AI GOVERNANCE AND CYBERSECURITY RISK: DEVELOPING AN INTEGRATED GRC FRAMEWORK FOR REGULATED ORGANIZATIONS

Rashid Hussain

doi:10.5281/zenodo.22295454

Abstract

Artificial intelligence (AI) is changing how regulated organizations identify, assess, control, and report cybersecurity risk. This conceptual paper examines how AI governance can be integrated with governance, risk, control and assurance, and compliance/reporting rather than managed as a separate compliance stream. A structured literature and standards review was used to identify recurring requirements for dynamic risk management, control assurance, regulatory traceability, and cross-functional integration. Building on this synthesis, the paper proposes an integrated AI-aware GRC architecture in which AI governance operates horizontally across four GRC functions through a shared AI-risk telemetry layer. The layer consolidates signals such as model drift, model and API versions, anomalous agent behavior, access events, human overrides, controltest results, AI incidents, audit findings, and regulatory evidence. These signals are intended to support continuous risk assessment, continuous assurance, and integrated regulatory reporting. The framework is further mapped to NIST AI RMF, ISO/IEC 42001, ISO/IEC 23894, ISO/IEC 27001, the EU AI Act, and relevant Saudi cybersecurity, data-protection, and financial-sector requirements. Comparison with existing GRC approaches indicates a conceptual distinction: the proposed model does not treat AI governance as another GRC module, but as a horizontal operating capability connected to shared risk telemetry. The framework is conceptual and has not yet been empirically validated; therefore, its benefits are presented as design propositions rather than demonstrated outcomes.

Keywords

AI governance, cybersecurity risk, governance risk and compliance, GRC framework, continuous assurance, AIrisk telemetry, regulated organizations, regulatory reporting

References

1) Edwards, J., & Weaver, G. (2024). The cybersecurity guide to governance, risk, and compliance. Wiley.
https://doi.org/10.1002/9781394250226
2) European Union. (2024). Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13
June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). EUR-Lex.
https://eur-lex.europa.eu/eli/reg/2024/1689
3) International Organization for Standardization, & International Electrotechnical Commission. (2022).
ISO/IEC 27001:2022: Information security, cybersecurity and privacy protection—Information security
management systems—Requirements. https://www.iso.org/standard/27001.html
4) International Organization for Standardization, & International Electrotechnical Commission. (2023a).
ISO/IEC 42001:2023: Information technology—Artificial intelligence—Management system.
https://www.iso.org/standard/42001
5) International Organization for Standardization, & International Electrotechnical Commission. (2023b).
ISO/IEC 23894:2023: Information technology—Artificial intelligence—Guidance on risk management.
https://www.iso.org/standard/77304.html
6) National Cybersecurity Authority. (2022a). Critical Systems Cybersecurity Controls (CSCC–1:2019).
https://nca.gov.sa/en/regulatory-documents/controls-list/cscc/
7) National Cybersecurity Authority. (2022b). Operational Technology Cybersecurity Controls (OTCC–
1:2022). https://nca.gov.sa/en/regulatory-documents/controls-list/otcc/
8) National Cybersecurity Authority. (2024a). Essential Cybersecurity Controls (ECC–2:2024).
https://nca.gov.sa/en/regulatory-documents/controls-list/ecc/
9) National Institute of Standards and Technology. (2023). Artificial intelligence risk management framework
(AI RMF 1.0). U.S. Department of Commerce. https://doi.org/10.6028/NIST.AI.100-1
10) Saudi Central Bank. (2017). Cyber security framework. https://rulebook.sama.gov.sa/en/cyber-securityframework-0
11) Saudi Data & AI Authority. (2023). Personal Data Protection Law (PDPL), as amended by Royal Decree
No. M/148. https://dgp.sdaia.gov.sa/wps/portal/pdp/knowledgecenter/details/PDPL/
12) Sayles, J. (2024). Aligning AI governance with other internal governance models for trustworthy AI: “The
convergence of governance frameworks.” In Principles of AI governance and model risk management. Apress.
https://doi.org/10.1007/979-8-8688-0983-5_5