BUSINESS INFORM JOURNAL.

УКР

ENG

Search:

REGISTRATION CERTIFICATE

KV #19905-9705 PR dated 02.04.2013.

FOUNDERS

RESEARCH CENTER FOR INDUSTRIAL DEVELOPMENT PROBLEMS of NAS of Ukraine (KHARKIV, UKRAINE)

ROR

EDRPOU 05481984

According to the decision No. 802 of the National Council of Television and Radio Broadcasting of Ukraine dated 14.03.2024, is registered as a subject in the field of print media.
ID R30-03156

PUBLISHER

Liburkina L. M.

CATALOG

Improving Enterprise Management Systems to Ensure Data Confidentiality in the Context of Artificial Intelligence Tools Application
Dobosevych Y. V., Shpak N. O.

Dobosevych, Yaroslav V., and Shpak, Nestor O. (2026) “Improving Enterprise Management Systems to Ensure Data Confidentiality in the Context of Artificial Intelligence Tools Application.” Business Inform 7:551–562.
https://doi.org/10.32983/2222-4459-2026-7-551-562

Section: Management and Marketing

Article is written in Ukrainian
Downloads/views: 0

Download article (pdf) -

UDC 005.95/.96:004.056:004.8

Abstract:
The aim of the article is to develop and empirically test an organizational and managerial model that ensures a balance between the security of sensitive data and its availability for machine learning (ML) systems at an innovative enterprise. The study addresses a gap arising from the fact that existing scientific approaches consider data security in ML mainly from the technical and legal perspectives, while the organizational and managerial integration of these processes remains underexplored: a systemic conflict emerges at the intersection of the interests of engineers, who seek maximum access to data, and the security function, which restricts such access, slowing down development and increasing the risk of leaks. The research methodology comprises: the Analytic Hierarchy Process (AHP) for calibrating the weighting coefficients of an integral model of data management efficiency, based on a purposive expert sample of 7 practitioners (chief technology officers, ML team leads, chief information security officers); a simulation of an IT department of 5 cross-functional teams over two six-month periods under control and experimental scenarios; and an economic feasibility assessment. As a result, the study proposes introducing a dedicated managerial role, the AI Data Custodian, and an accompanying process protocol, Data-Sec-AIOps. The simulation confirmed the hypothesis: introducing the role reduced the time to access prepared data (Time-to-Data) by 71% (from 14.5 to 4.2 days), decreased the number of security incidents by 83% (from 12 to 2), reduced the share of unstructured data from 22% to 5%, and increased the average accuracy of ML models (F1) from 0.74 to 0.86. The investment pays off within 4–5 months, and the estimated annual savings for an enterprise with 5 ML teams amount to USD 300.000–440.000. The scientific novelty lies in shifting the focus from technical access blocking to preventive data management through management by influence: the Custodian does not prohibit access but creates secure enclaves, manages anonymization and synthetic data, and acts as the single point of accountability for the ML data lifecycle, having an operational rather than strategic nature, unlike the CDO and DPO. The practical value of the study is a five-phase implementation roadmap (diagnostics – design – technological enablement – pilot – scaling) and a system of five KPIs for measuring the role’s efficiency; the proposed approach can serve as a methodological basis for building data governance systems at Ukrainian innovative enterprises integrating into the European regulatory space in line with GDPR and the AI Act requirements.

Keywords: data confidentiality; machine learning; enterprise management system; AI Data Custodian; organizational and managerial model; cybersecurity; data governance; artificial intelligence.

Fig.: 1. Tabl.: 2. Formulae: 2. Bibl.: 40.

