The Taxonomy

A shared vocabulary for describing technology.

Each category is a question people ask about a technology, and its elements are the answers. Choose a category, then an element, to see its icon and what it means. New to the terms? Read the concepts.

Input Data

Elements 10

What input data does this system process?

The input data this deployed system processes when it operates.

About this category

Input Data

What input data does this system process?

The input data this deployed system processes when it operates.

Datachain

Answer: Some devices, such as a gate or a display, take no data in. Answer it when the system processes data.
Icon shape: Data in motion: what goes in, what processes it, and what comes out.

Context: Personal Information

How identifiable the data is when this system processes it. The element name says what the data is about; this colour says how directly it identifies a person.

Anonymized dataData about people with the link to who is broken. Stripped of identifiers, blurred, aggregated, or noised so this system can’t reasonably tie a record back to an individual.

Pseudonymous dataEach person’s data is tied to a token (hash, ID, template) that lets this system recognise the same person across events, but the token itself doesn’t reveal a name. Reidentification is possible with extra information.

Identifiable dataThe data either contains a direct identifier (name, address, account name, recognisable face or voice, plate number) or carries a token this system uses to look up legal identity during processing.

Variables

Description Required

Data about a measurementSensor readings — air quality, temperature, sound level, energy, water flow. The system takes in numeric measurements from physical sensors, usually with no person attached. Examples: PM2.5 readings from an air-quality monitor, decibel levels from a sound sensor, kilowatt-hours from a meter.

Data about a placeLocations, routes, surroundings, or floor plans. The system takes in data describing where something is. Examples: GPS coordinates from a phone, foot-traffic counts on a sidewalk, a map of building corridors.

Data about behaviourTaps, choices, paths walked, dwell time, purchases, or queries. The system takes in records of what people did. Examples: tapped destinations on a wayfinding kiosk, items added to a cart, a search query typed into a public terminal.

Biometric dataFaces, fingerprints, voice prints, gait, gestures, gaze, posture. The system takes in biological signals from a person's body. Examples: a face captured at a turnstile, a voice recorded by a kiosk microphone, gait analyzed by an overhead camera.

A decision about youAn eligibility, classification, ranking, or yes/no that another system already made about a person. The system takes in this prior decision and uses it as input. Examples: a credit score from another model, an access-allow flag from upstream, a triage class assigned earlier in the pipeline.

Generated contentText, images, audio, or video that an AI system made. The system takes in this synthetic content and processes it further. Examples: an LLM-written summary fed into a translator, a generated photo passed to a moderation model, a text-to-speech clip routed to an audio system.

Operational dataSchedules, routes, budgets, occupancy counts, public records, or other administrative data — not about any one person. The system takes in data describing how a place or service runs. Examples: school occupancy by hour, trash-collection routes, a transit timetable, a department budget.

A physical actionA signal that something in the physical world changed — a door opening, a light turning on, an alert sounding. The system takes in evidence of these changes from upstream actuators or sensors. Examples: a turnstile-unlock event, an HVAC adjustment recorded by a sensor, a public-address alert played upstream.

A recommendation or predictionA suggestion, forecast, risk score, or ranking produced earlier by another system. The system takes in this advisory output and uses it. Distinct from a binding decision because it advises rather than determines. Examples: a forecasted demand curve, a risk score from a prior model, a recommended route from a navigation service.

Sensitive personal dataHealth, finances, beliefs, sexuality, immigration status, or other personal information that carries legal and social risk. The system takes in this kind of protected data. Examples: insurance eligibility at a clinic kiosk, a benefits-application status, a self-declared pronoun.

Generated content

Text, images, audio, or video that an AI system made. The system takes in this synthetic content and processes it further. Examples: an LLM-written summary fed into a translator, a generated photo passed to a moderation model, a text-to-speech clip routed to an audio system.

Context: Personal Information

How identifiable the data is when this system processes it. The element name says what the data is about; this colour says how directly it identifies a person. Choose a value to see its icon.

Variables

Description Required

Sources

EU AI Act Article 3(1) — output class "content"Regulation (EU) 2024/1689, Article 3(1).
EU AI Act Article 50 — Synthetic-content disclosureRegulation (EU) 2024/1689, Article 50.
NIST AI 100-4 — AI Risk Management FrameworkNIST.