AI
Inference
Inference is the running of a trained AI model to produce answers, as distinct from training, which is the one-off process of building the model.
The distinction drives the economics: training is a large capital event, inference is a permanent operating cost that scales with every user. When a company reports "compute costs", the split between the two is the number that matters.
Frontier model
A frontier model is an AI model at or near the current limit of demonstrated capability, typically the flagship systems of the handful of laboratories able to train one.
The term carries regulatory weight: the EU AI Act and the voluntary commitments brokered by governments attach specific obligations to models above defined capability or compute thresholds, so whether a model is "frontier" can decide which rules bind it.
GPAI (general-purpose AI) model
A GPAI model, in EU law, is an AI model that displays significant generality and can perform a wide range of tasks regardless of how it is placed on the market.
It is the EU AI Act's term of art for foundation models. GPAI obligations - documentation, copyright policy, training-data summaries, and for systemic-risk models more - took effect on 2 August 2025, on a separate clock from the Act's other provisions.
Hallucination
A hallucination is an AI model's confident statement of something false: fabricated facts, citations, quotations or events presented in the same fluent register as accurate output.
It is a structural property of how language models generate text, not an occasional bug. It is the reason answer engines weight sources that state facts checkably, and the reason this Journal ties every claim to a source it actually consulted.
Token
A token is the unit in which a language model reads and writes text, typically a word fragment of about four characters in English.
AI usage and pricing are metered in tokens, and a model's context window - how much it can consider at once - is a token count. Roughly, 1,000 tokens is 750 English words, though the ratio varies by language.
Infrastructure
Hyperscaler
A hyperscaler is a cloud provider operating data-center capacity at global scale - the term in practice means Amazon Web Services, Microsoft Azure, Google Cloud, and a small number of comparable platforms.
The word matters in European procurement and regulation because dependence on a non-EU hyperscaler is exactly what sovereignty rules and the EU Data Act's switching provisions are written about.
Sovereign cloud
A sovereign cloud is cloud infrastructure whose data, operations and legal exposure are guaranteed to remain under a specific jurisdiction's control.
The guarantee is legal as much as technical: a data center on EU soil operated by a US-controlled entity can still be within reach of US law, which is why genuine sovereignty claims turn on ownership and operating control, not geography alone.
Colocation
Colocation is renting space, power and cooling in someone else's data center for hardware you own and control.
It sits between owning a building and renting cloud capacity: you keep control of the machines and their data, without the capital cost of the facility. Power availability, not floor space, is what constrains colocation capacity today.
Bare metal
Bare metal is a physical server dedicated to one customer, with no virtualization layer between the hardware and the workload.
It is chosen when performance must be predictable, when licensing or compliance forbids shared hardware, or when the workload - AI training among them - needs the whole machine. The trade-off is elasticity: capacity changes are measured in days, not seconds.
HBM (high-bandwidth memory)
HBM is stacked memory placed directly beside a processor to feed it data far faster than conventional memory can.
It is the scarcest component in AI accelerators: production capacity for HBM, more than for the processors themselves, has repeatedly set the ceiling on how many AI chips ship. Memory pricing cycles now move AI infrastructure costs directly.
LEO (low Earth orbit) connectivity
LEO connectivity is satellite internet served from constellations orbiting a few hundred kilometres up, low enough for latency comparable to terrestrial broadband.
It made usable connectivity possible where fibre never reaches - at sea, in the air, in remote operations. The constellation, not the dish, is the product: coverage and capacity are set by how many satellites are overhead at once.
Cybersecurity
Zero-day
A zero-day is a vulnerability exploited before the vendor knows it exists, so no patch is available on the day attacks begin.
The name counts the days defenders have had to respond: zero. Once disclosed and patched it stops being a zero-day, which is why the term describes a window in time, not a class of bug.
CVE
A CVE is the standard public identifier for a specific security vulnerability, issued so that every vendor, researcher and tool refers to the same flaw by the same name.
Format: CVE-2026-12345. The existence of a CVE means the flaw is catalogued, not that it is fixed - and a vulnerability without a CVE, as with some vendor-silent mobile flaws we have covered, is harder to track precisely because it lacks the shared name.
Ransomware
Ransomware is an attack that encrypts or steals an organization's data and demands payment to restore it or to withhold publication.
Modern operations are staged: initial access is often bought from a separate broker, data is exfiltrated before encryption, and the ransom is priced against the victim's revenue. Recovery time, not the ransom itself, is usually the larger cost.
Supply-chain attack
A supply-chain attack compromises its real target indirectly, by first compromising a supplier - a software dependency, a vendor, a build system - that the target already trusts.
It defeats the perimeter by arriving through the front door with valid credentials. The defence is unglamorous: knowing what you depend on, and verifying what you install.
Regulation
EU AI Act
The EU AI Act is the European Union's regulation of artificial intelligence, in force since 1 August 2024, with obligations phasing in by risk class through 2027.
Prohibited practices applied from February 2025, GPAI-model duties from August 2025, and most high-risk-system rules from August 2026 onward. It applies to any provider placing AI on the EU market, wherever the provider is based - which is why non-EU laboratories negotiate with Brussels.
GDPR
The GDPR is the EU's data-protection regulation: it governs how organizations collect, process and store personal data of people in the EU, wherever the organization itself sits.
Its enforcement lever is scale - fines up to 4% of global revenue - and its consent rules are why the web asks before setting cookies. For AI, the open question it keeps producing is the lawful basis for training on personal data.
Data residency
Data residency is a requirement that data be stored and processed within a specific geography.
Residency alone is weaker than sovereignty: it fixes where the data sits, not who can be compelled to hand it over. Contracts that promise residency while the operator remains subject to foreign law are the gap most sovereignty disputes live in.