欧盟《人工智能法案》第 3(1) 条定义的、以机器为基础、具备不同程度自主性、可从输入推断生成预测、内容、建议或决策等输出的系统。
A machine-based system defined in Art. 3(1) of the EU AI Act that operates with varying levels of autonomy and infers, from the input it receives, how to generate outputs such as predictions, content, recommendations or decisions.
欧盟《人工智能法案》第 3(63) 条定义的模型：具有显著通用性、能胜任广泛不同任务、可集成到多种下游系统或应用，纯研究与原型阶段的模型除外。
A model defined in Art. 3(63) of the EU AI Act that displays significant generality, can competently perform a wide range of distinct tasks and can be integrated into a variety of downstream systems, excluding models used only for research, development or prototyping.
欧盟《人工智能法案》第 51 条下被认定具备"高影响能力"的通用模型；第 51(2) 条规定训练累计算力超过 10^25 次浮点运算即推定具备该能力。
A general-purpose AI model classified under Art. 51 of the EU AI Act as having high-impact capabilities; Art. 51(2) presumes such capabilities when cumulative training compute exceeds 10^25 floating-point operations.
开发（或委托开发）AI 系统或通用模型，并以自己名义或商标将其投放市场或投入使用的自然人或法人，无论是否收费。
A person or body that develops (or has developed) an AI system or GPAI model and places it on the market or puts it into service under its own name or trademark, whether for payment or free of charge.
在其授权下使用 AI 系统的自然人或法人，个人非职业性使用除外（AI 法案第 3(4) 条）。
A person or body using an AI system under its authority, except where the use is a personal non-professional activity (AI Act Art. 3(4)).
位于或设立于欧盟境内、接受 AI 系统或通用模型提供者书面委托、代其履行本法规定义务与程序的自然人或法人。
A natural or legal person located or established in the Union who has accepted a written mandate from a provider of an AI system or GPAI model to perform the obligations and procedures laid down in the Regulation on its behalf.
AI 系统或通用模型在欧盟市场上的首次提供（AI 法案第 3(9) 条）。
The first making available of an AI system or a general-purpose AI model on the Union market (AI Act Art. 3(9)).
欧盟《人工智能法案》第 6 条界定的两类系统：作为受欧盟产品法规约束产品的安全部件（附件一），以及用于附件三所列敏感场景（生物识别、关键基础设施、教育、就业、执法、移民等）的系统。
The two categories set out in Art. 6 of the EU AI Act: AI used as a safety component of products covered by Union product legislation (Annex I), and AI used in the sensitive Annex III use cases (biometrics, critical infrastructure, education, employment, law enforcement, migration and others).
AI 法案第 3(20) 条定义的程序：证明高风险 AI 系统已满足第三章第二节所列要求；可采用内部控制，或在特定情形下由公告机构参与。
The process defined in Art. 3(20) of the AI Act for demonstrating that a high-risk AI system fulfils the requirements in Chapter III, Section 2 — via internal control or, in specified cases, with a notified body.
提供者据以表明产品符合欧盟协调立法要求的标志；在 AI 法案下表明高风险 AI 系统符合第三章第二节要求（第 3(24)、48 条；通则见条例 (EC) No 765/2008）。
The marking by which a provider indicates conformity with applicable Union harmonisation legislation — under the AI Act, conformity of a high-risk AI system with Chapter III, Section 2 (Arts. 3(24) and 48; general principles in Regulation (EC) No 765/2008).
AI 法案第 27 条要求特定部署者在使用高风险 AI 系统前开展的评估，识别对受影响人群基本权利的具体风险及应对措施。
The assessment required by Art. 27 of the AI Act from certain deployers before using a high-risk AI system, identifying the concrete risks to affected persons’ fundamental rights and the mitigations.
AI 法案第 3(56) 条定义的技能、知识与理解，使提供者、部署者与受影响人能就 AI 的部署作出知情判断并认识其机会与风险。
The skills, knowledge and understanding defined in Art. 3(56) of the AI Act that allow providers, deployers and affected persons to make informed decisions about AI deployment and to be aware of its opportunities and risks.
AI 法案第 5 条列举的、在欧盟境内一律禁止投放、投入使用或使用的 AI 实践（如潜意识操纵、社会评分、特定实时远程生物识别等）。
The AI practices listed in Art. 5 of the AI Act that may not be placed on the market, put into service or used in the Union at all (for example subliminal manipulation, social scoring and certain real-time remote biometric identification).
AI 法案第 50(2) 条要求生成合成音频、图像、视频或文本的 AI 系统提供者，确保输出以机器可读格式标记并可被检测为人工生成或篡改。
Art. 50(2) of the AI Act requires providers of AI systems generating synthetic audio, image, video or text to ensure outputs are marked in a machine-readable format and detectable as artificially generated or manipulated.
内容来源与真实性联盟（C2PA）制定的开放技术规范，以密码学签名的清单记录媒体内容的来源与编辑历史。
An open technical specification from the Coalition for Content Provenance and Authenticity that records the source and edit history of media in a cryptographically signed manifest.
AI 法案第 3(49) 条定义"严重事件"为直接或间接造成特定严重后果的 AI 系统事件或故障；第 73 条要求高风险系统提供者向市场监督机关报告。
Art. 3(49) of the AI Act defines a serious incident as an incident or malfunctioning of an AI system that directly or indirectly leads to specified severe consequences; Art. 73 requires providers of high-risk systems to report it to market surveillance authorities.
