A Clean Cyber Review Is Not AI Assurance

Why cyber risk assessments cannot govern or approve AI's use in the enterprise

In July 2025, Deloitte delivered a $440,000 report to the Department of Employment and Workplace Relations. It contained citations to academic papers that did not exist and a quotation attributed to a Federal Court judgment that was never written. The generative AI that produced them ran on the department's own Azure tenant: access-controlled, logged, inside the government's security perimeter. Deloitte refunded the final instalment. Security was the one thing that worked.

A cyber risk assessment can tell you whether an AI system can be compromised. It cannot tell you whether it should be trusted to make a decision.

That distinction is becoming one of the most important governance gaps in Australian enterprises. AI arrives through the IT door, so it is sent through the only mature gate available: the cybersecurity review. The review comes back clean. The board believes AI risk has been addressed.

It has not. It has addressed one narrow, necessary part of the question.

Cybersecurity asks: can this system be attacked, breached, disrupted or misused? AI risk assessment asks: should this system be allowed to act, decide, advise or influence people, under what conditions, with what oversight, and who is accountable when it is wrong?

A system can be encrypted, access-controlled, patched, logged and monitored to an exemplary standard, and still:

• discriminate against particular groups;
• give customers confident but wrong advice;
• make decisions no one can adequately explain or contest;
• degrade as data, customers or operating conditions change;
• optimise a proxy measure rather than the outcome the organisation intended;
• create legal, privacy, consumer, employment or reputational harm without any attacker being involved.

Cybersecurity is essential. It is not a proxy for AI assurance.

What cyber does well

This is not an argument against cybersecurity. Cyber teams are very good at protecting systems from their environment. They understand threat modelling, vulnerabilities, identity and access, patching, segmentation, logging, monitoring, incident response and resilience. NIST's Cybersecurity Framework and ISO/IEC 27001 are mature, auditable and well suited to protecting the confidentiality, integrity and availability of systems and data.

For AI, cyber remains indispensable. It should own the security of model weights, training data, pipelines, APIs, agent permissions and vendor systems, and the new AI-specific attacks: prompt injection, data poisoning, model extraction.

That is the security slice of AI risk. It is not the whole of it.

Where cyber goes blind

The gap is structural. Cyber risk frameworks assume that correct behaviour is known in advance, so a compromise can be detected as a deviation from it. The discipline exists to protect a system from its environment.

AI breaks that assumption. Its behaviour is learned from data, probabilistic, context-dependent and often difficult to explain. The most consequential AI failures are not attacks. They are systems doing exactly what they were built or trained to do: badly, unfairly, unlawfully, or in a context where they should never have been used. The harm runs the other way, from the system into its environment, and no cyber control is pointed in that direction.

The clearest illustration is the triad itself. Integrity, in the cyber sense, means data and systems have not been altered without authorisation. A model that was never tampered with and is wrong two-thirds of the time has perfect integrity. Accuracy is a different property altogether. The EU AI Act makes the point for you: Article 15 lists accuracy, robustness and cybersecurity as three separate requirements for high-risk systems, in the same article, because none of them implies the others.

Cyber assessment asks	AI risk assessment must also ask
Can the system be breached?	Can it cause harm while working exactly as designed?
Is the data protected?	Was the data lawful, representative, fit for purpose and appropriately consented?
Are there vulnerabilities?	Does the model produce biased, inaccurate or unsafe outcomes for particular groups?
Can we detect an intrusion?	Can we detect drift, silent model changes and deteriorating performance?
Who can access the system?	Who is accountable for the decisions and advice the system produces?
Can we respond to an incident?	Can affected people understand, challenge, appeal or reverse a decision?
Is the vendor secure?	Is the vendor's model fit for our purpose, and what happens when they retrain or change it?
Can we restore the system?	Can we pause or withdraw it, and has that path been tested?

The unit of analysis is different. Cyber assesses assets: servers, applications, identities, datasets, networks. AI risk assessment assesses use: a model plus its data, its decision context, its human oversight, the people it affects, its commercial purpose and its operating environment.

The same model used to draft marketing copy and to support credit decisions is one cyber asset. It is two entirely different AI risks.

The standards already separate them

The standards bodies and regulators treat cyber and AI risk as related but distinct disciplines, and they say so in writing.

NIST maintains a Cybersecurity Framework and a separate AI Risk Management Framework. The AI framework is organised around governing, mapping, measuring and managing risk, and defines trustworthiness through seven characteristics: valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy-enhanced, and fair with harmful bias managed. One of the seven is cyber's territory. In December 2025 NIST released a draft Cyber AI Profile to bridge the two, and scoped it deliberately to three security focus areas: securing AI components, AI-enabled defence and AI-enabled attack. NIST states the profile is to be used with the AI framework, not instead of it. The security standards body drew the boundary itself.

