Page 360 - CyberSecurityEssentialsEnglish

FIGURE 8-1: THE CHAIN OF RESPONSIBILITY IN AN INSTITUTIONAL SYSTEM

What to notice: The interaction moves from the user to the AI interface and then into the
institutional process, but final responsibility remains with the organization and the decision

owner.
Source: Prepared by the author, drawing on the reasoning of the tribunal decision described
above [1].

Chapter Objectives

• Understand the difference among governance, management, compliance, audit,
assurance, and ethics.
• Classify a use case and determine the appropriate human oversight and the evidence it

requires.
• Manage a system across its lifecycle, from the idea and the testing to monitoring and

retirement.
• Examine data, vendors, security, and agents before granting them executive capability.
• Redesign work in a way that raises productivity while preserving skill and responsibility.

• Measure adoption with a balanced scorecard rather than counts of accounts or hours of
use.

• Translate global frameworks into a local and Arabic institutional context.

8.1 From Individual Use to Institutional Capability
◆ Key idea: subscriptions are not capability.
Owning subscriptions and tools is not the same as owning an institutional capability.
Capability appears when an organization knows why it uses AI, who owns each decision,
what evidence is required before scaling, and how value is measured and risk is treated.

Adoption usually begins from the bottom up. One employee tries a tool to summarize a
document, another team uses a model to draft replies, and a technical unit builds an internal

assistant. These experiments may generate quick value, but they also create what is called
shadow AI: uses the organization does not know about, data that may be uploaded to

359