AI 法案第 3(55) 条定义的受控框架：由主管机关设立，供提供者在监管监督下按沙盒计划在限定期间内开发、训练、验证与测试创新 AI 系统，必要时可在真实条件下进行。
A controlled framework defined in Art. 3(55) of the AI Act, set up by a competent authority so providers can develop, train, validate and test an innovative AI system — where appropriate in real-world conditions — under regulatory supervision for a limited time.
AI 法案第 53(1)(d) 条要求通用模型提供者按欧盟 AI 办公室模板，编制并公开关于训练所用内容的充分详细摘要。
Art. 53(1)(d) of the AI Act requires GPAI providers to draw up and make publicly available a sufficiently detailed summary of the content used for training, following a template provided by the AI Office.
AI 法案第 53(1)(c) 条要求通用模型提供者建立遵守欧盟版权法的政策，并以最新技术识别与遵守依《指令 (EU) 2019/790》第 4(3) 条作出的权利保留。
Art. 53(1)(c) of the AI Act requires GPAI providers to have a policy to comply with Union copyright law, including identifying and respecting rights reservations expressed under Art. 4(3) of Directive (EU) 2019/790 using state-of-the-art technology.
高风险 AI 系统按附件四、通用模型按附件十一编制的文档集合，涵盖系统描述、设计与开发、数据、评测结果与风险管理。
The documentation set required for high-risk AI systems under Annex IV and for GPAI models under Annex XI, covering system description, design and development, data, evaluation results and risk management.
行业通行的模型说明文档，结构化描述模型用途、能力与局限、评测结果与已知风险；在欧盟对应 AI 法案附件十二要求向下游提供者提供的信息。
An industry-standard model documentation artefact describing intended use, capabilities and limitations, evaluation results and known risks; in the EU it maps to the information for downstream providers required by Annex XII of the AI Act.
记录数据集来源、采集方式、覆盖人群、标注流程、已知偏差与使用限制的结构化文档；对应 AI 法案第 10 条数据治理与附件四的数据描述要求。
Structured documentation of a dataset’s provenance, collection method, population coverage, labelling process, known biases and use restrictions; it maps to the data-governance duties in Art. 10 and the data description in Annex IV of the AI Act.
由内部或独立外部团队主动尝试诱发模型有害输出与失效模式的结构化测试；AI 法案要求具系统性风险的通用模型提供者开展并记录对抗性测试。
Structured testing in which internal or independent external teams actively try to elicit harmful outputs and failure modes; the AI Act requires providers of GPAI models with systemic risk to conduct and document adversarial testing.
业界用语，指处于能力最前沿、可能带来大规模新型风险的通用模型；欧盟法律上没有该术语，最接近的法定概念是"具有系统性风险的通用人工智能模型"。
An industry term for the most capable general-purpose models that may pose novel large-scale risks; EU law does not use it, and the closest legal concept is a "GPAI model with systemic risk".
NIST 发布的自愿性框架，以治理、映射、度量、管理四大职能帮助组织把可信赖性要求嵌入 AI 的设计、开发、使用与评估。
A voluntary NIST framework organised around the Govern, Map, Measure and Manage functions to help organisations build trustworthiness into the design, development, use and evaluation of AI.
国际标准化组织与国际电工委员会发布的人工智能管理体系标准，规定建立、实施、维护与持续改进 AIMS 的要求，可认证。
The ISO/IEC management system standard for artificial intelligence, specifying requirements to establish, implement, maintain and continually improve an AI management system, and certifiable by accredited bodies.
《互联网信息服务算法推荐管理规定》要求具有舆论属性或社会动员能力的算法推荐服务提供者，通过互联网信息服务算法备案系统填报服务提供者、算法类型、自评估报告等信息并公示备案编号。
Under the Provisions on Algorithmic Recommendation, providers of algorithmic recommendation services with public-opinion attributes or social-mobilisation capability must file provider details, algorithm type and a self-assessment report through the national algorithm filing system and publish the filing number.
《生成式人工智能服务管理暂行办法》第十七条要求：提供具有舆论属性或者社会动员能力的生成式人工智能服务的，应当按国家有关规定开展安全评估，并履行算法备案手续。
Art. 17 of the Interim Measures for Generative AI Services requires providers of generative AI services with public-opinion attributes or social-mobilisation capability to carry out a security assessment and complete algorithm filing formalities.
《具有舆论属性或社会动员能力的互联网信息服务安全评估规定》要求：具有舆论属性或社会动员能力的信息服务上线、增设相关功能，或新技术新应用导致相关属性重大变化时，服务提供者应自行开展安全评估并对结果负责。
Under the 2018 Provisions, providers must carry out and stand behind a self-assessment when launching or adding functions to an information service with public-opinion attributes or social-mobilisation capability, or when new technology materially changes those attributes.
《互联网信息服务深度合成管理规定》规范的、利用深度学习与虚拟现实等生成合成算法制作文本、图像、音频、视频、虚拟场景等网络信息的技术与服务。
The technologies and services regulated by China’s Deep Synthesis Provisions that use deep learning, virtual reality and other generative-synthetic algorithms to produce text, images, audio, video or virtual scenes.
《人工智能生成合成内容标识办法》第三条将标识分为两类：显式标识以文字、声音、图形等方式呈现且用户可明显感知；隐式标识以技术措施加入文件数据、不易被用户明显感知。
Art. 3 of China’s Labelling Measures splits labels into explicit labels — text, audio or graphics that users can clearly perceive — and implicit labels added to the file data by technical means and not readily perceptible.
《人工智能拟人化互动服务管理暂行办法》第二条定义：利用人工智能技术向境内公众提供的、模拟自然人人格特征、思维模式和沟通风格的持续性情感互动服务（情感照护、陪伴、支持等）。
Art. 2 of the Interim Measures defines it as continuous emotional-interaction services offered to the Chinese public that simulate a natural person’s personality, thinking and communication style — emotional care, companionship and support.
