Auditing AI-Generated cyber threats in intelligent systems: A risk-based framework with legal considerations

This study proposes a risk-based audit framework for assessing AI-generated cyber threats within intelligent systems. The framework is designed to enable auditors to systematically identify, evaluate, and test threats associated with generative artificial intelligence through a structured and operational auditing process. The methodological approach integrates multiple components, including threat identification, attack surface mapping, risk classification, risk scoring, and scenario-based testing. This integrated process facilitates the evaluation of system behavior under controlled adversarial conditions. The findings indicate that AI-generated threats—particularly phishing, prompt injection, and synthetic content manipulation—can be effectively identified through direct system testing. Systems that lack mechanisms for output validation, monitoring, and logging controls demonstrate significant exposure to critical risks. Furthermore, the likelihood–impact scoring model supports the prioritization of audit procedures, including comprehensive testing and control validation. The study demonstrates that effective auditing of AI systems relies on realistic testing environments and evidence-based evaluation methods. The proposed framework offers a practical, replicable, and scalable approach for translating AI-generated threats into auditable risks and enforceable control mechanisms within intelligent systems.