Cybersecurity Responsibilities in Enterprise Generative AI Adoption: A Qualitative Documentary Analysis of Delegated Authority and Organizational Oversight
Abstract: Enterprise generative artificial intelligence assistants can retrieve organizational information, recommend decisions, and initiate actions through connected tools. These capabilities make cybersecurity a question of how authority and responsibility are distributed across systems and organizations. This study examines how public guidance translates security responsibilities into controls over enterprise AI assistants. A purposive corpus of 12 documentary units from public bodies, a security community, and technology providers was retrieved on 28 September 2026. Focused qualitative document analysis combined six initial coding categories with cross-document comparison, producing a register of 27 evidence records. Four interpretive themes were developed: responsibility is allocated at different organizational and technical levels; permission inheritance requires contextual judgment about appropriate access; human oversight depends on enforceable intervention points; and incident accountability requires continuity across organizational and temporal boundaries. Counterevidence matters: the corpus contains explicit oversight, authorization, and incident-management provisions, so it does not support a general claim that AI security guidance lacks responsibility requirements. The analysis instead identifies an implementation translation problem between broad obligations, application-level controls, and locally assigned decision rights. A proposed governance framework links retrieval, recommendation, and action capabilities to permission boundaries, intervention conditions, accountable owners, and retained decision evidence. The framework is an analytical synthesis, not an empirically validated maturity model. The study contributes a focused account of responsibility at transitions between AI capabilities and offers an auditable structure for enterprise deployment decisions. Its conclusions concern the selected documents and do not establish organizational compliance, …
Read More