Ireland - Cyber Security Guidance on Generative AI

Overview

The National Cyber Security Centre (NCSC) published “Cyber Security Guidance on Generative AI for Public Sector Bodies” on 01 June 2023. The short advisory (8-page PDF) is aimed at Public Sector Bodies (PSBs) in Ireland considering or using Generative AI (GenAI) tools and platforms. It focuses specifically on cyber security risks and mitigations, while acknowledging broader ethical and governance issues are addressed elsewhere by government. The guidance recommends that GenAI adoption be restricted by default, require a clear business case and prior risk assessment, and be accompanied by usage policies and staff awareness measures. The full guidance is available from the NCSC: Cyber Security Guidance on Generative AI for Public Sector Bodies (NCSC PDF, 01 Jun 2023). Additional contextual government AI policy can be found via Ireland’s National AI Strategy: AI - Here for Good (DETE).

Definitions

Generative AI (GenAI): systems capable of generating text, images, audio, video or code (e.g., chatbots, large language models, diffusion models). Public Sector Bodies (PSBs): government departments, agencies and public-service organisations in Ireland that operate and manage public data and service delivery. Data-in: information entered into GenAI systems (user prompts, documents). Data-out: outputs produced by GenAI (answers, summaries, code, images). Enterprise/self-hosted GenAI: vendor enterprise offerings or on-premises models offering contractual controls over data usage and retention. The guidance explicitly refers to risks such as “hallucination” (inaccurate/confidently-stated outputs), privacy exposure, copyright infringement, and adversarial misuse (e.g., enabling phishing, malware, deepfakes).

Governance and Institutional Framework

The guidance situates NCSC advice within the wider Irish whole-of-government AI workstream, including the National AI Strategy AI - Here for Good and subsequent interim public service AI guidelines issued in January 2024 by the Department of Public Expenditure (DPENDR). NCSC, as part of the Departmental and Government cybersecurity architecture, issues operational cyber security guidance; responsibility for AI governance and ethical frameworks is being developed by other departments. PSBs are expected to integrate this NCSC cyber security advice into their own governance processes, procurement rules, and ICT security baselines. The guidance recommends local approval processes (business case, risk assessment sign-off), the involvement of ICT/security teams in procurement and onboarding, vendor security attestation, and cross-departmental coordination for consistent policy application. For NCSC contact and reporting channels see the NCSC site: NCSC Contact & CSIRT-IE.

Key Focus Areas

The document organises risk and mitigation across several focus areas: (1) Data-in risks — do not enter classified, personal, commercially sensitive, or proprietary material into public GenAI models; (2) Data-out risks — validate outputs for accuracy, bias and copyright; (3) Provider and supply-chain security — require evidence of vendor security measures and certifications; (4) Technical hygiene — enforce MFA, robust passwords, logging, patching and vulnerability management; (5) Operational policy — restrict default access, permit only with approved business case, and require staff training; (6) Misuse by malicious actors — recognise GenAI can be used to craft more convincing phishing, automate social engineering, generate malware code, or create deepfakes; (7) Defensive use — GenAI can aid analysis of logs, threat intelligence and phishing simulation if used under secure controls. The guidance gives a concise “Do & Don’t” list (e.g., “Do validate outputs”, “Don’t use public GenAI services for business purposes”, “Don’t use GenAI to draft government policy or respond to public representations”). This mix of technical, procedural and procurement advice is designed for rapid operational adoption within PSBs while broader ethical and legal issues continue to be developed by other government departments.

Implementation Framework

The NCSC guidance recommends a conservative, risk-based implementation framework: 1) Assess business need — require a documented business case; 2) Conduct an appropriate risk assessment covering data protection/GDPR, cyber security, service continuity, and reputational risk; 3) Choose deployment model — prefer enterprise/self-hosted solutions with contractual protections; 4) Vendor assurance — require proof of security controls and international certifications where possible; 5) Apply technical controls — account security, multi-factor authentication, logging and monitoring, vulnerability management and patching; 6) Data handling rules — disable or periodically delete chat histories, do not use corporate emails for public GenAI unless enterprise option authorised; 7) Staff guidance — publish a ‘Do & Don’t’ brief and run awareness training; 8) Integration with procurement criteria — use NCSC procurement guidance templates to embed security requirements for GenAI suppliers. These steps are designed to be pragmatic and layered, allowing PSBs to pilot securely and scale where the risk posture permits.

Monitoring and Evaluation

Monitoring recommendations include continuous logging and monitoring of GenAI service use, maintenance of audit trails for access and queries, periodic review of provider security attestations, and regular re-assessment of risk as model capabilities and provider policies evolve. PSBs are advised to incorporate GenAI usage into existing incident reporting channels (including CSIRT-IE/NCSC), and to measure both security incidents and accuracy/quality issues (e.g., recorded hallucinations, copyright or privacy breaches). The guidance highlights the need to review controls frequently because model training and provider retention/use policies change rapidly; it also recommends liaising with central government AI governance bodies to align monitoring metrics and report cross-government learnings.

Penalties, Liability, and Appeals

The NCSC guidance itself is advisory and does not establish new statutory penalties. It emphasises that non-compliance with the guidance may expose PSBs to existing legal liabilities (notably data protection/GDPR breaches, potential administrative fines, and contractual liabilities) and to internal disciplinary measures under departmental policies. Where a security incident involves personal data, the Data Protection Commission (Ireland) and applicable GDPR enforcement mechanisms would be relevant. Similarly, obligations under NIS/NIS2 and other regulatory frameworks could trigger enforcement actions independent of this guidance. PSBs should therefore treat the guidance as part of their compliance and governance toolkit and escalate incidents using established legal and internal appeal channels.

Relationship to Other Instruments

This cybersecurity guidance is explicitly positioned as complementary to the National AI Strategy (AI - Here for Good) and to the interim public service AI guidelines published in early 2024. It should be used in conjunction with the NCSC Cyber Security Baseline Standards and the NCSC Guidelines on Cyber Security Specifications for ICT procurement. Legal instruments that interact with the guidance include the GDPR (and Ireland’s Data Protection Act), the NIS/NIS2 cybersecurity frameworks, public procurement rules, and forthcoming EU-level AI legislation. PSBs are advised to integrate NCSC cybersecurity measures with ethical, legal, and procurement assessments mandated by other departments.

International Alignment

The guidance recommends alignment with international best practices and vendor assurance frameworks (e.g., internationally-recognised security certifications). It references cross-government objectives to align with EU developments (such as the EU AI Act and NIS2) and Ireland’s participation in international cybersecurity cooperation. PSBs procuring GenAI services from global vendors should therefore seek contractual commitments that reflect EU data-protection and security expectations and ensure that cross-border data flows are lawfully managed. NCSC’s approach mirrors international security-first AI guidance emphasising risk management, vendor scrutiny and conservative data handling for GenAI.

Implementation Timeline

Sources and References