Dobosevych Yaroslav V. – Postgraduate Student, Department of Management and International Entrepreneurship, Lviv Polytechnic National University (12 Stepana Bandery Str., Lvіv, 79013, Ukraine)
Email: [email protected]
Shpak Nestor O. – Doctor of Sciences (Economics), Professor, Professor, Department of Management and International Business, Lviv Polytechnic National University (12 Stepana Bandery Str., Lvіv, 79013, Ukraine)
Email: [email protected]

List of references in article

Abadi M., Chu A., Goodfellow I. & McMahan H. B. (2016). Deep Learning with Differential Privacy. Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security (CCS) (pp. 308–318). https://doi.org/10.1145/2976749.2978318
Biggio B. & Roli F. (2018). Wild patterns: Ten years after the rise of adversarial machine learning. Pattern Recognition, 84, 317–331. https://doi.org/10.1016/j.patcog.2018.07.023
Bonawitz K., Ivanov V. & Kreuter B. (2017). Practical Secure Aggregation for Privacy-Preserving Machine Learning. Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security (CCS) (pp. 1175–1191). https://doi.org/10.1145/3133956.3133982
Brundage M., Avin S., Clark J. & Toner H. (2018). The Malicious Use of Artificial Intelligence: Forecasting, Prevention, and Mitigation. arXiv:1802.07228. https://doi.org/10.48550/arXiv.1802.07228
Carlini N., Tramer F. & Wallace E. (2021). Extracting Training Data from Large Language Models. 30th USENIX Security Symposium (pp. 2633–2650). https://doi.org/10.48550/arXiv.2012.07805
Davenport T. H. & Ronanki R. (2018). Artificial Intelligence for the Real World. Harvard Business Review, 1(96), 108–116. https://academichelptoday.com/assets/documents/Artificial_Intelligence_for_the_Real_World_-_HBR.pdf
Dwork C. & Roth A. (2014). The Algorithmic Foundations of Differential Privacy. Foundations and Trends in Theoretical Computer Science, 3–4(9), 211–487. https://doi.org/10.1561/0400000042
Ereth J. (2018). DataOps – Towards a Definition. Proceedings of the 20th International Conference on Enterprise Information Systems (ICEIS) (pp. 267–276). https://ceur-ws.org/Vol-2191/paper13.pdf
Floridi L. & Cowls J. (2019). A Unified Framework of Five Principles for AI in Society. Harvard Data Science Review, 1(1). https://doi.org/10.1162/99608f92.8cd550d1
Forman E. & Peniwati K. (1998). Aggregating Individual Judgments and Priorities with the Analytic Hierarchy Process. European Journal of Operational Research, 1(108), 165–169. https://doi.org/10.1016/S0377-2217(97)00244-0
Goodfellow I. J., Shlens J. & Szegedy C. (2015). Explaining and Harnessing Adversarial Examples. International Conference on Learning Representations (ICLR). https://doi.org/10.48550/arXiv.1412.6572
Hoofnagle C. J., van der Sloot B. & Borgesius F. Z. (2019). The European Union general data protection regulation: what it is and what it means. Information & Communications Technology Law, 1(28), 65–98. https://doi.org/10.1080/13600834.2019.1573501
IBM Security & Ponemon Institute. (2024). Cost of a Data Breach Report 2024. Armonk, NY: IBM Corporation. https://www-api.ibm.com/adobe/assets/urn:aaid:aem:c4711149-da99-4654-9114-8ee524108540/original/as/cost_of_a_data_breach_report_2024.pdf
IDC (2024). Worldwide Global DataSphere Forecast, 2024–2028: AI Everywhere, But Upsurge in Data Will Take Time. International Data Corporation.
International Organization for Standardization (2008). ISO/IEC 25012:2008. Data Quality Model. Geneva: International Organization for Standardization.
International Organization for Standardization (2022). ISO/IEC 27001:2022. Information security, cybersecurity and privacy protection – Information security management systems – Requirements. Geneva: International Organization for Standardization.
ISO (2019). ISO/IEC 27701:2019. Security techniques – Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management – Requirements and guidelines. Geneva: ISO.
Mayer-Schonberger V. & Cukier K. (2013). Big Data: A Revolution That Will Transform How We Live, Work, and Think. Boston: Houghton Mifflin Harcourt.
