Legal, Policy, and Compliance Issues in Using AI for Security: Using Taiwan's Cybersecurity Management Act and Penetration Testing as Examples

As artificial intelligence (AI) technology advances rapidly, integrating AI into cybersecurity practices poses new challenges for professionals. This paper focuses on the legal and policy implications of employing AI tools in penetration testing (PT). Key issues explored include liability in cases where AI tools cause damage and legal compliance challenges for organizations mandated to conduct PT. This paper argues that in the case of Taiwan, a comprehensive consideration of relevant laws, such as the Code of Civil Procedure, will be needed as AI products and tools become more widespread. The other issue concerns defining qualified PT, using Taiwan's Cybersecurity Management Act as an example. This paper concludes that, in addition to proper AI governance, governments should consider the legal frameworks necessary for the practical application of AI products or systems and develop appropriate AI safety testing methods to offer reference guidelines for public agencies to introduce risk-controllable AI tools, thus preparing for the transition into the AI era.