This is the fifth article in the Securing the Future of Industrial Energy Production series.

If you’re the CEO of an industrial production or critical infrastructure company, there’s a question you should be asking: Who, exactly, is watching the AI that’s about to watch over your most dangerous, expensive, or indispensable systems?

Boards love efficiency.
Investors love digital transformation.
Operational leaders love data-driven insight.

Somewhere in the overlap sits artificial intelligence or, more accurately, a rising stack of data-driven models, predictive engines, and self-learning algorithms woven into your industrial operations.

It’s not a question of if your organization adopts AI. The real question is how much trust, control, and assurance you have when your systems begin to adapt in ways your engineers – or your auditors – can’t fully predict.

This is where standards come in.
Or rather, where they don’t yet reach.

Why This Should Keep CEOs Up at Night

When you sign off on operational budgets or digital strategy, you do so on the premise that you can trust the technology stack underneath. Traditionally, that trust is enforced by standards bodies: groups like IEC, ISO, NIST, and national regulators who codify the “rules of the game” for keeping electricity grids, refineries, factories, or pipelines within safe, predictable bounds.

But here’s the rub: much of what you rely on, from IEC 62443 to ISO 27001 to NERC CIP, was written for static systems. Logic diagrams, access controls, deterministic fail-safes. Known threats, known countermeasures.

AI does not respect these lines. It learns, drifts, adapts. And today, your standards don’t fully account for that.

Where the Standards Are Strong

Let’s be clear: your teams are not operating in a regulatory vacuum. Many solid frameworks already exist to keep industrial production safe and secure:

• IEC 62443: The gold standard for industrial cybersecurity. Defines how to segment networks, secure devices, and manage identities in Operational Technology (OT) and Industrial Control Systems (ICS).
• NIST SP 800-82: A trusted resource for securing Industrial Control Systems that is still foundational for utilities, oil and gas, and manufacturing.
• ISO/IEC 27001: The global benchmark for Information Security Management Systems (ISMS). Strong on governance, risk, and compliance. Good at managing confidentiality, integrity, and availability of data – but not behavior of a learning algorithm.
• NERC CIP: For North American power utilities. Enforced and auditable but assumes humans make decisions about grid operations, not machine-learning models.
• Functional Safety Standards (IEC 61508, ISO 13849): These save lives. They ensure that machinery behaves predictably under fault conditions. But they expect systems to be deterministic. A neural net that adjusts itself mid-operation is not.

These frameworks are foundational but they’re designed for yesterday’s threats: patching CVEs, segmenting networks, controlling remote access. They’re not calibrated for a world where the threat might emerge from inside your own AI’s decision boundary.

Where the New Guard Begins

So where does AI fit in?

A few frameworks offer early answers but they stop short of the edge where your turbines spin and your compressors pump.

• NIST AI Risk Management Framework (AI RMF): Released to guide trustworthy, transparent, and accountable AI. A useful foundation for AI governance but not prescriptive for embedded OT systems.
• ISO/IEC SC 42: A technical committee drafting high-level guidance on AI system life cycles, ethics, and governance. Important groundwork yet too general to tackle, say, an AI-driven fault detection model in a gas plant.
• EU AI Act: Europe’s sweeping attempt to regulate “high-risk AI.” It classifies systems and requires risk controls but its practical implementation for hybrid OT/IT environments is still foggy.
• FDA AI Guidance (for medical devices): One of the few domain-specific regulatory examples of “adaptive AI” oversight. Useful analog for how continuous learning might be monitored but the stakes and physics are different when you’re running a refinery or a water grid.

The Gaps That Should Matter to You

Let’s go back to that frozen gas pipeline. The AI drift wasn’t a failure of technology it was a failure of governance. The maintenance team trusted a model they didn’t understand. No one had the training or tools to spot creeping bias in real time. There was no documented standard telling the plant’s safety engineer how to validate that the model’s assumptions were still safe for changing conditions.

If you’re a CEO, your next board packet probably won’t include a section on “adversarial machine learning.”

But maybe it should.