《科技伦理审查办法（试行）》要求：涉及以人为研究参与者、涉及实验动物，以及可能带来伦理风险挑战的科技活动，应当依办法开展伦理审查。
Under the Measures for Science and Technology Ethics Review (Trial), research involving human participants or laboratory animals, and activities that may raise ethical risks, must undergo ethics review.
《生成式人工智能服务管理暂行办法》第七条要求提供者使用具有合法来源的数据和基础模型，不侵害他人知识产权，涉及个人信息的须取得同意或符合其他法定情形。
Art. 7 of China’s Interim Measures requires providers to use lawfully sourced data and foundation models, not to infringe intellectual property, and to obtain consent or another lawful basis where personal information is involved.
GDPR 第 4(7) 条定义：单独或与他人共同决定个人数据处理目的与方式的自然人、法人或机构。
Defined in GDPR Art. 4(7) as the person or body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
GDPR 第 4(8) 条定义：代表控制者处理个人数据的自然人、法人或机构。
Defined in GDPR Art. 4(8) as the person or body which processes personal data on behalf of the controller.
GDPR 第 26 条下两个或以上控制者共同决定处理目的与方式，须以安排明确各自职责并向数据主体提供要点。
Under GDPR Art. 26, two or more controllers that jointly determine the purposes and means of processing must set out their respective responsibilities in an arrangement and make its essence available to data subjects.
GDPR 第 6(1) 条列举的六项处理依据：同意、合同履行、法定义务、重大利益、公共利益或官方权限、合法利益。
One of the six grounds in GDPR Art. 6(1): consent, contract, legal obligation, vital interests, public task, or legitimate interests.
以 GDPR 第 6(1)(f) 条为依据时需完成的三步评估：识别合法利益、论证处理的必要性、在利益与数据主体权利之间做平衡测试。
The three-part test required when relying on GDPR Art. 6(1)(f): identify the legitimate interest, show the processing is necessary, and balance it against the data subject’s rights.
GDPR 第 9 条列举的敏感数据：种族或民族出身、政治观点、宗教或哲学信仰、工会成员身份、基因数据、用于唯一识别的生物识别数据、健康数据、性生活或性取向。
The sensitive data listed in GDPR Art. 9: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for unique identification, health data, and data concerning sex life or sexual orientation.
GDPR 第 35 条要求：处理可能对自然人权利与自由造成高风险时，控制者须在处理前评估处理活动对个人数据保护的影响。
Required by GDPR Art. 35: where processing is likely to result in a high risk to individuals’ rights and freedoms, the controller must assess the impact of the envisaged processing before it starts.
依 EDPB《建议 01/2020》六步法开展的评估：识别传输、选择传输工具、评估第三国法律与实践是否削弱保护、必要时采取补充措施并定期复核。
The six-step assessment set out in EDPB Recommendations 01/2020: map transfers, pick a transfer tool, assess whether third-country law and practice undermine protection, adopt supplementary measures where needed, and re-evaluate periodically.
欧盟委员会实施决定 (EU) 2021/914 通过的模块化条款，作为 GDPR 第 46 条下向第三国传输个人数据的适当保障。
The modular clauses adopted by Commission Implementing Decision (EU) 2021/914 that serve as appropriate safeguards for transfers of personal data to third countries under GDPR Art. 46.
GDPR 第 47 条下由主管监管机关批准的集团内部数据保护政策，可作为集团内跨境传输的适当保障。
Internal data-protection policies approved by a competent supervisory authority under GDPR Art. 47 that provide appropriate safeguards for intra-group transfers.
GDPR 第 45 条下欧盟委员会作出的决定，认定第三国、其境内特定区域或国际组织能提供充分的数据保护水平，据此传输无需额外授权。
A decision by the European Commission under GDPR Art. 45 that a third country, a territory within it, or an international organisation ensures an adequate level of protection, so transfers need no further authorisation.
GDPR 第 12 至 22 条赋予个人的一组权利：知情、查阅、更正、删除、限制处理、可携、反对以及不受纯自动化决策约束。
The bundle of rights in GDPR Arts. 12–22: information, access, rectification, erasure, restriction, portability, objection, and not to be subject to solely automated decisions.
个人依 GDPR 第 15 条行使查阅权，要求确认其数据是否被处理、获取数据副本以及处理目的、类别、接收方、留存期等信息。
An individual exercising the right of access under GDPR Art. 15 to confirm whether their data is processed and to obtain a copy plus information on purposes, categories, recipients and retention.
GDPR 第 22 条规范的、仅基于自动化处理（含画像）并对个人产生法律效果或类似重大影响的决策。
Decisions based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect the individual, regulated by GDPR Art. 22.
GDPR 第 33 条要求控制者在知悉泄露后无不当延迟、且在可行时于 72 小时内向监管机关通报；第 34 条要求在高风险情形下通知数据主体。
GDPR Art. 33 requires controllers to notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware; Art. 34 requires notifying data subjects where the risk is high.
法律要求特定数据在境内存储（必要时出境须经审批）的制度安排；中国《网络安全法》对关键信息基础设施运营者境内收集产生的个人信息和重要数据即设有此类要求。
A legal requirement to store certain data within a jurisdiction, with export subject to approval where permitted at all; China’s Cybersecurity Law imposes this on personal information and important data collected or generated by critical information infrastructure operators.
