A Global Data Governance Perspective on Cyber-AI Risk and Institutional Decoupling

Abstract

As governments worldwide deploy AI systems, digital identity infrastructures, and cloud-based public services at unprecedented scale, a systematic and measurable gap is emerging between technical capacity and the policy scaffolding required to make such systems secure, accountable, and trustworthy. This study operationalises that gap as a quantifiable cyber-AI risk profile using cross-national data from the World Bank GovTech Maturity Index (GTMI) 2025 covering 197 economies, triangulated against the UN E-Government Development Index (EGDI) and the ITU Global Cybersecurity Index (GCI). A 13-indicator Cross-Sector Data Governance (CSDG) framework is constructed across four governance layers—infrastructure, policy, institutional, and practice—and a Decoupling Index quantifies the asymmetry between technical deployment and regulatory maturity. Spearman correlations with bootstrap confidence intervals $(B=1000)$, income-controlled partial correlations, Kruskal-Wallis tests $(\eta^{2}$ up to 0.553), and K-Means clustering (ARI = 0.638 against a median-split partition) demonstrate that AI-ethics institutionalisation exhibits the strongest single association with both service-delivery maturity $(\rho=0.742)$ and the ITU Global Cybersecurity Index $(\rho=0.729)$, empirically bridging the AI-governance and cybersecurity literatures. The resulting four-quadrant typology identifies sixteen economies (8.1% of the sample) in an infrastructure-ahead profile—economies that have deployed AI and digital systems without commensurate ethical-AI guidelines, data-protection authorities, or institutional oversight—and proposes this typology as a complementary country-level cyber-AI risk classifier. The findings establish that balanced governance, rather than infrastructure investment alone, is most strongly associated with cyber-secure and trustworthy public AI deployments.