Continuous developments in the field of AI have led to the rise of new applications across various industries, such as that of cybersecurity. AI’s ability to quickly process large amounts of data makes it a valuable tool for protecting IT systems.
The development and deployment of new AI systems in the European Union (EU) is, now regulated by the EU’s new AI Act, a landmark regulatory framework designed to promote responsible AI development and usage. The AI Act imposes regulations on the protection and use of AI systems, particularly in regards to the explainability and traceability required of these systems. Further developments in industry standards, such as the new ISO 42001 norm, also aim to provide guidance for the use and development of AI systems. Both regulatory and industry standards pose requirements regarding the implementation of safeguards for explainability and transparency for AI systems. These regulations and standards emphasize the need for safeguards that enhance transparency and accountability, ensuring both meaningful insight into AI-driven decision-making and effective mechanisms for human oversight.

This research seeks to consolidate legal and industry standards into a unified framework that offers clear guidance on the implementation of AI-driven cybersecurity solutions in the public sector. The framework aims to outline the current legislatory boundaries, including how regulations such as the GDPR and the forthcoming EU AI Act affect the design, deployment, and monitoring of AI systems. It also proposes different methods to comply with current regulations, such as best practices and industry standards, as well as tools from the field of Explainable AI (XAI) than can be implemented to comply with current regulatory requirements.
These methods were combined to answer the main research question:

How can compliance with current EU regulations be ensured in AI-powered cybersecurity monitoring solutions for public organizations?

An exploratory literature study was conducted to look at the current legal requirements regarding the use of AI systems, as well as any potential additional requirements for their application in the public sector. This was expanded upon by conducting with subject matter experts at DTACT, as well as external experts, to form cybersecurity, regulatory, and public sector perspectives. further elaborated upon by conducting interviews with subject matter experts at DTACT, as well as external experts. A case study was conducted on the cybersecurity solution currently developed and used at DTACT, using the constructed framework. This is followed by a discussion on the public sector implementation of AI solutions for cybersecurity, to gather further insights into the limitations of the framework and to increase its applicability on the needs and requirements of DTACT’s current client base.

Under which conditions can you say that a system is actually and meaningfully under your control? Accidents happen with machines and often that is not the fault of the user. So what does control entail? To gain some modicum of understanding, we need to learn how technology and control relate to one another. Of course, the concept of control also relates to the consequences of control, namely the responsibility you have for that which you can control.
On average,we are used to thinking about technology as a kind of hammer, something on hand that we can make use of. Yet, such a hammer also invites us to hammer things. This invitation is a kind of mediation through which we are encouraged to act in one way and not another. In short, technology can also influence us.
If technology can exert a kind of influence on you, then we need to ask what that means for control. What kind of issues do we run into because of that influence? In this dissertation I investigate a few key issues: self reinforcement and relevancy. Technology tends to entrench itself in society once it is widely implemented. This process of entrenchment is often through self-reinforcement (chapter 2). Like a snowball rolling down a hill that picks up more snow as it goes, so too can technology gain a kind of traction that becomes harder and harder to ignore and disband or even change. Consider, for example, how much has to change if we want to live without cars. The moment technology gets picked up at large, we also institute policies and create institutions around which such technology can be legitimized. The point is that the technology can create a new standard to which everyone grows accustomed...

Large language models (LLMs) are widely used tools that assist us by answering various questions. Humans implicitly use contrast as a natural way to think about and seek explanations (i.e., "Why A and not B?"). Explainability is a challenging aspect of LLMs, as we do not truly understand how good the LLM answers are. The challenge is understanding to what extent LLMs can generate effective contrastive self-explanations for users. We introduce the Contrastive Self-Explanation Method (CoSEM) to narrow the gap between LLMs and explainability. It generates contrastive self- explanations and evaluates them through automation and a user study on generality, usefulness, readability, and relevance. Our results indicate that LLMs are capable of generating effective contrastive self-explanations. Lexical analysis of contrastive explanation indicates that explanations are not less general than the text those explain, and semantic analysis shows that more complex models generalize self-explanations more consistently. Although it is challenging to evaluate contrast in self-explanations semantically, user study shows that some models (Llama3-8B) help understand the contrast. Moreover, task selection affects how readable users find the explanations, where more self-explanations on general topics (movie reviews) are more readable than more specific topics (medical diagnoses). Lastly, some models, such as Llama3-8B, excel at generating contrastive self-explanations that contain relevant information regarding input text.

As stated this research aims to provide insights into the criteria and trade-offs that determine a responsible level of automation when automating decision-making by civil servants through artificial intelligence within smaller public organisations, such as municipalities, in the Netherlands. Making use of expert interviews and vignette experiments in order to provide guidance to those willing to experiment with responsible AI implementation in the public domain.