Securing responsible AI:  Integrating cybersecurity and AI governance at NovexTech solutions

David Oyebisi; Stella-Maris Orim

doi:10.1177/20438869261448219

Securing responsible AI: Integrating cybersecurity and AI governance at NovexTech solutions

David Oyebisi
, Stella-Maris Orim

CEES School of Science

Research output: Contribution to journal › Article › peer-review

1 Citation (Scopus)

4 Downloads (Pure)

Abstract

This postgraduate-level teaching case explores the governance challenges that arise when artificial intelligence becomes embedded within enterprise cybersecurity and operational decision-making. Set in a mid-sized European IT services firm, NovexTech Solutions, the case examines how a ransomware incident affecting AI-enabled analytics systems exposes limitations in existing governance arrangements. While the organisation successfully restores services using established incident response and business continuity procedures, post-incident reviews reveal deeper concerns related to AI model integrity, accountability, and oversight across the AI development and operational lifecycle. As regulatory expectations intensify under frameworks such as the General Data Protection Regulation (GDPR), the Network and Information Systems Directive 2 (NIS2 Directive), and the European Union Artificial Intelligence Act (EU AI Act), NovexTech faces growing pressure from clients, partners, and broader societal stakeholders to demonstrate coherent and defensible governance. Students are invited to analyse governance fragmentation, evaluate trade-offs between control and innovation, and assess how organisations can structure responsible and resilient governance in AI-enabled environments. The case culminates in a board-level governance dilemma requiring senior leadership to determine whether to maintain parallel cybersecurity and AI governance structures or redesign governance into an integrated framework capable of managing AI-enabled cyber risk while sustaining innovation and regulatory accountability.

Original language	English
Pages (from-to)	(In-Press)
Number of pages	9
Journal	Journal of Information Technology Teaching Cases
Volume	(In-Press)
Early online date	6 May 2026
DOIs	https://doi.org/10.1177/20438869261448219
Publication status	E-pub ahead of print - 6 May 2026

Bibliographical note

© Association for Information Technology Trust 2026. This article is distributed under the terms of the Creative Commons Attribution 4.0 License (https://creativecommons.org/licenses/by/4.0/) which permits any use, reproduction and distribution of the work without further permission provided the original work is attributed as specified on the SAGE and Open Access page (https://us.sagepub.com/en-us/nam/open-access-at-sage).

Keywords

AI risk management
artificial intelligence governance
cybersecurity governance
enterprise governance design
governance integration
organisational accountability
regulatory compliance

ASJC Scopus subject areas

Education
Library and Information Sciences

Access to Document

10.1177/20438869261448219Licence: CC BY

Oyebisi2026VoRFinal published version, 1.27 MBLicence: CC BY

Cite this

@article{3d3d316d50bb40d48eefe998280ba4aa,

title = "Securing responsible AI: Integrating cybersecurity and AI governance at NovexTech solutions",

abstract = "This postgraduate-level teaching case explores the governance challenges that arise when artificial intelligence becomes embedded within enterprise cybersecurity and operational decision-making. Set in a mid-sized European IT services firm, NovexTech Solutions, the case examines how a ransomware incident affecting AI-enabled analytics systems exposes limitations in existing governance arrangements. While the organisation successfully restores services using established incident response and business continuity procedures, post-incident reviews reveal deeper concerns related to AI model integrity, accountability, and oversight across the AI development and operational lifecycle. As regulatory expectations intensify under frameworks such as the General Data Protection Regulation (GDPR), the Network and Information Systems Directive 2 (NIS2 Directive), and the European Union Artificial Intelligence Act (EU AI Act), NovexTech faces growing pressure from clients, partners, and broader societal stakeholders to demonstrate coherent and defensible governance. Students are invited to analyse governance fragmentation, evaluate trade-offs between control and innovation, and assess how organisations can structure responsible and resilient governance in AI-enabled environments. The case culminates in a board-level governance dilemma requiring senior leadership to determine whether to maintain parallel cybersecurity and AI governance structures or redesign governance into an integrated framework capable of managing AI-enabled cyber risk while sustaining innovation and regulatory accountability.",

keywords = "AI risk management, artificial intelligence governance, cybersecurity governance, enterprise governance design, governance integration, organisational accountability, regulatory compliance",

