Integrating Cybersecurity, Risk Management, and Procurement Governance for AI Technology Acquisition

Abstract

In the fast-paced world of technology acquisition, the advent of artificial intelligence (AI) has created a complex governance issue where organizations must navigate cybersecurity, risk, data, supplier reliance, algorithmic accountability, and regulation all at once. But these concerns are often addressed by different organizational units, with procurement being concerned about commercial and contractual issues, cybersecurity concerned with technical controls, and risk management with enterprise exposure, leaving gaps of governance when critical assumptions about data, models, vendors and accountability are found in vendor solutions. In this paper, we look at how cyber security, risk management, and procurement governance can be brought together into a single approach in acquiring AI technologies. A qualitative document-analysis approach was used, analyzing peer-reviewed papers, international standards, regulatory documents, cybersecurity frameworks and institutional guidance until December 2025. The corpus was analysed deductively with respect to three main domains – cybersecurity, risk management and procurement governance; with the cross cutting themes emerging inductively. The analysis categorizes AI risk classification and organizational authorization as requirements for the pre-procurement phase, while cybersecurity and supply-chain due diligence are requirements for the contracting phase, technical and performance evaluation are requirements for the post-acquisition phase, and continuous post-acquisition monitoring and assurance and integrated institutional accountability are requirements for the continuous post-acquisition phase. The results suggest that governance needs have to be turned into 'hard' procurement requirements through specifications, evaluation criteria, contractual clauses, acceptance testing, supplier commitments, monitoring and exit clauses. This paper suggests that an Integrated AI Acquisition Governance Framework (IAAGF) is needed, connecting organizational governance, AI risk management, cybersecurity supply chain risk management, procurement controls, and lifecycle assurance, making the point that procurement is a governance mechanism that makes cybersecurity and risk requirements enforceable organizational controls.