处理者依 GDPR 第 28(2)、28(4) 条聘用、代其执行部分处理活动的另一处理者；须经控制者事先书面授权（具体或一般授权），且合同义务须逐层传递。
Another processor engaged by a processor under GDPR Arts. 28(2) and 28(4) to carry out part of the processing; it requires the controller’s prior specific or general written authorisation and the same contractual duties must flow down.
GDPR 第 28(3) 条要求的控制者与处理者之间的书面合同，须约定处理的对象、期限、性质与目的、数据类型、数据主体类别以及双方权利义务。
The written contract required by GDPR Art. 28(3) between controller and processor, setting out the subject matter, duration, nature and purpose of processing, the types of data, categories of data subjects, and each party’s rights and obligations.
GDPR 第 4(5) 条定义：以某种方式处理个人数据，使其在不使用单独保存的附加信息时无法归属于特定数据主体，且该附加信息受技术与组织措施保护。
Defined in GDPR Art. 4(5) as processing personal data so it can no longer be attributed to a specific data subject without additional information, which is kept separately and protected by technical and organisational measures.
GDPR 第 30 条要求控制者与处理者维护的书面处理活动清单，载明目的、数据类别、接收方、跨境传输与安全措施等。
The written inventory of processing activities that controllers and processors must maintain under GDPR Art. 30, covering purposes, data categories, recipients, transfers and security measures.
《数据出境安全评估办法》规定的申报制度：数据处理者向境外提供境内运营中收集和产生的重要数据和个人信息，符合规定情形的须经省级网信部门向国家网信部门申报评估。
The filing regime under China’s CBDT Security Assessment Measures: data handlers exporting important data or personal information collected or generated in domestic operations must, in prescribed cases, apply through the provincial cyberspace authority to the national regulator.
《个人信息出境标准合同办法》规定的路径：个人信息处理者与境外接收方订立网信部门制定的标准合同，并向省级网信部门备案。
The route under China’s Standard Contract Measures: the personal information handler signs the CAC-issued standard contract with the overseas recipient and files it with the provincial cyberspace authority.
《个人信息保护认证实施规则》确立的第三方认证路径，认证依据 GB/T 35273 及（涉跨境时）TC260-PG-20222A，认证模式为技术验证＋现场审核＋获证后监督。
The third-party certification route in China’s Implementation Rules, benchmarked against GB/T 35273 and, for cross-border activities, TC260-PG-20222A, using technical verification plus on-site audit plus post-certification supervision.
中国数据分类分级保护制度中的一类数据，由各地区、各部门按行业、领域确定具体目录并对列入目录的数据重点保护。
A category in China’s classified and graded data protection regime; regions and departments determine sector-specific catalogues and give listed data priority protection.
《关键信息基础设施安全保护条例》规范的重要行业和领域的网络设施、信息系统，一旦遭到破坏、丧失功能或数据泄露可能严重危害国家安全、国计民生、公共利益。
Network facilities and information systems in key sectors regulated by China’s CII Regulations, where damage, loss of function or data leakage could seriously endanger national security, the economy, people’s livelihood or the public interest.
PIPL 第五十四条要求个人信息处理者定期对其遵守法律、行政法规的情况进行合规审计；第六十四条允许主管部门在高风险或事件情形下要求委托专业机构审计。
PIPL Art. 54 requires handlers to audit their compliance with laws and administrative regulations on a regular basis, and Art. 64 lets authorities require an audit by a professional institution where risk is high or an incident has occurred.
《网络数据安全风险评估办法》第二条定义：对网络数据和网络数据处理活动安全进行的风险识别、风险分析和风险评价等活动。
Defined in Art. 2 of the 2026 Measures as risk identification, risk analysis and risk evaluation of network data and network data processing activities.
PIPL 在向他人提供、公开、处理敏感个人信息、跨境提供等特定情形下要求的、区别于一揽子告知同意的专门同意。
The distinct consent PIPL requires — separate from bundled notice-and-consent — for specific acts such as providing personal information to others, public disclosure, processing sensitive personal information and cross-border transfer.
美国商务部工业与安全局（BIS）实施的两用物项出口管制规则，编入 15 CFR 第 730 至 774 部分，管辖货物、软件与技术的出口、再出口与国内转移。
The dual-use export control rules administered by the U.S. Bureau of Industry and Security, codified at 15 CFR Parts 730–774, covering exports, reexports and in-country transfers of commodities, software and technology.
15 CFR § 772.1 定义：用于商业管制清单（15 CFR Part 774 附件一）与 EAR 全文的编号，由若干数字与一个字母组成，编码构成见 § 738.2(c)。
Defined in 15 CFR § 772.1 as the number used in Supplement No. 1 to Part 774 and throughout the EAR, consisting of a set of digits and a letter, with its composition described in § 738.2(c).
15 CFR Part 774 附件一所载的受控物项清单，按十大类与五个产品组组织，每个条目对应一个 ECCN 与管制理由。
The list of controlled items in Supplement No. 1 to 15 CFR Part 774, organised into ten categories and five product groups, with each entry carrying an ECCN and its reasons for control.
EAR 项下把受管辖物项从一个境外国家运往另一个境外国家的行为（定义见 15 CFR § 734.14，术语表 § 772.1 指向该条）。
Shipping or transmitting an item subject to the EAR from one foreign country to another, defined at 15 CFR § 734.14 (the § 772.1 glossary cross-references it).
15 CFR § 734.13(a)(2) 与 § 734.13(b) 规定：在美国境内向外国人释放或以其他方式转移"技术"或源代码（不含目标代码），构成出口，并视同向该外国人最近的国籍或永久居留国出口；"释放"的含义另见 § 734.15。
Under 15 CFR § 734.13(a)(2) and § 734.13(b), releasing or otherwise transferring "technology" or source code (but not object code) to a foreign person inside the United States is an export, and is a deemed export to that person’s most recent country of citizenship or permanent residency; "release" itself is defined at § 734.15.
