Information Security Recommendations for Organisational AI Usage: A qualitative study exploring the adaptation of existing information security best practices for organisations utilizing AI systems

Sammanfattning

As artificial intelligence (AI) becomes increasingly embedded in organisational operations, it introduces not only efficiency but also unique information security challenges. Traditional security practices cover common threats, however, the lack of transparency in AI output and the possibility of novel attacks such as data poisoning and phishing attacks show that these systems are poorly equipped to ensure information security. The individual domains of AI and information security are both well-researched while their intersection is less explored, especially in practical situations. This study aims to investigate how internal information security practices evolve following the increased use of AI in organisations and how already established best practices overlap with the increased need of information security to address this. Recommendations which organisations can follow to protect their information with regards to AI usage are presented. Research was conducted through interviews of individuals operating in IT landscapes and through literature review of well-established standards and best practices in information security. Through the focus on technical aspects rather than regulatory developments, the study contributes to the limited knowledge on securing AI usage in organisations. The findings showcase the expanded need for employee training connected to AI usage and the benefits of using localized AI systems rather than relying on them externally.