Policy framework to apply artificial intelligence for the management of records at the Council for Scientific and Industrial Research

Abstract

Purpose

This study aims to investigate how a policy framework can be applied in the use of artificial intelligence (AI) for the management of records at the Council for Scientific and Industrial Research (CSIR) in South Africa. A policy and legal framework enables the records divisions to protect, administer and make their records available in a safe and professional way. Policies play a crucial role in ensuring that records are properly managed.

Design/methodology/approach

Convergent mixed-methods research was conducted, and data were collected using interviews and questionnaires. Data were analysed thematically and statistically and presented in tables and figures.

Findings

The study reveals that the policy framework should also include the application of AI for the management of records. Therefore, this study further concludes that the CSIR should review their policy framework to ensure the application of AI for the management of records is accommodated.

Originality/value

The study proposed a framework to guide the application of the policy framework in using AI for the management of records at CSIR. It is hoped that the proposed framework will serve as a guideline for the implementation of a policy framework in the utilisation of AI in the archives and records management sector.

Citation

Modiba, M. (2023), "Policy framework to apply artificial intelligence for the management of records at the Council for Scientific and Industrial Research", Collection and Curation, Vol. 42 No. 2, pp. 53-60. https://doi.org/10.1108/CC-11-2021-0034

Introduction

A policy framework significantly contributes to effective and efficient management of records. Policies are used to implement strategies and resources to properly and professionally manage records. Therefore, organisations such as the Council for Scientific and Industrial Research (CSIR) need policies to ensure that records are properly managed. A policy framework enables the records divisions to protect, administer and make their records available in a safe and professional way (Rundle, 2009). A policy framework is also used by large organisations such as corporate, educational institutions or government to notify workers about whose endorsement is required to create new policies, what law must be followed when developing new policies, how policies should be interconnected and imposed and what high-level or long-term aims that new policies should attempt to maintain (National Policy Institute, 2019). A policy framework is virtuous only if it assists to achieve a certain objective as follows: where comprehensive legislation prevails on paper, but the regulator is weak and infective and/or poorly resourced; where the justice system is not robust and autonomous; and where legislation prevails, but fewer – if any – of the key shareholders are conscious of its prevalence or comprehend what it refers to (Rundle, 2009). The National Archives and Records Services of South Africa (2006) indicates the constitutional and regulatory outline and policy framework in which comprehensive records management is anchored in the following: The Constitution, 1996, and The National Archives and Records Services of South Africa Act No. 43 of 1996 (1996). This study concentrated on policies that can be used to apply artificial intelligence (AI) for records management. Therefore, this study intends to explore the policies that can be used to apply AI for the management of records at CSIR.

Literature review

Records management policy manual

Section 2.3 of the National Archives of South Africa Records Management Policy Manual states how institutions should manage their electronic records. Electronic records are subject to similar necessities offered in the National Archives and Records Services of South Africa Act (Act No. 43 of 1996) to implement in the management of other records (Records Management Policy Manual, 2004). The manual states that the national archivist has the authority to determine the condition of records, whether they shall be technologically replicated and the condition according to which electronic records system shall be managed. The national archivist would guide the utilisation of AI for the management of records in the public sector. The national archivist will also guide the records management functions to be carried through AI such as classification or filing, retrieval, access to and disposal and preservation of records (Smith et al., 2020).

Managing electronic records in governmental bodies: policy, principles and requirements

The purpose of the policy on managing electronic records in governmental bodies: policy, principles and requirements, is to offer direction to governmental bodies to help them to comply with legislative necessities concerning electronic records as a vital part of the strategic management of their records resources. Section 8.2.2 of the policy on managing electronic records in governmental bodies: policy, principles and requirements, states that this policy addresses the information technology (IT) infrastructure that is needed to manage electronic records in the public sector. The IT infrastructure refers to the development of an integrated document and records management system (IDRMS) that requires specific infrastructure specifications such as inadequacies of workstations, which need advancement before deployment; limitation of server stipulations; network boundaries that may impact reply times; elements that should be reused in the system; and technology direction that was decided by the governmental body (Managing Electronic Records in Governmental Bodies: Policy, Principle and Requirements, 2006).