15 CFR § 734.9 规定：位于美国境外、属于特定美国"技术"或"软件"直接产品的外国生产物项，或由此类技术软件的直接产品工厂（或主要部件）生产的物项，受 EAR 管辖。
Under 15 CFR § 734.9, foreign-produced items located outside the United States are subject to the EAR when they are a direct product of specified U.S. "technology" or "software", or produced by a plant or major component that is itself such a direct product.
BIS 维护、编入 15 CFR Part 744 附件四的名单，对被列名实体适用额外许可要求与审查政策（法律依据见 § 744.11 与 § 744.16）。
The BIS list at Supplement No. 4 to 15 CFR Part 744 that imposes additional licence requirements and review policies on named entities (see §§ 744.11 and 744.16).
美国财政部下属机构，负责实施基于国别与主题的经济与贸易制裁项目，并维护特别指定国民与被封锁人员清单（SDN List）。
The U.S. Treasury office that administers country-based and thematic economic and trade sanctions programmes and maintains the Specially Designated Nationals and Blocked Persons (SDN) List.
出口申请中由境外买方或最终用户出具、说明物项最终去向与用途并承诺不作未经许可转用的文件；中国《两用物项出口管制条例》要求申请时提交最终用户有关情况说明。
A document from the overseas buyer or end user describing the item’s ultimate destination and use and undertaking not to divert it; China’s Dual-Use Export Control Regulations require an end-user statement with the licence application.
一国将其法律适用于境外主体与交易的做法；在出口管制语境下主要通过美国成分规则、外国直接产品规则与美国人活动限制实现。
A state applying its law to persons and transactions abroad; in export controls this runs mainly through U.S.-content rules, the Foreign-Direct Product rules and restrictions on U.S.-person activities.
美国跨部门委员会，依 31 CFR Part 800 等规则审查外国人对美国企业的投资与收购是否影响国家安全，可要求缓释措施或建议总统阻止交易。
The U.S. interagency committee that reviews foreign investments in and acquisitions of U.S. businesses for national security under 31 CFR Part 800, and can require mitigation or recommend that the President block a deal.
31 CFR Part 850 建立的制度，对美国人投向"受关注国家"相关方在半导体与微电子、量子信息技术、人工智能等领域的特定交易设定禁止或申报要求。
The regime in 31 CFR Part 850 that prohibits or requires notification of certain U.S.-person investments into covered foreign persons in semiconductors and microelectronics, quantum information technologies and artificial intelligence.
《两用物项出口管制条例》定义：既有民事用途，又有军事用途或有助于提升军事潜力，特别是可用于设计、开发、生产或使用大规模杀伤性武器及其运载工具的货物、技术和服务，包括相关技术资料等数据。
Defined in China’s Dual-Use Export Control Regulations as goods, technologies and services with both civil and military uses, or that help enhance military potential — especially those usable for weapons of mass destruction and their delivery systems — including related technical data.
《两用物项出口管制条例》下由国务院商务主管部门签发的出口许可，分为单项许可（单一最终用户单次出口）、通用许可（同一最终用户多次出口）等类型。
The export licence issued by China’s commerce authority under the Dual-Use Export Control Regulations, in forms including a single licence for one export to one end user and a general licence for repeated exports to the same end user.
《技术进出口管理条例》规定：属于《中国禁止出口限制出口技术目录》限制出口部分的技术实行许可证管理，未经许可不得出口。
Under China’s Technology Import and Export Regulations, technologies in the restricted section of the Catalogue of Technologies Prohibited or Restricted from Export are subject to licensing and may not be exported without one.
在开户、签约、发货与付款等环节，对客户、供应商及其股东与关联方比对各国管制与制裁名单的流程。
The process of checking customers, suppliers and their owners and affiliates against government control and sanctions lists at onboarding, contracting, shipment and payment.
EAR 关于境外制造物项中所含美国受控成分比例的规则：超过规定门槛时该外国物项即受 EAR 管辖（见 15 CFR Part 734 适用范围条款）。
The EAR rule on the proportion of controlled U.S. content in a foreign-made item: above the prescribed threshold the foreign item becomes subject to the EAR (see the scope provisions of 15 CFR Part 734).
交易中提示物项可能被转往受管制最终用户或用途的异常迹象，如与业务不符的采购规格、拒绝提供最终用途信息、异常运输路线等。
Signals in a transaction that an item may be diverted to a controlled end user or end use — order specifications inconsistent with the buyer’s business, refusal to give end-use information, unusual routing and similar.
欧盟 CSRD/ESRS 采用的重要性判定方法：同时从影响重要性（企业对人与环境的影响）与财务重要性（可持续议题对企业的财务影响）两个维度识别应披露议题。
The materiality approach in the EU CSRD/ESRS: topics are identified both from an impact perspective (the company’s effects on people and the environment) and a financial perspective (how sustainability matters affect the company).
由欧盟委员会以授权条例形式通过、供 CSRD 适用主体使用的可持续发展报告准则，第一套见授权条例 (EU) 2023/2772。
The sustainability reporting standards adopted by the European Commission as delegated regulations for CSRD filers; the first set is Delegated Regulation (EU) 2023/2772.
指令 (EU) 2022/2464，要求适用范围内企业按 ESRS 在管理报告中披露可持续发展信息并接受鉴证。
Directive (EU) 2022/2464, requiring in-scope companies to report sustainability information in the management report in line with the ESRS and to have it assured.
