Reference
Regulatory compliance glossary.
Plain-English definitions of the recordkeeping, data, and AI-governance terms that appear most often across SEC, FCA, FCC, FTC, NIST, ISO, CBP, DOT, and FMC compliance work.
(
- (a)(1)(A) List
- The informal name for the recordkeeping schedule in 19 CFR Part 163, which lists the categories of records U.S. Customs and Border Protection (CBP) can require an importer or customs broker to produce. Failure to produce records on that list is itself a violation, separate from any error in the underlying entry.See also:CBP recordkeeping and UFLPA
A
- AI Risk Management Framework (AI RMF)
- A voluntary framework published by the National Institute of Standards and Technology (NIST) in January 2023 that gives organisations a structured way to identify, assess, and govern risks arising from the design, deployment, and operation of AI systems. The framework is organised around four core functions: Map, Measure, Manage, and Govern.See also:NIST AI RMF in depth
- Audit trail
- A chronological, tamper-evident log of actions taken on a record or system: who accessed it, what they did, and when. Regulators across financial services, communications, trade, and technology require audit trails because they convert policy claims into provable facts. An audit trail that cannot be produced on demand offers no protection.See also:SEC recordkeeping overview
B
- Broker-dealer
- A firm registered with the SEC that buys and sells securities on behalf of customers (broker) or for its own account (dealer), or both. Broker-dealers are subject to the SEC's recordkeeping rules under 17 CFR 240.17a-3 and 17a-4, and to FINRA's supervision and records obligations.See also:SEC recordkeeping requirements
C
- Consumer Duty (FCA)
- A UK Financial Conduct Authority standard that took effect in July 2023, requiring firms to deliver good outcomes for retail customers across four areas: products and services, price and value, consumer understanding, and consumer support. The Duty shifts the regulatory question from 'did you follow the rule?' to 'can you show the outcome was good?', which is fundamentally a records and evidence question.See also:FCA AI governance expectations
- Customer Proprietary Network Information (CPNI)
- The call records, usage data, and service information that a telecommunications carrier generates about its customers in the course of providing service. FCC rules under 47 CFR §§ 64.2001-64.2011 restrict how carriers may use and disclose CPNI, require access logging, and mandate annual compliance certifications. The access log backing that certification is a records obligation in its own right.See also:FCC CPNI and data-breach rules
- CTPAT (Customs-Trade Partnership Against Terrorism)
- A voluntary CBP program in which importers, carriers, and other supply-chain participants submit to security assessments and meet defined standards in exchange for reduced examination rates and expedited processing. CTPAT membership signals supply-chain security posture but does not substitute for the traceability records the UFLPA requires; an importer can hold CTPAT status and still be unable to rebut a UFLPA hold.See also:CBP recordkeeping and UFLPA
D
- Demurrage
- A charge levied by an ocean carrier or terminal when imported cargo remains at the terminal beyond the allowed free-time period. Demurrage is a port-side charge: the container has not yet left the terminal. Under the FMC's 2024 billing rule, demurrage invoices must carry specific information (the container timeline, the free-time calculation, the availability notification) or they are contestable on their face.See also:FMC demurrage and detention billing rulesThe records behind a detention dispute
- Detention
- A charge for retaining a carrier's equipment, typically a chassis or container, beyond the allowed free-time period after it has left the terminal. Distinct from demurrage, which is a terminal-side charge. Under the FMC's 2024 demurrage and detention billing rule, detention invoices are subject to the same minimum-content and timing requirements, and can be disputed if those requirements are not met.See also:FMC demurrage and detention billing rulesThe records behind a detention dispute
E
- Electronic Logging Device (ELD)
- A certified electronic device that automatically records a commercial driver's duty status by synchronising with the vehicle's engine. The FMCSA ELD mandate (49 CFR Part 395) replaced the paper logbook for most commercial carriers, converting hours-of-service compliance into a continuous digital audit trail. Because the record is automatic and tamper-resistant, violations are generated alongside the drive, not reconstructed from paper.See also:DOT hours-of-service and ELD records
F
- Free time
- The number of days an importer may keep a container at the terminal (for demurrage) or carrier equipment off-terminal (for detention) before charges begin. Free time is negotiated between the shipper and carrier or terminal, and the calculation of when it begins and ends is frequently disputed. Under the FMC's 2024 rule, the free-time calculation must appear on every invoice.See also:FMC demurrage and detention billing rules
- FTC Safeguards Rule
- The FTC's Standards for Safeguarding Customer Information, codified at 16 CFR Part 314, require non-bank financial institutions to develop, implement, and maintain a written information-security program. Major amendments that took effect in 2023 added specific technical requirements, including encryption, multi-factor authentication, and an incident-response plan. Covered entities must designate a qualified individual to oversee the program.See also:FTC Safeguards Rule analysis
H
- Hours of service (HOS)
- FMCSA rules under 49 CFR Part 395 that set maximum on-duty and driving times and required rest periods for commercial motor vehicle drivers. The rules include an 11-hour driving limit per day, a 14-hour on-duty window, a 10-hour off-duty break, and 60/70-hour weekly limits. The purpose is fatigue reduction. With ELDs generating automatic duty-status records, violations are evidence as well as events.See also:DOT hours-of-service and ELD records
I
- ISO/IEC 42001
