Risk management frameworks for cloud and AI systems: A comparative review

Abstract

The rapid growth of cloud computing and artificial intelligence (AI) has transformed enterprise operations, enabling scalability, automation, and advanced predictive capabilities. However, their convergence introduces complex and interdependent risks, including data breaches, service disruptions, regulatory challenges, and AI-specific concerns such as bias, lack of explainability, and ethical implications. This narrative review synthesizes current literature on risk management frameworks for cloud and AI systems to identify key similarities, differences, and integration opportunities. A structured search of IEEE Xplore, Scopus, and Web of Science was conducted to select high-quality peer-reviewed studies based on methodological rigor, framework comprehensiveness, and relevance to cloud-AI environments. Comparative analysis shows that established cloud frameworks such as NIST RMF, ISO/IEC 27001, and the CSA Cloud Controls Matrix effectively address security, operational, and compliance risks. In contrast, AI-focused frameworks, including ISO/IEC TR 24028, NIST AI RMF, and EU AI guidelines, primarily target governance, ethical, and model-specific risks. Despite these advances, significant gaps remain in unified risk management approaches for hybrid cloud–AI systems, particularly in harmonizing security, compliance, and explainability metrics. To address this, this study proposes the Unified Adaptive Cloud Resilience Framework (UACRF), an integrated risk management model that unifies cloud security, operational risk, AI governance, and model lifecycle risks into a single adaptive framework that combines the strengths of both domains, enabling more adaptive, scalable, and ethically aligned risk mitigation. Unlike existing frameworks that treat cloud and AI risks independently, UACRF provides a unified cross-domain architecture for managing hybrid cloud-AI risk environments. This study also offers actionable insights for the development of resilient, trustworthy, and compliant AI-cloud systems in high-stakes environments. Keywords: Cloud Computing, Artificial Intelligence, Risk Management Frameworks, Integrated Risk Mitigation, Hybrid Cloud-AI Systems.