For energy and other critical infrastructure operators, the binding rules are mostly about cyber security, and AI enters through them: as a component of a critical system, as a safety component under the EU AI Act, as something that must be inventoried and governed under the same programs. Canada’s Critical Cyber Systems Protection Act has been enacted with duties that take effect on designation. Ontario’s Cyber Security Standard version 3.1 applies to the electricity sector now. NIS2 and the UK’s NIS Regulations set the European baseline.
Conditionary’s energy pack is deliberately labelled cyber-led. It tracks the future-effective duties so they appear in your plan before they are enforceable, lists what is known to be missing on its watchlist with the source and the date it was checked, and does not pretend to AI-specific energy regulation that has not been written yet.
Decisions the set-up guide asks about
- Grid and asset operations decisions
- Outage and maintenance prioritisation
- Customer service and billing assistants
- Workforce and safety tools
Rules in the pack, among others
- Critical Cyber Systems Protection Act (future duties)
- Ontario Cyber Security Standard v3.1
- NIS2 Directive
- UK NIS Regulations 2018
- EU AI Act infrastructure and safety-component duties
- EU Cyber Resilience Act
Ready to run: The Outstanding items report tracks future-effective duties separately from today's gaps, so planning and compliance are not confused. See the reports.