IFRS 基金会下设机构，制定以投资者为对象的全球可持续披露基准准则，已发布 IFRS S1 与 IFRS S2。
The IFRS Foundation board that sets a global baseline of investor-focused sustainability disclosure standards; it has issued IFRS S1 and IFRS S2.
ISSB 气候专项准则，要求企业披露可合理预期影响其现金流、融资渠道或资本成本的气候相关风险与机遇，按治理、战略、风险管理、指标与目标四支柱组织。
The ISSB’s climate standard requiring disclosure of climate-related risks and opportunities that could reasonably be expected to affect the entity’s cash flows, access to finance or cost of capital, organised around governance, strategy, risk management, and metrics and targets.
全球报告倡议组织发布的、面向多元利益相关方的影响报告标准体系，由通用标准、行业标准与议题标准组成。
The multi-stakeholder impact reporting standards issued by the Global Reporting Initiative, comprising Universal, Sector and Topic Standards.
《温室气体核算体系 · 企业核算与报告标准》定义的、来自企业拥有或控制的排放源的直接温室气体排放。
Direct greenhouse gas emissions from sources owned or controlled by the company, as defined in the GHG Protocol Corporate Standard.
《温室气体核算体系 · 范围二核算指南》规范的、来自外购或获取的电力、蒸汽、供热与供冷的间接排放。
Indirect emissions from purchased or acquired electricity, steam, heat and cooling, standardised by the GHG Protocol Scope 2 Guidance.
《企业价值链（范围三）核算与报告标准》规范的、发生在企业价值链上下游但不属于范围一、二的其他间接排放。
Other indirect emissions occurring in the company’s upstream and downstream value chain that are not Scope 1 or Scope 2, covered by the GHG Protocol Corporate Value Chain (Scope 3) Standard.
按用电所在电网的平均排放强度核算范围二排放的方法，反映当地电网的物理排放水平。
A Scope 2 accounting method that applies the average emissions intensity of the grid where consumption occurs, reflecting the physical grid mix.
按企业实际采购的电力合同工具（绿证、PPA、供应商特定因子等）核算范围二排放的方法；所用合同工具须满足范围二指南的八项质量标准。
A Scope 2 method based on the contractual instruments a company has purchased (energy attribute certificates, PPAs, supplier-specific factors), where those instruments must meet the eight Scope 2 quality criteria.
代表一定电量可再生属性的可交易凭证，是范围二市场法下用于主张低碳电力的合同工具之一，须满足范围二指南的质量标准。
A tradable instrument representing the renewable attributes of a quantity of electricity, used as a contractual instrument to claim low-carbon power under the Scope 2 market-based method subject to the quality criteria.
企业与发电方签订的长期购电合同，可为实体交割或虚拟（差价）结构，通常同时转让能源属性证书用于范围二市场法核算。
A long-term contract between a buyer and a generator, structured as physical or virtual (contract-for-difference), typically transferring the energy attribute certificates used for market-based Scope 2 accounting.
单位活动量（如每单位营收、每单位产品、每千瓦时电力）对应的温室气体排放量，是强度型目标与对标的基础指标。
Greenhouse gas emissions per unit of activity — per unit of revenue, per unit of product, per kilowatt-hour — the base metric for intensity targets and benchmarking.
欧盟条例 (EU) 2023/956 建立的机制，通过对进口商品的隐含碳排放定价来应对碳泄漏，与欧盟排放交易体系相配套。
The mechanism established by Regulation (EU) 2023/956 that addresses carbon leakage by pricing the embedded emissions of imported goods, complementing the EU Emissions Trading System.
为企业设定与气候科学一致的减排目标提供框架与验证服务的倡议，其《企业净零标准》是企业净零目标设定的主流基准。
An initiative providing a framework and validation service for corporate emission reduction targets aligned with climate science; its Corporate Net-Zero Standard is the mainstream benchmark for corporate net-zero targets.
由独立鉴证机构对可持续发展报告信息出具结论的程序；CSRD 要求在管理报告中披露的可持续信息接受鉴证。
A procedure in which an independent practitioner issues a conclusion on reported sustainability information; the CSRD requires assurance of the sustainability information in the management report.
在若干种未来气候与政策情景下评估企业战略与商业模式韧性的方法；IFRS S2 要求企业运用与其情况相称的气候相关情景分析评估气候韧性。
A method for assessing the resilience of strategy and business model under alternative climate and policy futures; IFRS S2 requires climate resilience to be assessed using scenario analysis commensurate with the entity’s circumstances.
企业说明如何调整业务、资本配置与运营以实现气候目标的行动计划，需与已披露的目标、时间表与资源投入相衔接。
A plan setting out how the entity will adjust its business, capital allocation and operations to meet its climate targets, linked to disclosed targets, timelines and resourcing.
全球最广泛采用的企业温室气体核算与报告标准体系，企业标准覆盖《京都议定书》所列七种温室气体，2015 年以范围二指南补充电力核算。
The most widely used corporate greenhouse gas accounting and reporting framework; the Corporate Standard covers the seven Kyoto gases and was supplemented in 2015 by the Scope 2 Guidance for electricity.
由注册会计师依 AICPA 信任服务标准出具的服务机构控制报告，针对安全性、可用性、处理完整性、保密性与隐私五项标准中被选定者发表意见。
A service organisation controls report issued by a CPA firm under the AICPA Trust Services Criteria, opining on the selected criteria among security, availability, processing integrity, confidentiality and privacy.
国际标准化组织与国际电工委员会发布的信息安全管理体系要求标准，可由认可的认证机构颁发证书。
The ISO/IEC standard specifying requirements for an information security management system, certifiable by accredited certification bodies.
