Securing responsible AI: Integrating cybersecurity and AI governance at NovexTech solutions

This postgraduate-level teaching case explores the governance challenges that arise when artificial intelligence becomes embedded within enterprise cybersecurity and operational decision-making. Set in a mid-sized European IT services firm, NovexTech Solutions, the case examines how a ransomware incident affecting AI-enabled analytics systems exposes limitations in existing governance arrangements. While the organisation successfully restores services using established incident response and business continuity procedures, post-incident reviews reveal deeper concerns related to AI model integrity, accountability, and oversight across the AI development and operational lifecycle. As regulatory expectations intensify under frameworks such as the General Data Protection Regulation (GDPR), the Network and Information Systems Directive 2 (NIS2 Directive), and the European Union Artificial Intelligence Act (EU AI Act), NovexTech faces growing pressure from clients, partners, and broader societal stakeholders to demonstrate coherent and defensible governance. Students are invited to analyse governance fragmentation, evaluate trade-offs between control and innovation, and assess how organisations can structure responsible and resilient governance in AI-enabled environments. The case culminates in a board-level governance dilemma requiring senior leadership to determine whether to maintain parallel cybersecurity and AI governance structures or redesign governance into an integrated framework capable of managing AI-enabled cyber risk while sustaining innovation and regulatory accountability.