Data protection on a Cloud-Native Infrastructure: experiences over the implementation of AI-driven workflows

About

The convergence of artificial intelligence (AI) and biomedical research is reshaping the way complex datasets are analyzed, particularly in histopathology, where high-resolution imaging plays a critical role in diagnosis and treatment planning. As research institutions increasingly adopt AI-driven workflows, the challenge lies not only in achieving computational scalability and performance but also in ensuring compliance with stringent security and privacy requirements.

This tension becomes especially pronounced when operating within an Information Security Management System (ISMS), where every technological choice must align with established governance frameworks.

In this context, the collaboration between Italian EOSC and BBMRI-ERIC nodes, supported by INFN and Masaryk University's CERIT-SC team, represents a significant step toward building secure, cloud-native infrastructures for medical data processing. The initiative leverages advanced technologies - such as Kubernetes clusters hardened with CIS benchmarks, federated identity management via Keycloak, and containerized AI pipelines - to enable multi-institutional research while safeguarding sensitive health data. These components collectively form a platform capable of hosting deep learning workflows for histopathological image analysis, ensuring reproducibility, traceability, and compliance with security standards.

However, the integration of these technologies within an ISMS environment has revealed operational complexities. Balancing elasticity and modularity with strict security policies requires continuous negotiation between innovation and governance.

This contribution explores the practical experience of achieving a partial equilibrium between these competing demands, highlighting the architectural decisions, security controls, and collaborative strategies that enabled the deployment of an AI-ready infrastructure without compromising data integrity or regulatory compliance. By sharing these…