AI for utilities requires capability and control

Energy and utility companies are increasingly using AI to transform many aspects of their operations. Common use cases include strengthening cyber and infrastructure defenses, making engineering knowledge easier to find, and reducing the time that employees spend assembling information. Realizing this value requires the same discipline that utilities apply to other consequential technologies, including processes to define operating boundaries, validate performance, and ensure accountability.

For an organization responsible for critical energy infrastructure, model capability is only one part of the purchasing decision. Where AI runs, what information it can access, and what authority it receives determine which workloads a utility can responsibly put into production.

Recent discussions between frontier AI labs and utility executives illustrate an important tension facing critical-infrastructure operators.

North creates a path for utilities to work with engineering documents, asset histories, emergency procedures, customer information, and internal operating knowledge within their controlled environments without the potential for data egress. This allows operators to select an architecture that fits the sensitivity of the workload and its requirements for control over data and infrastructure .

Good governance frameworks, practices, and policies make those boundaries durable. Each workflow should have an accountable owner, approved uses, evaluation criteria, and a change-control process. Traceability should connect a recommendation to its source records and preserve the relevant versions, approvals, and execution logs. Teams also need a tested way to stop a workflow and investigate failures.

A strong business case for a particular project includes licensing, hardware requirements, integration, support, security operations, and ongoing evaluation. It includes a rollout plan that starts with a bounded workflow, then measures the results, and finally expands only when both the value and the controls are demonstrated. This gives the project a defensible basis for investment, and provides the organization with a repeatable method for deciding where AI belongs.

The goal should not be to deploy AI everywhere. It should be to create a controlled foundation on which additional use cases can be introduced when their value has been demonstrated.

It is also: Where does it run? What information can it access? What actions can it take? How is it monitored? And who remains in control?

In this post, we’ll take a look at key considerations for utility leaders and how North can meet a utility organization’s security, data, and operational requirements.

OpenAI’s recent engagement with utilities reflects the growing role of AI in critical-infrastructure cybersecurity. Its September Daybreak announcement describes a gathering of utility leaders whose organizations cover 40 states and Washington, D.C. and collectively serve more than half the US population. The initiative aims to help utilities identify vulnerabilities, analyze suspicious activity, and develop and test fixes.