- An international standard published in December 2023 that specifies requirements for an artificial-intelligence management system (AIMS). It gives organisations a framework for governing AI throughout its lifecycle, including risk assessment, transparency, and accountability requirements. ISO 42001 is designed to work alongside ISO 27001 (information security) and can be audited and certified.See also:ISO 42001 and 27001 management systems
N
- NIST CSF 2.0 Govern function
- The sixth core function added in the February 2024 update to the NIST Cybersecurity Framework (CSF 2.0). Where the original five functions (Identify, Protect, Detect, Respond, Recover) address operational practices, Govern addresses the organisational context: cybersecurity policies, accountability, supply-chain risk, and the oversight mechanisms that make the other five functions sustainable. It is the function most directly tied to board and senior-leadership accountability.See also:NIST CSF 2.0 Govern function in depth
O
- Off-channel communications
- Business communications conducted over messaging platforms (WhatsApp, iMessage, Signal, personal email) that are not captured and retained by a firm's approved archiving infrastructure. For SEC- and FINRA-regulated broker-dealers and investment advisers, off-channel business communications breach recordkeeping rules and have drawn enforcement actions totalling more than $2.9 billion in penalties since 2021.See also:FINRA off-channel enforcement analysisWhatsApp archiving is not enough
- OSRA 2022 (Ocean Shipping Reform Act of 2022)
- A U.S. law that gave the Federal Maritime Commission expanded authority to regulate ocean shipping practices, including demurrage and detention charges. OSRA 2022 directed the FMC to address unreasonable practices and issue rules; it led directly to the 2024 demurrage and detention billing rule that sets content and timing requirements for container-charge invoices.See also:FMC demurrage and detention billing rules
P
- Prior express consent (TCPA)
- The consent that the Telephone Consumer Protection Act requires before certain automated calls or text messages may be placed to a consumer's mobile number. For marketing messages, the TCPA requires prior express written consent. The caller bears the burden of proving that consent was given, that it covers the specific type of message, and that it has not been revoked. Consent that is not recorded, timestamped, and retrievable offers no legal protection.See also:FCC CPNI and data-breach rulesThe TCPA consent trail
R
- Reasonable care (CBP)
- The standard of diligence U.S. law (19 U.S.C. § 1484) requires of importers when entering goods. CBP has given it content through the (a)(1)(A) records list, informed-compliance publications, and enforcement history. An importer satisfies reasonable care by keeping complete, accurate records tied to each entry and by making a genuine effort to classify and value goods correctly. Good intentions alone are not evidence of reasonable care.See also:CBP recordkeeping and UFLPACustoms compliance in software
- Rebuttable presumption (UFLPA)
- The legal standard the Uyghur Forced Labor Prevention Act applies to goods connected to the Xinjiang Uyghur Autonomous Region: they are presumed to have been made with forced labour and are inadmissible unless the importer rebuts that presumption with clear and convincing evidence. The burden of proof falls entirely on the importer. A supply chain that cannot be traced to raw inputs cannot be rebutted.See also:CBP recordkeeping and UFLPA
- Rule 17a-4 (SEC)
- 17 CFR 240.17a-4, the SEC's primary records-preservation rule for broker-dealers. It sets minimum retention periods (three to six years, depending on record type), requires that electronic records be stored in a non-rewriteable, non-erasable format (WORM), and mandates third-party access arrangements with an independent custodian. Amendments effective in 2023 added a compliance-audit program requirement and clarified conditions for alternative recordkeeping systems.See also:SEC recordkeeping requirements
S
- SM&CR (Senior Managers and Certification Regime)
- A UK FCA and PRA framework that maps individual accountability in authorised financial firms. Senior Managers hold approved functions and carry personal responsibility for their areas; certified individuals must be assessed annually as fit and proper; and conduct rules apply broadly across staff. The Regime makes it difficult to attribute failures to vague collective decision-making, which drives firms to keep decision-trail records.See also:FCA AI governance expectations
U
- Unassigned driving time
- ELD records that show vehicle movement but cannot be attributed to a specific driver. FMCSA rules require carriers to resolve unassigned driving time promptly by assigning it to the correct driver or annotating it with an explanation. A persistent backlog of unassigned time is a red flag in a compliance audit, because it suggests either a failure to assign records or an attempt to avoid attribution of hours that would show a violation.See also:DOT hours-of-service and ELD records
- UFLPA (Uyghur Forced Labor Prevention Act)
- A U.S. law enacted in December 2021 and enforced from 21 June 2022, which applies a rebuttable presumption that goods with any connection to the Xinjiang Uyghur Autonomous Region of China are produced with forced labour and therefore inadmissible. CBP maintains an UFLPA Entity List of companies whose goods are subject to the presumption. Rebuttal requires complete, documented supply-chain traceability from raw material to finished product.See also:CBP recordkeeping and UFLPA
W
- WORM storage (Write Once, Read Many)
- A storage technology or media configuration that allows data to be written once but not altered or deleted during the retention period. SEC Rule 17a-4 requires broker-dealers to retain electronic records in a WORM format to ensure authenticity. Both hardware WORM (optical disk, purpose-built hardware) and software-WORM solutions (cryptographic hash-anchored storage with an independent access arrangement) are accepted under the rule's 2023 amendment.See also:SEC recordkeeping requirements