ISO publishes ISO/IEC 27001 for information security management and ISO/IEC 42001 for AI management systems, supported by ISO/IEC 23894 for AI risk. They share a management-system spine, which is why 27001-certified organisations reach 42001 faster. They certify different things. One asks whether information is secure. The other asks whether AI is being developed, deployed and used responsibly. An organisation can hold the first and fail the second.

In Australia the direction is clearer still. From 10 December 2026, entities covered by the Privacy Act must disclose, in their privacy policies, which computer programs make or substantially and directly inform decisions that significantly affect people's rights or interests. The obligation sits with the organisation that deployed the program, not the vendor. Meeting it requires an inventory of decision-making systems that no cyber asset register can produce.

ASIC's Report 798, Beware the Gap, reviewed 624 AI use cases across 23 licensees and found governance lagging adoption. In its accompanying release, ASIC reported that nearly half of the licensees had no policies that considered consumer fairness or bias, and fewer still had policies on disclosing AI use to consumers. Its eleven questions for licensees lead with fairness, not security.

The failures cyber would have missed

The most instructive AI failures have not begun with a breach.

Robodebt. The harm came from the design of the decision system: income averaging, a reversed burden of proof, and legal warnings that were ignored. The Royal Commission called it a crude and cruel mechanism, neither fair nor legal. $1.73 billion in unlawful debts were raised against more than 400,000 people. Nothing was compromised.

The Dutch childcare benefits scandal. A self-learning fraud-risk model used nationality and dual citizenship as risk signals. Some 26,000 families were wrongly accused; the entire government resigned in January 2021. The damage was discriminatory by design, with inadequate human review and no clear line of accountability.

Epic's sepsis prediction model. Deployed across hundreds of US hospitals inside secure electronic health records. Independent validation published in JAMA Internal Medicine found it missed 67 per cent of sepsis cases while alerting on 18 per cent of all patients. The vendor had reported an AUC of 0.76 to 0.83; the hospital observed 0.63. The model was never attacked. It was never externally validated either.

Air Canada's chatbot. A bereaved customer was told he could claim a bereavement fare retroactively. He could not. Air Canada argued the chatbot was a separate legal entity responsible for its own statements. The tribunal rejected that in a sentence: the chatbot is part of the airline's website, and the airline is responsible for everything on it.

Deloitte and the Commonwealth. Fabricated references and a fictitious judicial quote, in a report on welfare compliance, produced on government-secured infrastructure and found by an academic after publication.

None of these would appear on a penetration-test report, a vulnerability dashboard, a patch register or a SOC alert. Each would appear in a fairness assessment, an outcome evaluation, an external validation, a decision inventory, a human-oversight review, a vendor assurance process or an accountability map. Those are the instruments of AI risk assessment.

Why leaders conflate the two

The conflation is structural, not a failure of intelligence.

AI arrives through IT, so procurement, licensing and deployment pass through technology and security processes by default. The CISO is handed the file: security leaders are increasingly expected to manage AI risk, often without equivalent authority, resourcing or mandate across the business. Cyber is the mature gate, with language, controls, evidence and board familiarity that AI governance does not yet have. Ownership is undefined, so if no one owns fairness, accuracy, contestability or decision accountability, those questions are quietly not asked. A completed assessment feels like diligence, even when it evidences the wrong question. And boards cannot yet distinguish the two: cyber reporting is familiar and quantified; AI harm is emergent, contextual and resists the dashboard.

The organisations most exposed are not those with no assessment. They are the ones with a strong cyber assessment and a board that believes it covers AI.

What the law already expects

Australian directors have been here before. In ASIC v RI Advice, the Federal Court found that failing to implement reasonably appropriate controls for a foreseeable technology risk, in that case cyber, was enough to breach licensee obligations and to open a path to director liability under section 180 of the Corporations Act. The same architecture applies to AI. A cyber sign-off is a control. It is a control for the wrong risk.

When an AI system harms a customer, a patient or an applicant, the question a director will be asked is not whether the system was secure. It is: what did you know, and what systems did you insist on? I have written about this in more detail elsewhere.1

What a proper AI risk assessment produces

An enterprise AI risk assessment sits alongside cyber assurance, not inside it. The questions it must answer are the right-hand column of the table above, applied to a specific use rather than to a system in the abstract. Before connecting AI to anything that matters, three questions carry most of the weight:2

What can it see? What can it do? What happens when it is wrong?

The third question is the one a cyber review never asks.

The output is not a risk register entry. It is a decision: proceed, proceed with conditions, redesign the use case, add oversight, restrict the operating envelope, or do not deploy. It comes with a named human who is accountable for the decisions the system makes, and a tested path to pause or withdraw it.

The governance test

Before approving an AI tool, ask one question:

What evidence do we have that this system is safe, fair, accurate, lawful, explainable and appropriately supervised for this specific use, and not merely that it is secure?

If the answer is a penetration test, a security questionnaire and a privacy tick-box, you do not yet have AI assurance. You have cyber assurance.

Cybersecurity protects the system. AI governance protects the people, decisions, customers, patients, employees and communities the system affects.

Both are necessary. They are not interchangeable.