IDRMS should be linked/connected with the applied AI such as a robotic machine that would be used to manage electronic records effectively and efficiently in the public sector. When records are searched for via IDRMS, they will be retrieved by AI and a robotic machine will be accessed by the user via a database that is also integrated to the IDRMS, AI and robotic machine. The robotic machine used to manage the records will also have specifications such as auto-classification of records, auto-filing, cloud storage facility and effective retrieval and access of records (Ripcord Company, 2019; Demaitre, 2020).

Minimum information security standards

Chapter 4 of the policy on minimum information security standards, regarding the security element of documents – especially those that are classified confidential, secret and top secret – states that they should be maintained. During the classification process, documents need to be classified according to the sensitivity of the document. The degree of sensitivity governs the level of protection, which suggests that information must be granted or classified according to it (Minimum Information Security Standards, 1996). Such documents must not be easily accessed by the general public or unauthorised users. The information officer must put strict security measures in place for protection. Such documents must be protected by encrypted security passwords so that, even when they are stored on the cloud, they would not be easily accessed with passwords. Only people with suitable security clearance or who, by way of exemption, are allowed by the head of the organisation or section would be granted access to such documents (Minimum Information Security Standards, 1996). They will punch in the correct password to access such documents. The utilisation of AI will also require strict security measures to keep secret documents protected. AI and robotic machines and cloud storage will require people to pass the security checks before granting them access to any records that are stored via the robotic machine (Montjoye et al., 2017).

However, the foregoing section looked at the legislative framework to ensure that relevant and appropriate policies and the legal framework are reviewed and taken into consideration when adopting AI and robotic machine for the management of records. Since there is no policy and legislative framework to apply AI to manage records in South Africa, such policies should be formulated when AI is applied to manage records in South Africa. This study used the existing records management policies and legislative framework to adopt AI for the management of records. The researcher looked at what the Constitution of the Republic of South Africa says about the effective and proper management of records. The Constitution therefore gave birth to other legislative frameworks that play a pivotal role in public organisations for various functions, including electronic records management.

Problem statement

The problem that led to this study is that without effective legislations that include the application of AI and robotic machines, the application of AI and robotic machines for effective records management would not be achieved. Policy frameworks play a crucial role in ensuring that records are properly managed. The CSIR also needs policies that would protect its records against unauthorised access. So far, CSIR has no specific policies that can be used to adopt and use AI for the management or records (Modiba, 2021). However, they have policies that include the management of electronic records. Such policies can be reviewed to include sections that can include the use of AI and robotic machines for the management of records. In order for CSIR to effectively adopt and use AI for the management of records, policies should be written to best adopt and use AI for effective records management.

CSIR would not be able to adopt and use AI for the management of records if proper policies are not in place (Modiba, 2021). The policy framework would be able to guide the records management practitioners on how records are created, maintained, stored, retrieved and disposed of through the use of AI and robotic machines. Records management practitioners would also not be able to determinate how AI can be used to manage records if there is not a clear policy on the adoption and application thereof. Therefore, this study seeks to identify policies that can be applied to use AI for the management of records at the CSIR in South Africa.

Research methodology

Convergent mixed-methods research was conducted, and data were collected using interviews and questionnaires. The study was conducted from the perspectives of ontological pluralism and epistemic pragmatism. A convergent design was selected to allow researchers to collect both qualitative and quantitative data from participants, analyse the data independently and combine the responses during data interpretation. The study further used parallel sampling as the sampling technique to collect both qualitative and quantitative data from the same population but using different samples (Creswell and Creswell, 2018; Creswell and Plano Clark, 2018).

Records management practitioners and records managers were the population of this study. They provided information about their knowledge, expertise and expectations regarding the use of AI for records management. The population of this study consisted of a sample size of eight respondents, all of whom were employed by the CSIR. The respondents were one portfolio manager, one records manager, three indexers, two archives’ technicians and one data librarian. The portfolio manager and records manager contributed qualitative data to the study through interviews. Three indexers, two archives’ technicians and one data librarian contributed quantitative data to the study through questionnaires.

Purpose and objectives of the study

The purpose of this study was to investigate how a policy framework can be applied in the use of AI for the management of records at the CSIR in South Africa. The following are the objectives of this study:

• to identify policies that can be used to apply AI for the management of records at the CSIR; and

• to propose a framework for the application of the policy framework to use AI for the management of records at the CSIR in South Africa.