云安全联盟发布的标准化云服务商安全问卷，内嵌于云控制矩阵（CCM），以是非题形式覆盖各控制域；自 v4.1 起 CCM 与 CAIQ 合并发布。
The Cloud Security Alliance’s standardised questionnaire for cloud providers, built into the Cloud Controls Matrix as yes/no questions across control domains; CCM and CAIQ have been published together since v4.1.
在授权范围内模拟攻击者行为、主动尝试利用系统漏洞以验证实际可被攻破程度的安全测试。
Authorised security testing that simulates attacker behaviour and actively attempts to exploit vulnerabilities in order to verify real exploitability.
NIST SP 800-207 提出的网络安全范式：不基于网络位置授予隐式信任，每次资源访问都按策略动态评估身份、设备状态与上下文后最小授权。
The cybersecurity paradigm in NIST SP 800-207: no implicit trust based on network location; every resource access is evaluated dynamically against identity, device posture and context and granted least privilege.
NIST SP 800-57 规范的密码密钥全生命周期管理：生成、分发、存储、使用、轮换、归档与销毁，以及相应的职责分离与访问控制。
The full lifecycle management of cryptographic keys standardised in NIST SP 800-57 — generation, distribution, storage, use, rotation, archival and destruction — with the matching separation of duties and access controls.
客户自行生成并控制加密密钥、由服务方在受限条件下调用（BYOK），或密钥完全不离开客户环境（HYOK）的密钥托管安排。
Key custody arrangements where the customer generates and controls the encryption keys and the provider invokes them under constraints (BYOK), or where keys never leave the customer’s environment at all (HYOK).
针对软件从依赖引入、构建、签名到分发全链条的完整性与可追溯性保障，核心手段包括物料清单、构建来源证明与签名验证。
Protecting the integrity and traceability of software from dependency intake through build, signing and distribution, using tools such as bills of materials, build provenance attestations and signature verification.
CISA 表述为软件组成成分的"嵌套清单"，逐层列出构成软件的组件及其版本与关系，用于软件安全与供应链风险管理。
Described by CISA as a nested inventory — a list of ingredients that make up software components — used for software security and supply chain risk management.
接收、验证、修复并对外沟通产品安全漏洞的流程，通常包含公开的联络渠道、响应时限承诺与协调披露政策。
The process for receiving, validating, remediating and communicating product security vulnerabilities, typically with a published contact channel, response-time commitments and a coordinated disclosure policy.
从检测、分级、遏制、根除到恢复与复盘的事件处置流程，并衔接对外的监管通报与客户通知义务。
The lifecycle of detection, triage, containment, eradication, recovery and post-incident review, wired into external regulatory notification and customer notice duties.
只授予主体完成其任务所必需的最小访问权限与最短授权时长的安全原则，是零信任架构的核心要求之一。
The principle of granting a subject only the minimum access needed to perform its task, for the shortest necessary duration; a core requirement of zero trust architecture.
以合同或技术方式约定数据静态存储所在的地理区域；与法定的数据本地化不同，它通常是商业承诺而非法律强制。
A contractual or technical commitment about the geography in which data is stored at rest; unlike statutory data localisation it is usually a commercial promise rather than a legal mandate.
《网络安全法》确立的中国网络安全等级保护制度：网络运营者按网络等级履行相应安全保护义务。
China’s graded cybersecurity protection regime established by the Cybersecurity Law, under which network operators perform security duties matched to the assigned protection level.
《网络安全审查办法》第二条规定的国家安全审查：关键信息基础设施运营者采购网络产品和服务、网络平台运营者开展数据处理活动，影响或者可能影响国家安全的，应当按办法申报审查。
The national security review under Art. 2 of China’s Cybersecurity Review Measures: CII operators procuring network products and services, and online platform operators carrying out data processing, must file for review where national security is or may be affected.
金融机构与受监管主体在建立业务关系时识别并核实客户身份、了解业务性质与目的的流程；美国 CDD 规则要求识别法人客户的受益所有人。
The process by which financial institutions and regulated entities identify and verify customers and understand the nature and purpose of the relationship; the U.S. CDD rule requires identifying beneficial owners of legal entity customers.
防止犯罪收益经由金融体系洗白的法律与合规制度，通常包含客户尽职调查、交易监控、可疑交易报告与记录保存要求。
The legal and compliance regime preventing criminal proceeds from being laundered through the financial system, typically comprising customer due diligence, transaction monitoring, suspicious activity reporting and record keeping.
最终拥有或控制法人客户的自然人；美国 31 CFR § 1010.230 要求金融机构在开户时识别并核实法人客户的受益所有人。
The natural persons who ultimately own or control a legal entity customer; 31 CFR § 1010.230 requires financial institutions to identify and verify them at account opening.
在收付款环节对交易对手、受益人与中间行比对制裁名单，命中时冻结或拒付并按规定报告的控制措施。
Controls that screen counterparties, beneficiaries and intermediary banks against sanctions lists during payment processing, blocking or rejecting on a hit and reporting as required.
证券市场规则要求上市或拟上市主体按适用准则（如 ISSB 准则或本地等效准则）定期披露可持续与气候相关信息。
Securities market rules requiring listed or listing entities to disclose sustainability and climate-related information periodically under applicable standards such as the ISSB standards or local equivalents.
就环境绩效或气候目标作出无充分证据支撑、夸大或具误导性的陈述，可能触发虚假陈述与消费者保护责任。
Making unsubstantiated, exaggerated or misleading claims about environmental performance or climate targets, exposing the company to misrepresentation and consumer-protection liability.
