Paper Number
ICIS2026-2264
Paper Type
Short
Abstract
AI-enabled autonomous drone operations are expanding across critical sectors, from healthcare logistics to infrastructure inspection, yet existing risk frameworks address only exogenous threats and overlook the endogenous risks introduced by AI infrastructures. Through Action Design Research conducted within the XADOT project on autonomous drone organ transportation, this paper proposes an AI-specific risk assessment framework that articulates three interrelated components: AI infrastructure vulnerabilities (algorithmic bias, decisional opacity, accountability gaps), endogenous and exogenous threats, and distributed operational activity domains. Each component is anchored to established IS theoretical lenses on algorithmic fairness, responsible AI, and AI risk management, and mapped onto the European regulatory landscape – Including the AI Act, the Cyber Resilience Act, NIS2, and GDPR – revealing coordination gaps for AI-enabled autonomous infrastructures. The framework is offered as a first analytical step toward a governance-actionable conceptual model in subsequent design cycles.
Recommended Citation
Spagnoletti, Paolo and Polidori, Rachele, "Cyber-Safe Autonomous Drone Operations: An AI-specific Risk Assessment Framework" (2026). ICIS 2026 Proceedings. 7.
https://aisel.aisnet.org/icis2026/security/security/7
Cyber-Safe Autonomous Drone Operations: An AI-specific Risk Assessment Framework
AI-enabled autonomous drone operations are expanding across critical sectors, from healthcare logistics to infrastructure inspection, yet existing risk frameworks address only exogenous threats and overlook the endogenous risks introduced by AI infrastructures. Through Action Design Research conducted within the XADOT project on autonomous drone organ transportation, this paper proposes an AI-specific risk assessment framework that articulates three interrelated components: AI infrastructure vulnerabilities (algorithmic bias, decisional opacity, accountability gaps), endogenous and exogenous threats, and distributed operational activity domains. Each component is anchored to established IS theoretical lenses on algorithmic fairness, responsible AI, and AI risk management, and mapped onto the European regulatory landscape – Including the AI Act, the Cyber Resilience Act, NIS2, and GDPR – revealing coordination gaps for AI-enabled autonomous infrastructures. The framework is offered as a first analytical step toward a governance-actionable conceptual model in subsequent design cycles.
Comments
08_Cybersecurity_and_privacy