McMahan H. B., Moore E. & Ramage D. (2017). Communication-Efficient Learning of Deep Networks from Decentralized Data. Proceedings of the 20th International Conference on Artificial Intelligence and Statistics (AISTATS) (pp. 1273–1282). PMLR. https://proceedings.mlr.press/v54/mcmahan17a/mcmahan17a.pdf
Mell P., Scarfone K. & Romanosky S. (2007). A Complete Guide to the Common Vulnerability Scoring System Version 2.0. FIRST.org.
National Institute of Standards and Technology (2012). NIST SP 800-30 Rev. 1. Guide for Conducting Risk Assessments. Gaithersburg: National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-30r1
NIST (2023). Artificial Intelligence Risk Management Framework (AI RMF 1.0). Gaithersburg, MD: National Institute of Standards and Technology. https://doi.org/10.6028/NIST.AI.100-1
Official Journal of the European Union. (2024, July 12). Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng
Official Journal of the European Union. (2016, April 27). Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (General Data Protection Regulation). https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng
O’Neil C. (2016). Weapons of Math Destruction: How Big Data Increases Inequality and Threatens Democracy. New York: Crown Publishing Group.
Papernot N., McDaniel P., Sinha A. & Wellman M. P. (2018). SoK: Security and Privacy in Machine Learning. 2018 IEEE European Symposium on Security and Privacy (EuroS&P) (pp. 399–414). https://doi.org/10.1109/EuroSP.2018.00035
Park K. (2023, May 2). Samsung bans use of generative AI tools like ChatGPT after April internal data leak. TechCrunch. https://techcrunch.com/2023/05/02/samsung-bans-use-of-generative-ai-tools-like-chatgpt-after-april-internal-data-leak/
Patton M. Q. (2002). Qualitative Research & Evaluation Methods. Thousand Oaks: Sage Publications.
Pipino L. L., Lee Y. W. & Wang R. Y. (2002). Data Quality Assessment. Communications of the ACM, 4(45), 211–218. https://doi.org/10.1145/505248.506010
Rose S., Borchert O., Mitchell S. & Connelly S. (2020). Zero Trust Architecture. Gaithersburg, MD: National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-207
Saaty T. L. (1980). The Analytic Hierarchy Process: Planning, Priority Setting, Resource Allocation. New York: McGraw-Hill.
Saaty T. L. (2008). Decision Making with the Analytic Hierarchy Process. International Journal of Services Sciences, 1(1), 83–98. https://doi.org/10.1504/IJSSCI.2008.017590
Saaty T. L. & Vargas L. G. (2012). Models, Methods, Concepts & Applications of the Analytic Hierarchy Process. New York: Springer. https://doi.org/10.1007/978-1-4614-3597-6
Sculley D., Holt G., Golovin D. & Davydov E. (2015). Hidden Technical Debt in Machine Learning Systems. NIPS'15: Proceedings of the 29th International Conference on Neural Information Processing Systems (pp. 2503–2511). https://dl.acm.org/doi/10.5555/2969442.2969519
Shokri R., Stronati M., Song C. & Shmatikov V. (2017). Membership Inference Attacks Against Machine Learning Models. 2017 IEEE Symposium on Security and Privacy (SP) (pp. 3–18). https://doi.org/10.1109/SP.2017.41
Veale M. & Borgesius F. Z. (2021). Demystifying the Draft EU Artificial Intelligence Act – Analysing the good, the bad, and the unclear elements of the proposed approach. Computer Law Review International, 4(22), 97–112. https://doi.org/10.9785/cri-2021-220402
Wang R. Y. & Strong D. M. (1996). Beyond Accuracy: What Data Quality Means to Data Consumers. Journal of Management Information Systems, 4(12), 5–33. https://doi.org/10.1080/07421222.1996.11518099
zakon.rada.gov.ua. (2010, June 1). Zakon Ukrainy «Pro zakhyst personalnykh danykh» [Law of Ukraine "On Personal Data Protection"]. https://zakon.rada.gov.ua/laws/show/2297-17#Text
zakon.rada.gov.ua. (2017, October 5). Zakon Ukrainy «Pro osnovni zasady zabezpechennia kiberbezpeky Ukrainy» [Law of Ukraine "On the Basic Principles of Ensuring Cybersecurity of Ukraine"]. https://zakon.rada.gov.ua/laws/show/2163-19#Text
Zuboff S. (2019). The Age of Surveillance Capitalism: The Fight for a Human Future at the New Frontier of Power. New York: PublicAffairs.