Data governance for a sovereign and secure generative artificial intelligence
Keywords:
generative artificial intelligence; data governance; data sovereignty; artificial intelligence ethics; national security; Cuba.Abstract
Introduction: Generative Artificial Intelligence offers transformative opportunities for public administration, but its implementation raises critical risks related to information security and technological sovereignty, especially in contexts of technological asymmetry.
Objective: To propose a specific data governance framework for the use of GAI in the Cuban public sector, designed to protect sensitive state information while harnessing its benefits.
Methods: A systematic literature review (2019-2025), a critical analysis of the Cuban regulatory framework, and a systematization of practical experiences within the central government were conducted through case studies, semi-structured interviews with 29 officials, and participant observation.
Results: Significant regulatory and operational gaps were identified, such as the absence of a National Data Governance Strategy and the inadequacy of current regulations to address specific GAI risks (e.g., prompt injection, data extraction). In response, four interdependent pillars for a governance framework are proposed: data governance with a focus on sovereignty and unified classification; institutionalized ethics and human oversight; technical security of models; and talent development and critical AI literacy.
Conclusions: The presented framework is distinguished by its operationalization in a context of technological asymmetry, integrating existing national regulations and institutional structures such as Cuba's AI Technical Advisory Council. It provides a concrete roadmap to implement the tenets of the Cuban Artificial Intelligence Strategy, positioning data sovereignty as a prerequisite for an autonomous and secure digital transformation in the Cuban public sector.
Downloads
References
1. Ministerio de Comunicaciones. Política para la transformación digital, Agenda digital cubana y la Estrategia de inteligencia artificial. La Habana: MINCOM; 2024 [citado 27 Nov 2025]. Disponible en: http://media.cubadebate.cu/wp-content/uploads/2024/06/Politica_de_Transformacion_Digital_de_Cuba_Agenda_Digital_y_Estrategia.pdf
2. Bommasani R, Hudson DA, Adeli E, Altman R, Arora S, von Arx S, et al. On the opportunities and risks of foundation models. arXiv [Preprint]. 2021 [citado 27 Nov 2025]. Disponible en: https://arxiv.org/abs/2108.07258
3. European Union Agency for Cybersecurity. Cybersecurity of AI and standardisation. Atenas: ENISA; 2024 [citado 27 Nov 2025]. Disponible en: https://www.enisa.europa.eu/publications/cybersecurity-of-ai-and-standardisation
4. Consejo de Estado. Decreto-Ley 78/2023: Sobre la seguridad y protección de la información clasificada y limitada. Gaceta Oficial de la República de Cuba, No. 88 Ordinaria (2024).
5. Consejo de Estado. Ley 149/2022: De Protección de Datos Personales. Gaceta Oficial de la República de Cuba, No. 77 Ordinaria (2022).
6. Consejo de Estado. Decreto-Ley 6/2020: Del Sistema de Información del Gobierno. Gaceta Oficial de la República de Cuba, No. 54 Ordinaria (2020).
7. Consejo de Estado. Decreto-Ley 98/2024: De la Estadística Oficial. Gaceta Oficial de la República de Cuba, No. 51 Ordinaria (2025).
8. Hintze M, De La Chapelle B. The sovereignty of data: A European perspective. In: Chalaby AB, editor. Data governance in the digital age. Ontario: Centre for International Governance Innovation; 2019. p. 15-34.
9. Couldry N, Mejias UA. Data colonialism: Rethinking big data's relation to the contemporary subject. Telev New Media. 2019;20(4):336-49.
10. DAMA International. The DAMA guide to the data management body of knowledge. 2nd ed. New Jersey: Technics Publications; 2017.
11. ISACA. COBIT 2019 framework: Governance and management objectives. Illinois: ISACA; 2018 [citado 27 Nov 2025]. Disponible en: https://www.isaca.org/resources/cobit
12. Beange S. DCAM v3.1: The future-ready framework for strategic data management [Internet]. Projective Group; 2025 [citado 27 Nov 2025]. Disponible en: https://www.projectivegroup.com/dcam-v3-1-the-future-ready-framework-for-strategic-data-management/
13. BigID. What is the Cloud Data Management Framework? (CDMC) [Internet]. 2021 [citado 27 Nov 2025]. Disponible en: https://bigid.com/blog/cdmc/
14. Aldama O, Delgado M, Díaz-Canel M, Rodríguez A. Implementación de Tableros de Mando Integral en la Gestión Gubernamental: Impacto en la Toma de Decisiones Sanitarias Basada en Datos. INFODIR. 2025;(41):e1768.
15. Aldama López O, Delgado Fernández M, Díaz-Canel Bermúdez M. Metodología de los tableros y cuadro de mando integral en la gestión de gobierno orientada a la innovación. Rev Cubana Adm Pública Empresarial. 2022;6(3):e236.
16. Janssen M, Brous P, Estevez E, Barbosa LS, Janowski T. Data governance: Organizing data for trustworthy Artificial Intelligence. Gov Inf Q. 2020;37(3):101493.
17. Organisation for Economic Co-operation and Development. Enhancing access to and sharing of data: Reconciling risks and benefits for data re-use across societies. París: OECD Publishing; 2019.
18. UNESCO. Recomendación sobre la ética de la inteligencia artificial. París: UNESCO; 2021 [citado 27 Nov 2025]. Disponible en: https://unesdoc.unesco.org/ark:/48223/pf0000381137
19. Mohamed S, Png MT, Isaac W. Decolonial AI: Decolonial theory as sociotechnical foresight in artificial intelligence. Philos Technol. 2020;33:655-84.
20. Carlini N, Tramer F, Wallace E, Jagielski M, Herbert-Voss A, Lee K, et al. Extracting training data from large language models. In: Proceedings of the 31st USENIX Security Symposium; 2022; Boston. Berkeley: USENIX Association; 2022. p. 2633-50.
21. Organización para la Cooperación y el Desarrollo Económicos, CAF – Banco de Desarrollo de América Latina. Uso estratégico y responsable de la inteligencia artificial en el sector público de América Latina y el Caribe. París: OECD Publishing; 2022.
Downloads
Published
How to Cite
Issue
Section
License
Copyright (c) 2026 Alfredo Rodriguez Díaz, Omara Aldama López
This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.
Those authors who have published with this journal, accept the following terms:
a. The authors will keep their copyright and guarantee the magazine the right of first publication of their work, which will be simultaneously subject to the Creative Commons Attribution License that allows third parties to share the work as long as the author and first publication of this magazine are indicated.
b. The authors may adopt other non-exclusive license agreements for the distribution of the published version of the work (e.g., deposit it in an institutional telematic archive or publish it in a monographic volume) as long as the initial publication in this journal is indicated.
c. Authors are allowed and recommended to disseminate their work through the Internet (e.g.: in institutional telematic archives or in their web page) before and during the submission process, which may produce interesting exchanges and increase the number of citations of the published work. (See The effect of open access).
