A Reference Model for AI-Assisted Information Security GRC: Roles, Control Gates, and Oversight for Enterprise Adoption

Abstract

The growing interest in artificial intelligence for information security governance, risk, and compliance (GRC) has not been matched by equally clear guidance on how such support should be embedded within enterprise governance structures. Existing discussions frequently address AI-enabled use cases, but less often specify the organizational roles, control gates, and oversight conditions needed to support adoption in a controlled and accountable manner. This leaves a practical and conceptual gap for organizations seeking to incorporate AI into GRC without weakening governance discipline.This paper proposes a reference model for AI-assisted information security GRC that offers a structured basis for enterprise adoption. Using NIST CSF 2.0 as the primary structural backbone and NIS2 as regulatory context for the EU setting, the paper organizes AI-assisted GRC around three core dimensions: roles, control gates, and oversight. Methodologically, the study applies a design-oriented conceptual approach to synthesize governance and control requirements into a coherent reference structure. The main contribution is a model that clarifies where AI may assist, where human accountability must remain explicit, and how governance checkpoints can support responsible adoption. A lightweight scenario-based evaluation is used to illustrate applicability and assess conceptual coherence and practical relevance. The paper provides a credible basis for future refinement, case-based application, and empirical study.