Secure AI in OT: how to apply the CISA and NSA principles
AI can help operators, maintenance and engineers, but OT has different rules than IT. Since December 2025 there is joint guidance from nine agencies. This is how we apply it.
Use AI in OT only after checking that it is the right tool and that its benefits justify its risks, keep a human in the loop for critical decisions, push data out of the OT network rather than letting AI reach in, and make sure the process falls back to normal automation or manual operation if the AI fails. These are the core points of the 'Principles for the secure integration of AI in operational technology', published on 3 December 2025 by CISA and Australia's ACSC with NSA, the FBI and partner agencies including Germany's BSI and the Dutch NCSC.
Who published it
The guidance was released on 3 December 2025, led by CISA and Australia's ACSC together with NSA, the FBI, the Canadian Centre for Cyber Security, Germany's BSI, the Netherlands' NCSC-NL, and the national cyber security centres of New Zealand and the United Kingdom. It covers machine learning models, large language models and AI agents.
The four principles and what we do
| Principle | What we do in a project |
|---|---|
| 1. Understand AI | We explain to your team what the model can and cannot do, and where it can be wrong. |
| 2. Consider AI use in the OT domain | We start from a concrete use case with a clear benefit, and we say no when normal automation does the job. |
| 3. Establish AI governance and assurance | Named owners, an agreed data list, logging of what the assistant read and answered, and a review before each extension. |
| 4. Embed safety and security | Read-only access, one-way data flows out of OT, fail-safe fallback, and safety functions kept outside AI. |
Architecture we use
- Data is pushed from SCADA or the historian to a separate zone; the assistant never connects into the control network
- Read-only by default; any write path is a separate design with its own approval
- Engineering changes go to development systems and simulation first; downloads to real controllers stay a manual step
- Every answer shows its sources (alarm, trend, document) so people can check it
How it fits with standards and law
For integrators and service providers, IEC 62443-2-4 sets security requirements during integration and maintenance, and IEC 62443-3-3 defines system security requirements and security levels. In Belgium, NIS2 applies since 18 October 2024; see NIS2 and OT in Belgium. For the EU AI Act and the Machinery Regulation, see our overview of the dates.
Questions we get
Can an AI assistant make safety decisions?
No. We keep safety functions in certified safety systems and keep people in the loop for critical decisions, in line with the guidance.
Does the AI need access to the PLC network?
No. In our setup data is pushed out of the OT network to a separate zone, and the assistant works from there.
What if the AI is down?
Nothing changes for the process. The plant runs on its normal automation; the assistant is an aid, not part of the control loop.
Sources
- NSA: NSA, CISA, and others release guidance on integrating AI in operational technology (3 Dec 2025)
- Australian Signals Directorate (ACSC): Principles for the secure integration of artificial intelligence in operational technology (December 2025)
- IEC: IEC 62443-2-4:2015+AMD1:2017 Security program requirements for IACS service providers (withdrawn 15 Dec 2023, replaced by the 2023 edition) (24 Aug 2017)
- IEC: IEC 62443-3-3:2013 System security requirements and security levels (7 Aug 2013)
- ENISA: Multilayer Framework for Good Cybersecurity Practices for AI (7 Jun 2023)
A new line, an upgrade, or AI for your plant?
Tell us about your project and we will set up a technical call.
2800 Mechelen, Belgium E-mail: info@simsolutions.be Enterprise no. / VAT: BE 0680.932.773