Critical infrastructure designation and its governance implications
Energy companies — electricity generators, grid operators, gas distributors, oil and gas producers — are critical infrastructure under both the EU AI Act and the NIS 2 Directive. This designation creates the most demanding AI governance obligations in the regulatory landscape. AI used in the supply, distribution, or management of electricity, gas, heating, or cooling is high-risk AI under Annex III, Category 2 of the EU AI Act. The compliance obligations — technical documentation, risk management, human oversight, logging, conformity assessment — apply from the compliance deadline and require proactive preparation.
The critical infrastructure designation also brings NIS 2 cybersecurity obligations that are more demanding than general security best practices. NIS 2 requires essential entities (which includes energy companies) to implement measures covering incident handling, supply chain security, access control, and the secure management of information systems — all of which apply to AI systems used in critical operations. The intersection of EU AI Act and NIS 2 obligations means energy sector AI governance must address both the functional governance requirements (does the AI do what it should, with appropriate oversight?) and the cybersecurity requirements (is the AI secure against attack and resilient in failure?).
Grid management AI: the safety case imperative
AI systems that make or influence decisions about grid operations — load forecasting, fault detection and response, renewable integration, demand response management — are safety-critical systems in the most direct sense: their failure can cause cascading outages affecting millions of people and, in extreme cases, physical damage to infrastructure. The governance standard for safety-critical AI must reflect this consequence profile.
The safety case methodology — developed in aerospace and nuclear for demonstrating that a system is safe to operate — is increasingly being applied to grid management AI. A safety case for grid AI must demonstrate that the system's failure modes are understood and bounded, that the system operates within defined safety parameters, that there are appropriate safeguards for out-of-envelope operation, and that human operators retain meaningful capacity to intervene. This is a demanding standard that goes well beyond the governance documentation required for commercial AI.