Findings of the study

Availability of policy framework for records management

A policy framework is used to provide guidance on how to manage records in the organisations and assists the organisations to manage their records effectively. Based on this statement, the respondents were asked if there was a policy framework for the management of records at the CSIR. The outcomes show that all six respondents indicated that the CSIR had a policy framework that was used to manage their records.

The interview participants were also requested to comment on how a policy framework was applied at the CSIR. Participants stated that the policy framework governed the CSIR’s records management activities such as the creation, storage, use, maintenance and disposal of records. They replied as follows:

Participant 1 stated that:

The policy governs CSIR records activities so that records are reliable, authentic and accessible. The policy framework advises the organisation on the appropriate infrastructure, resources and processes that need to be in place so that data can be captured, and records disposed.

Participant 2 stated that:

Policies are written in order to guide and govern CSIR since staff is required to comply with policies. The policies govern the efficient management of records at CSIR including all stages of records management such as the creation, use, access, maintenance and disposal of records. The policies govern and protect the confidentiality of CSIR records.

The document analysis reported on the following policies:

The CSIR’s conditions of service dealt with the following:

Working time: This guides the records management practitioners to develop turnaround time to provide a particular records management service. For example, how long it takes to retrieve a file on the shelves or in the system when requested by the users.

Training and development: This propels the CSIR to continuously provide developmental training to the records management practitioners. This helps the practitioners to provide effective records management services.

Policies: This guides the CSIR on how to manage and provide records management services effectively.

Security and privacy: This guides the CSIR on how records should be secured, which records are regarded as confidential and how such records could be retrieved when needed.

The CSIR’s information security policy deals with the following:

Protection of information: This aspect of the policy ensures that the digital records are protected against illegal access and files are encrypted with firewall applications, passwords and security codes.

Backup and recovery: This deals with how electronic records are backed up through the electronic records management system (ERMS) and how deleted files are recovered in the cloud storage facilities. This policy guides the CSIR on how to store records on the clouds.

The CSIR’s privacy policy deals with the confidentiality of personal information of their staff and the users of their services such as the researchers. Although the CSIR collects the information such as the IP address, browser and operating system information of users navigating through the website, such information would not be shared with a third party.

Policy framework used by the CSIR

The CSIR also has its own policy framework that is used to guide it on how to manage its records properly. Hence, the respondents were asked through questionnaires about the policy framework that was used to manage records at the CSIR. All six respondents indicated that they used the CSIR’s records management policy for the management of records.

The document analysis testified that the CSIR’s records management policy covered the roles and responsibilities of the chief executive officer, CSIR management, the chief information officer and the records manager. The policy also explains the records management processes such as records creation, maintenance, use, storage and disposal.

National policy framework used to develop the CSIR policy framework

Organisations in South Africa use the national policy framework to develop their institutional policy frameworks to manage their records. Based on this statement, the respondents were asked about the South African National Archives and Records Management policies that the CSIR used to develop its own records management policy. Figure 1 reports that one respondent specified that the minimum information security standards policy was used to develop the CSIR’s records management policy, one indicated the NARSSA records management policy manual was used and one indicated that the CSIR’s privacy policy was also used to develop the CSIR’s records management policy. One respondent was unsure which policies were used, while five indicated that the NARSSA manages electronic records in governmental bodies: policy, principle and regulations were used to develop the CSIR’s records management policy

The interview participants were also asked which policy was used by the CSIR to manage their records. Participants indicated that the CSIR used the CSIR records management policy to manage records effectively and efficiently. They responded as follows:

Participant 1 stated that:

CSIR records management policy is used to manage records. The policy helps govern the effectiveness and efficiency of records management at CSIR, ensure good records management practice and ensure the integrity of records, long-term access and disposal of records.

Participant 2 stated that:

CSIR records management policy is utilised to manage records at CSIR. The policy is used to govern and guide so that the staff has a clear direction on how things are done at CSIR and how CSIR requires the staff to manage records, and also the policy protects the intellectual output of staff at CSIR. The policy also guides on access, use and disposal of records at CSIR.

