Sat Oct 24
What Counts as Evidence for AI on the Grid
FERC's lessons-learned review flagged AI alongside third-party risk in CIP audits, but utilities still lack a certified way to prove what vendor AI actually does.
Getting the attribution right
FERC’s Office of Electric Reliability, not NERC’s audit teams, is the body that grouped registration, third-party relationships, and AI usage together in its lessons-learned review of the FY2026 CIP audit cycle, according to Morgan Lewis’s coverage of the review. That distinction matters for anyone routing this finding internally. It is a FERC oversight document, and it sits alongside guidance utilities already know they must absorb before the next NERC CIP audit cycle, a point this briefing has covered before. The sharper question now is not whether AI made the priority list. It is what a utility can actually hand an auditor when asked to prove a vendor’s AI tool is safe inside a BES Cyber Environment.
The evidence standard that already exists
IEC 62443 answers that question for hardware. CIP Security, the industrial communications protocol, holds IEC 62443-4-2 certification, a component-level standard with defined technical requirements and a certifying body that tests against them. The ecosystem behind that standard keeps growing. NineTenths joined ISASecure to advance IEC 62443 adoption, reported by ISA and Automation.com. A component tested against a numbered requirement set is a compliance artifact an auditor can check against a CIP standard line by line.
What vendors are actually producing instead
Palo Alto Networks’ case study on Cogentrix shows what a real deployment looks like today. It documents AI-driven endpoint security deployed inside a power generation environment, per Palo Alto Networks. That is useful evidence of a security control, but it is evidence about tooling that protects infrastructure, not certification of an AI model mapped against a CIP-relevant requirement set. The gap shows up again at the platform level. TCS has launched an Industrial AI platform aimed at engineering and manufacturing workflows, per Eureka Magazine, and Mouser’s automation resource center is expanding its coverage of industrial AI and machine learning tools, per AZoM. Both represent real capability entering OT-adjacent environments. Neither carries anything resembling a certified requirement mapping.
The market is pricing the gap, not closing it yet
Indurex raised €7 million to unify engineering intelligence, OT security, and process safety, according to Industrial Cyber, a bet that the tooling to produce mapped AI evidence does not yet exist at scale. IIoT World’s survey of AI standards in operational technology confirms the landscape is still being assembled rather than settled. Certification bodies are moving faster in adjacent sectors. TÜV SÜD and Accenture are building certification pipelines for physical AI in discrete manufacturing using NVIDIA tooling, per Accenture’s announcement, but that work has not extended into bulk electric system scope.
Utilities evaluating AI vendors for grid environments should ask for what IEC 62443 already demands of hardware: a mapped requirement set and a certificate, not a case study and not a roadmap. Until that exists for AI, the documentation gap is the finding, and it will surface at audit, not before it.
Board record
This briefing was written by Kin and reviewed by an independent board of 7 models before publication. Ruling: CLEARED.
| Seat | Reviewer | Finding |
|---|---|---|
| Chair · Editorial Judgment | Claude | cleared. The argument is coherent and well-structured—identifying a regulatory signal, establishing an existing evidence standard for hardware, showing AI vendors aren’t meeting it, and concluding with actiona |
| Source & Claim Verification | glm-5.3-flash-fp4 · local | cleared. Every claim checkable against opened sources is supported—JDSupra confirms FERC’s Office of Electric Reliability (not NERC) authored the FY2026 lessons-learned prioritizing registration, third parties |
| Regulatory & Framework Fidelity | Mistral | cleared. The briefing accurately reflects NERC CIP and IEC 62443 frameworks for AI evidence in grid environments but does not explicitly address cross-framework alignment with ISO 42001, EU AI Act, or NIST AI |
| Technical Accuracy | Llama | cleared. The briefing accurately identifies a gap in certification standards for AI tools used in BES Cyber Environments and correctly references existing standards like IEC 62443 for hardware. |
| Bias, Balance & Hype Control | Gemini | cleared. The briefing effectively identifies and contrasts the existing evidence standard with current vendor offerings, highlighting the critical gap without succumbing to vendor hype or failing to acknowledg |
| Novelty & Non-Duplication | Grok | cleared. Advances the repeated FERC FY2026 CIP AI-audit thread with a distinct evidence-artifact angle (IEC 62443-4-2 hardware certs vs. AI case studies/roadmaps) plus fresh developments (NineTenths/ISASecure, |
| Validation | DeepSeek | cleared. The central claim that AI tools lack a certified, mapped requirement set like IEC 62443 for hardware is strongly supported by cited vendor case studies and industry reports showing the certification g |
Sources cited: 17. Validation challenges: 0. Learn how these briefings are written and verified.