author = "David Oyebisi and Stella-Maris Orim",

note = "{\textcopyright} Association for Information Technology Trust 2026. This article is distributed under the terms of the Creative Commons Attribution 4.0 License (https://creativecommons.org/licenses/by/4.0/) which permits any use, reproduction and distribution of the work without further permission provided the original work is attributed as specified on the SAGE and Open Access page (https://us.sagepub.com/en-us/nam/open-access-at-sage).",

year = "2026",

month = may,

day = "6",

doi = "10.1177/20438869261448219",

language = "English",

volume = "(In-Press)",

pages = "(In--Press)",

journal = "Journal of Information Technology Teaching Cases",

issn = "2043-8869",

publisher = "SAGE Publications",

}

TY - JOUR

T1 - Securing responsible AI

T2 - Integrating cybersecurity and AI governance at NovexTech solutions

AU - Oyebisi, David

AU - Orim, Stella-Maris

N1 - © Association for Information Technology Trust 2026. This article is distributed under the terms of the Creative Commons Attribution 4.0 License (https://creativecommons.org/licenses/by/4.0/) which permits any use, reproduction and distribution of the work without further permission provided the original work is attributed as specified on the SAGE and Open Access page (https://us.sagepub.com/en-us/nam/open-access-at-sage).

PY - 2026/5/6

Y1 - 2026/5/6

N2 - This postgraduate-level teaching case explores the governance challenges that arise when artificial intelligence becomes embedded within enterprise cybersecurity and operational decision-making. Set in a mid-sized European IT services firm, NovexTech Solutions, the case examines how a ransomware incident affecting AI-enabled analytics systems exposes limitations in existing governance arrangements. While the organisation successfully restores services using established incident response and business continuity procedures, post-incident reviews reveal deeper concerns related to AI model integrity, accountability, and oversight across the AI development and operational lifecycle. As regulatory expectations intensify under frameworks such as the General Data Protection Regulation (GDPR), the Network and Information Systems Directive 2 (NIS2 Directive), and the European Union Artificial Intelligence Act (EU AI Act), NovexTech faces growing pressure from clients, partners, and broader societal stakeholders to demonstrate coherent and defensible governance. Students are invited to analyse governance fragmentation, evaluate trade-offs between control and innovation, and assess how organisations can structure responsible and resilient governance in AI-enabled environments. The case culminates in a board-level governance dilemma requiring senior leadership to determine whether to maintain parallel cybersecurity and AI governance structures or redesign governance into an integrated framework capable of managing AI-enabled cyber risk while sustaining innovation and regulatory accountability.

AB - This postgraduate-level teaching case explores the governance challenges that arise when artificial intelligence becomes embedded within enterprise cybersecurity and operational decision-making. Set in a mid-sized European IT services firm, NovexTech Solutions, the case examines how a ransomware incident affecting AI-enabled analytics systems exposes limitations in existing governance arrangements. While the organisation successfully restores services using established incident response and business continuity procedures, post-incident reviews reveal deeper concerns related to AI model integrity, accountability, and oversight across the AI development and operational lifecycle. As regulatory expectations intensify under frameworks such as the General Data Protection Regulation (GDPR), the Network and Information Systems Directive 2 (NIS2 Directive), and the European Union Artificial Intelligence Act (EU AI Act), NovexTech faces growing pressure from clients, partners, and broader societal stakeholders to demonstrate coherent and defensible governance. Students are invited to analyse governance fragmentation, evaluate trade-offs between control and innovation, and assess how organisations can structure responsible and resilient governance in AI-enabled environments. The case culminates in a board-level governance dilemma requiring senior leadership to determine whether to maintain parallel cybersecurity and AI governance structures or redesign governance into an integrated framework capable of managing AI-enabled cyber risk while sustaining innovation and regulatory accountability.

KW - AI risk management

KW - artificial intelligence governance

KW - cybersecurity governance

KW - enterprise governance design

KW - governance integration

KW - organisational accountability

KW - regulatory compliance

UR - https://www.scopus.com/pages/publications/105037896923

U2 - 10.1177/20438869261448219

DO - 10.1177/20438869261448219

M3 - Article

SN - 2043-8869

VL - (In-Press)

SP - (In-Press)

JO - Journal of Information Technology Teaching Cases

JF - Journal of Information Technology Teaching Cases

ER -