The researcher observed that staff used the following policies to develop the CSIR’s records management policy: the CSIR’s conditions of services, information security policy, privacy policy and good research guide.

Records management activities covered in the CSIR policy framework

A policy framework can be used to provide guidance on how to manage different kinds of records management activities in an organisation. Hence, the respondents were asked to identify records management activities that were covered by the CSIR policy framework. Six respondents indicated that the CSIR records management policy covered the following records activities: receiving records, records preservation and conservation, records maintenance and use and records disposal.

The interview participants were also asked to indicate the records management activities that were covered by the CSIR’s records policy framework. Participants identified the records management activities as follows: creation of records, use of records, records maintenance and disposal of records. Their responses were as follows:

Participant 1 stated that “The policy covers the creation of records, records maintenance, use and disposal of records”.

Participant 2 stated that “The policy covers records activities such as records receiving, records conservation and disposition of records”.

The document analysis confirmed that the following activities were covered in the CSIR’s records management policy:

• Records creation and recipients: Records are created in various formats, including paper and electronic formats. It is the responsibility of the record creator to ensure that records are complete, reliable, authentic and available for access and use. Employees creating documents must follow the document management procedure. Records received from external parties during the execution of the CSIR functions will be managed and retained in accordance with the file plan retention schedule.

• Records storage: Electronic records are stored in relevant records management systems listed in the file plan. Transactional electronic records are managed within the applicable transactional systems and in accordance with the prevailing system procedures. Security, privacy and confidentiality of electronic records are ensured as per the information security policy. Records in paper format with enduring value are transferred to the archives as soon as it is feasible to do so. Retention periods of records are determined in consultation with users and considering prevailing legislation, contractual commitments and organisational needs. Data sets are managed and stored according to the data management procedure.

• Records maintenance: The upgrading of organisational systems and the migration of electronic records must be managed appropriately to ensure that records remain retrievable, authentic and available when required. Long-term accessibility of records is ensured through the long-term preservation and disaster recovery procedure for records. Physical records are maintained as per the archive’s procedure.

• Records access: The CSIR’s records are not automatically in the public domain, and the CSIR, at its own discretion, determines which records will be made publicly available. Specific guidelines regarding requests for information are contained in the Promotion of Access to Information Act manual, which is maintained by the DIO and/or his/her delegated authority. Confidentiality and non-disclosure clauses, as specified in the CSIR’s conditions of service, apply. Only authorised staff may disclose CSIR records that are not in the public domain. The DIO will authorise appropriate staff members to disclose records that contain personal information of any member of staff of the CSIR, when necessary. Authorisation to disclose other records will be obtained through the CSIR records manager who will consult applicable management structures. Records are shielded against unauthorised access and tampering to protect their authenticity and reliability as evidence of the business of the CSIR.

Records disposition: Disposition of records comprises archiving, as well as destruction of records. The CSIR has established its own physical archives on the Pretoria premises and consequently no archival records are transferred to the National Archives of South Africa. Records that are due for destruction will be deleted or disposed of as required. The disposal authority stipulated in the CSIR file plan serves as the guideline for decision-making.

Gaps in the policy framework for records management

Policies can have gaps that will hamper organisations in the proper management of their records. Hence, the respondents were asked through an open-ended question in the questionnaire if there were gaps in the CSIR policy framework. Respondents indicated that the policy framework did not cover the use of ERMS for effective management of records. Respondents further stated that there was no full compliance with the policy when managing records. The responses were as follows:

Respondent 1 stated that “There is no full compliance of policies within organisation”.

Respondent 2 stated that “The policy does not fully cover the section of electronic records management”.

Respondent 3 stated that “The policy does not cover effectively the use of effective electronic document management system at CSIR”.

Respondent 4 stated that “The policy so far covered everything needed to be covered”.

Respondent 5 stated that “There are no gaps in the current policy”.

Respondent 6 stated that “I don’t know if there is a gap in the current policy”.

The interview participants were also requested to identify the gaps in the current CSIR records management policy. Participants indicated that the records management policy covered all the critical components of records management at the CSIR as the policy had just been reviewed recently. Participants replied as follows:

Participant 1 stated that “All the gaps have been addressed since their current policy has just been revised”.

