Cybersecurity agencies in the United States and allied countries have issued new guidance for critical infrastructure operators deploying artificial intelligence in operational technology systems.
New guidance on using AI in operational technology highlights both opportunity and risk across critical systems. The 2026 Artificial Intelligence Summit on March 19 will bring together experts advancing secure, mission-ready AI for the federal enterprise. Reserve your seat to be part of this AI-focused conversation.
The Cybersecurity and Infrastructure Security Agency said Wednesday that the joint document, titled “Principles for the Secure Integration of Artificial Intelligence in Operational Technology,” highlights the growing adoption of AI tools—such as machine learning, large language models and AI agents—to enhance performance, decision-making and efficiency in OT environments, particularly those that support public services. At the same time, the guidance warns that these technologies introduce new pathways for adversarial threats and stresses the need for risk-informed implementation.
How Should Critical Infrastructure Manage AI Security Risks in OT?
“AI holds tremendous promise for enhancing the performance and resilience of operational technology environments – but that promise must be matched with vigilance,” said Madhu Gottumukkala, acting director at CISA.
Describing OT systems as the “backbone of our nation’s critical infrastructure,” Gottumukkala noted that “integrating AI into these environments demands a thoughtful, risk-informed approach.”
What Security Principles Does the AI-OT Guidance Recommend?
The paper identifies four principles organizations should follow when integrating AI in OT environments:
• Understanding AI through training on risks, benefits and development practices
• Assessing AI use in OT based on operational needs and potential system and data impacts
• Establishing AI governance, including through testing and compliance measures
• Maintaining safety and security through operator oversight, transparency and incident response planning
Nick Andersen, executive assistant director for cybersecurity at CISA, said applying the principles will help ensure AI integration is carried out securely and responsibly.
Partners involved in developing the guidance include the National Security Agency’s Artificial Intelligence Security Center, the FBI, and cybersecurity authorities in Australia, Canada, Germany, the Netherlands, New Zealand and the United Kingdom.