Here’s why: The same innovation driving your predictive maintenance, advanced robotics, or energy efficiency is also opening the door to entirely new classes of risk many of which slip between today’s regulatory cracks.

• Model Drift & Unpredictability
  No functional safety standard today fully addresses what happens when an AI’s behavior shifts in production. For a fixed logic controller, that’s a violation of design. For an AI, that’s normal.
• Data Poisoning & Supply Chain Integrity
  NIST, ISO, and IEC are clear about patching vulnerabilities but less so about defending the datasets your vendors use to train their models. If an upstream contractor ships you a Trojan-horsed AI, where’s the audit trail?
• Hybrid Attack Surface
  AI entangles IT, OT, and cloud. This means that gaps in one domain (like an exposed API) can suddenly become physical safety issues on your plant floor. Many legacy standards treat these layers as separate.
• Accountability Loops
  When an AI makes an incorrect recommendation that your operators act on, who is legally responsible? The standard might call it “human-in-the-loop.” Your insurance policy might disagree.

Why Wait? What Leading CEOs Should Insist On Now

If you accept the premise that regulation always lags innovation, then you know your only choice is to build your own margin of safety.

Here’s how the best CEOs are staying ahead:

• Champion Internal Standards Before External Ones Arrive
  Push your CISO, VP of OT Security, and Head of Engineering to document how AI is used. Insist on an AI risk register. Treat AI changes like code changes: review, validate, monitor.
• Demand Explainability Where It Counts
  Not every model needs to be a black box. For safety- or mission-critical systems, push for explainable AI or hybrid models that combine classic control logic with ML layers.
• Test for Drift & Poisoning
  Don’t accept a model as “done.” Require your teams to plan for re-validation. Test how AI behaves under stress: manipulated data, edge cases, new conditions.
• Harden the Human Factor
  Your people are your last line of defense. Train operators and engineers to spot when an AI output “just doesn’t look right” and to challenge it. JDLR works here too.
• Push the Ecosystem
  Get involved with your industry’s standards groups. Standards move when large operators demand clarity. Insurers and regulators follow the money. Be the voice that says, “This is the gap. Close it before something closes us.”

Right now, industry doesn’t need more regulation. It needs smarter guardrails.

The Regulatory Horizon

Here’s the hard reality: No single standard will solve this for you.

Regulators and insurers will catch up eventually.

NIST has pilot programs exploring AI risk management. IEC has draft working groups looking at secure AI lifecycle management. ISO is shaping committees on ML auditing. But these efforts move at the speed of consensus. Meanwhile, startups and cloud providers keep pushing more autonomy deeper into your plant floor.

The next decade will see a patchwork of updates, new annexes, and domain-specific rules. NIST will refine its AI guidance. IEC will debate new control layers. Regional regulators will clash with global supply chains.

Meanwhile, your board and shareholders will still expect safe, resilient, compliant operations. That means the gap between what’s codified and what’s deployed is your leadership problem to close.

The Bottom Line

Adopting AI can be your biggest operational edge – or your biggest blind spot.

For CEOs, this is a governance gap. Your engineers are busy fighting fires. Your security team can’t reverse-engineer black box models. Your operations team doesn’t want new risk.

But the promise of “self-learning” systems means that a small oversight can spiral – quietly, invisibly, until the regulator is at your door asking:

“Who signed off on this?”

If you’re the CEO signing off on digital transformation budgets this year, sign off on something else too: an unflinching look at where the standards end, and where your responsibility begins.

Your regulators will ask. Your insurers will ask. Your investors should ask. The time to have answers is before your pipelines freeze in the dark.

The worst time to find out the rules didn’t cover you is after you’re on the front page.

If you’re leading the charge on integrating AI into critical production systems and want strategic patterns – not just vendor promises – I publish real-world guidance for teams like yours.

👉 Connect with me on LinkedIn

👉 Look for more articles in this series coming to LinkedIn or maddphysics.com

👉 Visit laurellye.com or schedule a quick call

I publish tactical and strategic insights on securing industrial systems, integrating AI safely, and building resilient architectures that don’t just survive modernization, they lead it.