Participant 2 stated that “The policy is addressing everything that need to be addressed at CSIR”.

The document analysis reported that the CSIR records management policy did not cover the management of electronic records and the use of IT for the management of records.

Improvement on the CSIR policy framework for records management

Some of the policy frameworks need to improve to include critical aspects of records management functions. Hence, the respondents were asked through an open-ended question in the questionnaire if the CSIR policy framework needed improvement. Respondents stated that the CSIR policy should be executed effectively and fully. The following were the responses:

Respondent 1 stated that “The policy should address the full compliance within the organisation”.

Respondent 2 stated that “The staff need to ensure that they apply the policy effectively and efficiently”.

Respondent 3 stated that “The policy should allow the records management practitioners to identify and use effective and efficient electronic document management system”.

Respondent 4 stated that “The policy needs no improvement, but it should be enforced”.

Respondent 5 stated that “The current policy was just amended, so there is no need for the improvement”.

Respondent 6 stated that “I don’t know where the policy can be improved”.

The interview participants were also requested to comment on how the CSIR policy framework can be improved. Participants mentioned that the only challenge the CSIR faced with regard to the policy framework was the implementation. They indicated that the CSIR’s records management practitioners are hesitant to execute the policy. Their responses were as follows:

Participant 1 stated that “The only improvement needed is the execution of the policy at CSIR to ensure records are effectively managed”.

Participant 2 stated that “The policy must just be fully implemented to ensure that the records are effectively managed”.

Discussion of the results

Availability of policy framework for records management

The availability of the policy framework would ensure that the records management practitioners are guided on how records should be managed (Mosweu, 2019). The policy framework guides the records management practitioners on how records were created, used, maintained, stored and disposed of Marutha (2019). As reviewed in chapter two, the policy framework enables the records management divisions to protect and administer their records availability in a safe and professional way (Mosweu, 2019). According to Katuu and Van der Walt (2016), organisations use the available legislative frameworks to develop their own policy framework. Organisations such as the CSIR also use the national policy framework compiled through NARSSA Act No. 43 of 1996 to develop their own policy framework that is used to manage their records. Hence, six respondents indicated that they used NARSSA Act No. 43 of 1996 such as “Managing electronic records in governmental bodies: policy, principle and regulations” to develop the CSIR records management policy for the management of their records.

They were also followed by the majority of five respondents who also acknowledged the availability of the national policy for records management. Only one respondent indicated that they used the following policies developed under national policies in South Africa to manage records: minimum information security standards policy and the records management policy manual.

The respondents further affirmed that they used the CSIR records management policy to effectively manage their records. Participants articulated that the policy governed the CSIR’s records activities so that records were reliable, authentic and accessible. The policy framework was used to provide guidance on organisation with regard to appropriate infrastructure, resources and processes that were required to be in place so that data could be captured and disposed of. They further affirmed that the policies were written to provide guidance to the CSIR since the staff was required to comply with the policy framework when managing records. The policy governed the efficient management of records at the CSIR including all stages of records management such as the creation, use, access, maintenance and disposal of records. The policy also governed and protected the confidentiality of records at the CSIR.

The document analysis report further concedes that the policies that were used for records management were as follows: the CSIR’s conditions of service, records management policy, and information security policy and privacy policy. The policy framework was used to govern and guide the employee on good records management practice at the CSIR. Document analysis reported that the CSIR records management policy covered the roles and responsibilities of the Chief Executive Officer, CSIR management and the Chief Information Officer and Records Manager. The policy also provided guidance on access, use and disposal of records at the CSIR. The document analysis report indicated that the staff used the CSIR conditions of service, information security policy, privacy policy and good research guide to develop the CSIR records management policy. The researcher also observed that the CSIR used its records management policy to manage its records.

Records management activities covered in the CSIR policy framework

Netshakhuma (2019) alluded that a policy framework is used to manage and facilitate the records management processes or activities. The policy framework covers the records management processes such as records creation, use, maintenance, digitisation and disposal (Netshakhuma, 2019). Hence, six respondents indicated that the CSIR used the policy framework for creating records, records preservation and conservation, records maintenance and use and records disposal. Netshakhuma (2019) opines that the utilisation of the policy framework is to ensure that there is good records management practice at the CSIR. Participants affirmed that the policy covered the creation of records, records receiving, records maintenance, use, records conservation and disposal of records. Document analysis report echoes that the policy included the following records activities: records creation and receipts, records storage, records maintenance, records access and records disposal.

