CISA joint principles for integrating AI into operational technology: what plant and infrastructure buyers can ask vendors

Why this page: the site covers IEC 61511 SIS life-cycle questions for AI and what assessors expect from process-industry ML. Those are standards-side views. This page adds a government cybersecurity view for owners of operational technology (OT). It quotes the guidance’s PDF. CISA’s web page for the same document currently renders the title with the term Super Intelligence; the PDF title above is the document’s own, and the site’s EO 14434 note explains the terminology question.

What it is

CISA’s publication page describes joint cybersecurity guidance for critical infrastructure owners and operators co-authored with the Australian Signals Directorate’s Australian Cyber Security Centre, with partners including the NSA AI Security Center, the FBI and the cyber agencies of Canada, Germany, the Netherlands, New Zealand and the United Kingdom. The PDF’s version history says December 3, 2025: Initial version.

The four principles

The PDF lists them in its introduction: Understand AI. Consider AI Use in the OT Domain. Establish AI Governance and Assurance Frameworks. And Embed Safety and Security Practices Into AI and AI-Enabled OT Systems. (The table of contents words Principle 4 slightly differently; we follow the introduction.)

What to ask OT vendors

Section 2.3 says owners and operators should demand transparency and security considerations from OT vendors regarding how AI technologies are embedded into their products. Items under it include:

• Negotiate contractual agreements that ensure OT vendors provide explicit details on AI features and functionalities.
• Require OT vendors to provide information on how AI is embedded into their OT products (including by requesting vendors provide an SBOM) and the supply chain of the models used. See the SBOM and AIBOM article.
• The AI vendor should disclose if they have discovered an indication that the AI can provide improper advice or take inappropriate action.
• A data-usage policy: Operators may not want vendors to train AI on operational data as it could include IP or be sensitive.

The same section notes that Some OT devices now come with built-in AI technology, which may require internet connectivity to function. That is a procurement question before it is a security one.

Testing and failsafes

Section 3.3 says Operators should initially conduct tests of the AI system on infrastructure specifically designed for testing. and that Operators should only move the AI system into production for additional testing after sufficient testing in a non-production environment.

Section 4.2 says to Establish failsafe mechanisms that enable AI systems to fail gracefully without disrupting critical operations. It also says to Incorporate new AI system failure states, including how to bypass or replace an AI system, into existing functional safety and incident response processes.

Gaps the guidance admits

Section 3.4 lists regulatory challenges, including Current international AI technical standards are broadly aligned to the deployment of AI systems into IT environments. and AI systems may not meet the rigorous safety standards required in critical infrastructure and OT environments. That is a government statement that no standard yet fully fits AI in OT.

For the data side, CISA’s separate guidance highlights the critical role of data security in ensuring the accuracy, integrity, and trustworthiness of AI outcomes; the OT guidance points to it for protecting OT data.

How a buyer can use it (editorial judgment)

This section is the site’s judgment, not CISA’s. The vendor-transparency list works as a short addendum to a purchase order: AI features named, model supply chain disclosed, improper-advice notices, data-use limits. The failsafe sentences map onto a hazard-analysis question your functional-safety team already asks: what is the safe state when the AI is bypassed? None of this is a compliance requirement. The document is guidance, and it is not a substitute for IEC 61511 or the plant’s own safety case.

Questions

Is this guidance mandatory?

Nothing in the PDF text we fetched makes it a regulation. It is joint cybersecurity guidance addressed to owners and operators.

Does it cover large language models?

The CISA page says the guidance focuses on machine learning, large language model-based systems and related AI; read the PDF’s scope section for the exact list.