欧盟《数字运营韧性法案》为金融实体设定 ICT 风险管理、事件报告与第三方风险要求，并对 ICT 第三方服务合同规定必备条款。
The EU Digital Operational Resilience Act imposes ICT risk management, incident reporting and third-party risk requirements on financial entities, and prescribes mandatory clauses for ICT third-party contracts.
大量关键业务依赖单一供应商、单一云区域或单一法域所形成的系统性风险，DORA 将其列为金融实体第三方风险管理要点。
The systemic risk from concentrating critical functions in one provider, one cloud region or one jurisdiction; DORA treats it as a focus of financial entities’ third-party risk management.
在服务终止时保障客户有序迁出的安排，包含数据导出格式、过渡协助期与删除证明；欧盟《数据法案》就数据处理服务的切换设有专章。
Arrangements ensuring an orderly customer exit on termination — export formats, transition assistance and deletion certification; the EU Data Act devotes a chapter to switching between data processing services.
违规导致的罚款、整改支出、业务中断、合同违约赔偿与商誉损失的总和，是合规投入商业论证的对照项。
The total of fines, remediation spend, business interruption, contractual damages and reputational loss arising from non-compliance — the comparator in the business case for compliance investment.
约定双方长期合作通用条款（责任、保密、知识产权、赔偿、终止等）的框架合同，具体交付内容另由订单或工作说明书约定。
A framework contract setting the general terms of a long-term relationship — liability, confidentiality, intellectual property, indemnities, termination — with specific deliverables handled in order forms or statements of work.
以可量化指标（可用性、响应时间、恢复时间等）约定服务水平，并规定未达标时的服务积分或赔偿救济的合同文件。
A contract document defining service levels in measurable terms — availability, response time, recovery time — with service credits or other remedies when they are missed.
一方承诺就特定风险（如第三方知识产权侵权、数据泄露、违规使用）给对方造成的损失、责任与费用予以补偿的合同安排。
A contractual undertaking by one party to compensate the other for losses, liabilities and costs arising from specified risks such as third-party IP infringement, data breach or misuse.
合同中限制一方赔偿责任总额（常以年度费用倍数表示）并排除间接损失的条款，通常对数据泄露与违规设有超级上限或例外。
A clause capping a party’s aggregate liability, often as a multiple of annual fees, and excluding indirect losses, typically with a supercap or carve-out for data breach and compliance failures.
客户（或其授权审计人、监管机关）核查供应商合规与控制有效性的合同权利；GDPR 第 28(3)(h) 条要求处理者配合控制者的审计与检查。
The customer’s (or its auditor’s or regulator’s) contractual right to verify a supplier’s compliance and control effectiveness; GDPR Art. 28(3)(h) requires processors to allow for and contribute to audits and inspections.
GDPR 第 28(2) 条下控制者对处理者聘用子处理者的事先具体或一般授权；采用一般授权时，处理者须就增删子处理者事先通知并给控制者反对机会。
The controller’s prior specific or general written authorisation for a processor to engage sub-processors under GDPR Art. 28(2); with general authorisation, the processor must give prior notice of additions or replacements and an opportunity to object.
采购方公开说明需求、评审标准与投标要求，邀请供应商提交方案与报价的采购文件；欧盟公共采购的程序与准则由指令 2014/24/EU 规范。
A procurement document in which the buyer states requirements, award criteria and bid rules and invites suppliers to submit proposals and pricing; EU public procurement procedures and criteria are governed by Directive 2014/24/EU.
在正式采购前对供应商开展资质、财务、安全、隐私与制裁筛查并完成合同签署与系统建档的流程。
The process of qualifying a supplier before purchase — corporate, financial, security, privacy and sanctions screening — through contract signature and system record creation.
对供应商全生命周期（准入、合同、持续监控、退出）风险进行识别、评估与缓释的管理体系。
A management system for identifying, assessing and mitigating supplier risk across the full lifecycle: onboarding, contracting, ongoing monitoring and exit.
针对客户尽调问卷（CAIQ 或客户自制问卷）组织证据、统一口径并留档的流程，通常与信任中心和证据库联动。
The process of assembling evidence, aligning answers and archiving responses to customer due-diligence questionnaires (the CAIQ or a buyer’s bespoke form), usually backed by a trust centre and an evidence repository.
集中保存政策、评估报告、审计结论、培训记录与审批留痕的仓库，使每条合规主张都能被即时追溯到原件。
A central store of policies, assessments, audit conclusions, training records and approval trails so every compliance assertion can be traced to its source document on demand.
服务条款中界定用户不得将 AI 服务用于哪些用途（违法内容、禁止类实践、高风险场景等）并规定违反后果的政策文件。
A policy in the terms of service defining what users may not do with an AI service — unlawful content, prohibited practices, high-risk use cases — and the consequences of breach.
AI 法案第 14 条要求高风险 AI 系统设计上支持自然人有效监督，使其能理解系统能力与局限、监控运行并在必要时介入或停止。
Art. 14 of the AI Act requires high-risk AI systems to be designed so natural persons can effectively oversee them — understand capabilities and limits, monitor operation, and intervene or stop the system.
AI 法案第 72 条要求高风险 AI 系统提供者建立并记录与技术性质、风险相称的上市后监测体系，主动收集与分析系统运行表现数据。
Art. 72 of the AI Act requires providers of high-risk AI systems to establish and document a post-market monitoring system proportionate to the technology and its risks, actively collecting and analysing performance data.
内容截至 2026-09-12 · 语料版本 2026.09|本内容基于公开官方来源整理，标注了来源链接与复核日期，供合规决策参考；监管要求可能变化，正式对外披露、监管申报或合同承诺前请由持证专业人士复核。