Gaps in the policy framework for records management

On the other hand, organisations fail to provide good records management services because their policies were not well written and do not cover all aspects of records management programmes in the organisation. A policy framework should not have gaps that would affect the proper and effective management of records in both private and public organisations (Katuu and Van der Walt, 2016). However, respondents articulated that there was no full compliance of the policy framework at the CSIR, and the policy did not fully cover the section of and use of effective ERMS. However, respondents affirmed that the policy so far covered all aspects of records management at CSIR such as records creation, use, maintenance, storage and disposal. Participants echo that all the gaps have been addressed since their current policy has just been revised and the policy addressed everything that needed to be addressed at the CSIR in terms of records management. The document analysis report on the CSIR records management policy indicated that there should be full compliance of the policy. This was because the CSIR records management policy framework came into effect on 6 January 2020; therefore, the policy is still new and relevant.

Improvement on the CSIR policy framework for records management

The improved records management policy would be error-free and include all aspects of records management that are frequently infused as records management trends surface. An improved policy would assist organisations to manage their records effectively (Mosweu, 2019). Hence, respondents pronounced that the improved CSIR records management policy addressed full compliance within the organisation; staff needed to ensure that they applied the policy framework effectively and efficiently; and allow the records management practitioners to identify and use it effectively and efficiently for the ERMS. Participants articulated that the only improvement needed was the execution of the policy framework at the CSIR to ensure records are effectively managed. The policy must just be fully implemented to ensure that the records are effectively managed. The policy was last reviewed on 6 January 2020. The policy reported that issues pertaining to compliance were revised regarding the policy when records management services were rendered.

Recommendations and conclusion

Recommendations

The national policy framework should be used to develop the CSIR policy framework, electronic systems and records management framework. The policy framework should govern the CSIR on how to use the policy framework to manage its records activities for compliance purposes. The policy framework should guide the organisation on how records should be created, stored, used, maintained and disposed of. The CSIR should be used to implement the policy on managing electronic records in governmental bodies: policy, principle and regulations framework to develop the CSIR records management policy. The CSIR should use the policy framework for receiving records, records preservation and conservation, records maintenance and use and records disposal. The policy framework should be implemented, and compliance with the CSIR records management policy should be of paramount importance. Therefore, the CSIR policy framework should also include the application of AI for the management of records.

Proposed framework

The study proposes a framework to apply the policy framework to guide the utilisation of AI for the management of records at the CSIR (see Figure 2). The framework is based on the AI and policy framework in South Africa, which are known to guide issues of compliance in the management of records.

This model deals with the policy framework that should be applied to use AI for the management of records at the CSIR in South Africa. The model begins with AI, which among others, includes the following: robotic machines, natural language processing, deep learning and machine learning. The AI algorithms would then be infused in the policy framework to ensure that the records management policies cover the introduction of disruptive technologies such as AI. AI would be infused in the records management policy manual, managing electronic records in governmental bodies: policy, principle and requirement, as well as minimum information security standards. AI will be outlined in the records management policy framework on how records are managed through AI and robotic machines. If properly infused in the records management policy framework, AI would ensure that records are effectively managed at the CSIR in South Africa.

Conclusion

In conclusion, policy framework plays a crucial role in ensuring that records are properly managed. For the purpose of using AI and robotic machines, organisations should draft and implement policies that would allow them to effectively apply AI for the provision of effective records management services. The CSIR should also use the policy framework to draft and establish the records management framework that infuses AI. However, the CSIR also used the records management policies to develop its own customised records management policy. Such policies included: managing electronic records in governmental bodies: policy, principle and regulations, minimum information security standard policy, records management policy and CSIR privacy policy. This study further concludes that the CSIR should review their policy framework to ensure the application of AI for the management of records is embraced.

Figures

Figure 1

National policy framework used to develop CSIR policy framework (N = 6)

Figure 2

Framework to apply the policies to use artificial intelligence for the management of records