpretation, issues guidelines, and makes binding decisions in disputes between supervisory authorities (Art. 68).

AI in practice

Large language model (LLM)

A model trained on text that predicts the likely continuation. The basis of today's chatbots.

Hallucination

A plausible-sounding but false output. A systemic property of language models, not an occasional glitch, which is why facts from a model are verified against a source.

Prompt (input) and output

The instruction given to a model and the content it generates. What does not belong in a prompt, and who owns the output, is summed up in a practical note.

RAG

Retrieval-augmented generation, generation grounded in search. For a query the model is given a few semantically similar snippets from a database and answers over them. The most common way to “give AI your documents”, but in law semantic similarity is not the same as legal relevance and hallucinations persist. A comparison with other approaches is in a note on verified data.

MCP

Model Context Protocol, a standard through which a model calls tools in real time and receives structured data (case law, statutes, registers). The server runs locally or remotely; with a remote one, data leaves your environment (a question for GDPR) and dependence on the vendor grows. Being up to date is a property of the connected source, not of the protocol. An analysis is in a note on verified data.

Skill (Agent Skill)

A single capability or action that an AI agent loads only once it is relevant to the task. In Claude it is a folder with a SKILL.md file (name, description, instructions, optionally scripts), with progressive loading so it takes up context only when used. OpenAI Codex has “skills” too, as a lightweight function-level extension. The word “skill” was popularised by Amazon (Alexa Skills); today it is shared by the coding agents Claude Code and Codex. Consumer Gemini and ChatGPT call it something else (Gems, GPTs).

Plugin

A package that bundles several things at once, skills, app integrations and MCP servers, and installs from a marketplace with the /plugin command. Where a skill is a single capability, a plugin is a way to package, version and hand out capabilities. Claude Code and OpenAI Codex share almost the same form of it, so it is a convention of coding agents, not one company's brand. “Plugin” is otherwise a general IT term (browsers, WordPress). The older consumer ChatGPT plugins were a different thing and were discontinued in 2024.

Unauthorized practice of law

Providing legal services without authorisation under the Advocacy Act. How the concept bends around AI is tracked by the research map.

AI literacy

The duty to give the people working with AI a sufficient level of knowledge (Art. 4 of the AI Act). It has applied since 2 February 2025, even to entities that only use AI. An open AI-literacy course serves to meet it free of charge.

Vibe lawyering

Running legal work with generative AI through intent expressed in natural language, after the model of “vibe coding” from software development. It covers two situations: laypeople have chatbots write filings and arguments without a lawyer (courts then deal with invented citations and defective filings), and lawyers have AI assemble drafts toward a goal instead of from detailed instructions, with human verification and responsibility at the end. The Economist brought the term to wider attention (June 2026); the trend and its risks are summed up in the TL;DR digest.

The glossary grows with the site. Missing a term you keep running into elsewhere? It will be added in the next revision.