Mayer N., Cortina S., Bettaieb S., Stoica D.
Communications in Computer and Information Science, vol. 3136 CCIS, pp. 257-270, 2027
The rapid deployment of artificial intelligence (AI) across sectors exposes organizations to overlapping and mutually reinforcing risks spanning cybersecurity, privacy, and AI‑specific dimensions. Threats such as inference attacks, adversarial manipulation, and privacy leakage cut across all three domains yet are typically addressed in isolation, resulting in fragmented assessments, duplicated effort, and regulatory blind spots. The European regulatory landscape encompassing the GDPR, the EU AI Act, NIS 2, and the forthcoming Cyber Resilience Act, further compounds this fragmentation by imposing distinct, domain-specific risk management obligations that organisations must reconcile in practice. This paper addresses these challenges by proposing an integrated conceptual model that systematically unifies key notions from the AI, privacy, and cybersecurity risk domains. Grounded in the Information System Security Risk Management (ISSRM) domain model and extended through structured semantic alignment with relevant international standards and regulatory guidelines, the model enables coherent, non-redundant risk assessments across the three domains. It has been implemented in a model-based risk management platform, and an evaluation through a case study, conducted in collaboration with RMT Labs, a provider of an AI-supported recruitment system, has been initiated.
