Briefing: AI Risks to Critical Infrastructure

This briefing document provides an analysis of the implications and applications of artificial intelligence (AI) within the context of critical infrastructure (CI) sectors in the United States, with a particular focus on the energy sector. It explores the distinctions between generative AI and classical machine learning, emphasizing their respective roles in enhancing operational efficiency while addressing associated risks. The paper aims to inform regulatory discussions by establishing clear guidelines—referred to as "brightline criteria"—that delineate acceptable uses of AI technologies in industrial control systems (ICS). By engaging various stakeholders, including asset owners, operators, suppliers and regulators, this document seeks to foster a deeper understanding of AI's potential benefits and challenges, ultimately contributing to the resilience and safety of critical infrastructure operations.  
 
Acknowledgments: The International Society of Automation (ISA) along with the ISA Global Cybersecurity Alliance (ISAGCA) fostered a Supplier Working Group to support research conducted by Tim Roxey (Eclectic Technology, former NERC CSO) on this topic. Tim Roxey is working in conjunction with Idaho National Lab and the North American Electric Reliability Corporation (NERC). This briefing does not reflect an official position of ISA.