Generativ AI som arbetsverktyg : En kvalitativ studie om informationssäkerhetsrisker i samspelet mellan mänskliga, tekniska och organisatoriska faktorer

Sammanfattning

The rapid development and increasing accessibility of generative artificial intelligence (AI) has led to its growing adoption as a workplace tool across organizations. While generative AI enables increased efficiency and supports tasks such as information processing, problem-solving, and content generation, its use also introduces new information security risks. These risks are particularly evident when sensitive or work-related information is shared with external AI services, where organizations may have limited control over how data is processed, stored or reused. This study aims to examine how information security risks emerge in the use of generative AI as a work tool, with focus on the interaction between human, technical and organizational factors within a university context. A qualitative research approach was applied, based on semi-structured interviews with IT professionals. The data collected was analyzed using thematic analysis guided by an analytical framework. The findings show that information security risks arise through the interplay between user behavior, system limitations and organizational conditions. Key challenges include informal use of AI tools (Shadow IT), uncertainty regarding data handling and system transparency and a gap between formal policies and actual practice. The study highlights the importance of a holistic approach to managing information security risks related to generative AI.