Essential services regulation treats an AI system as part of the service itself. Under the NIS Regulations 2018 and the NCSC Cyber Assessment Framework, operators must show the system is secure, resilient and accountable. In practice that means AI running on hardware you own, working offline, with every consequential action signed and independently verifiable.
What does essential services regulation actually require of an AI system?
It requires you to treat the AI as part of the service, not as a tool sitting beside it. The Network and Information Systems Regulations 2018 oblige operators of essential services to take appropriate and proportionate technical and organisational measures to manage risk to their network and information systems, and to prevent or minimise the impact of incidents on continuity of service. Nothing in that wording carves out a system because it happens to use a model.
So the first question is not what the AI can do. It is where it sits. If it informs a dispatch decision, a maintenance priority, a network configuration or a safety judgement, it is inside the regulated boundary. And your competent authority does not assess your supplier. It assesses you. When someone asks why the system recommended what it recommended on the night of an incident, "we have logged a ticket with the vendor" is not an answer you can give twice.
I have watched procurement teams treat an AI purchase as a software purchase, with a security questionnaire bolted on at the end. In this sector it is closer to adding a new asset to the estate. It needs an owner, a risk assessment, a documented failure mode and a decommissioning plan, on day one.
Which rules apply when AI touches critical national infrastructure?
Work out which of three layers you sit in, because they stack. The first is the NIS Regulations 2018, covering operators of essential services in energy, transport, drinking water and digital infrastructure, each with its own competent authority named in Schedule 1: the Secretary of State for Energy Security and Net Zero, acting jointly with the Gas and Electricity Markets Authority for electricity; the Secretary of State for Transport; the Secretary of State for Environment, Food and Rural Affairs for drinking water in England; and Ofcom for digital infrastructure.
The second layer is sector security law. For telecoms that is the Telecommunications (Security) Act 2021 and the regulations made under it, enforced by Ofcom, which set duties out in far more specific terms than NIS does, down to how you handle privileged access and the security of equipment and suppliers.
The third layer is data protection. If the system touches personal data, UK GDPR accountability applies, a data protection impact assessment is likely to be mandatory, and Article 22 constrains decisions taken solely by automated means where they have legal or similarly significant effects on a person. The ICO is the regulator there, and its guidance on AI and data protection is the practical starting point.
The Government has also set out plans to widen the NIS regime through the Cyber Security and Resilience Bill, with more attention on managed service providers and on supply chain. I would not design an essential services deployment on the assumption that today's perimeter is the final one.
How does the NCSC Cyber Assessment Framework change an AI deployment?
The CAF is where an abstract duty becomes a set of questions someone will score you against. It has four objectives: A, managing security risk; B, protecting against cyber attack; C, detecting cyber security events; D, minimising the impact of incidents. Under each sit contributing outcomes, and an assessor marks every one of them achieved, partially achieved or not achieved.
Run a remote AI service through that honestly. Objective A asks whether you understand and control your assets and your supply chain dependencies, which is difficult when the model, the weights and the inference stack all belong to someone else and can change without notice. Objective C asks whether you can detect and investigate events on your own systems, which is hard when the logs live in another tenancy and reach you summarised. Objective D asks whether you can continue the service through disruption, which is an awkward conversation when the intelligence layer is reachable only over the internet.
Moving the system onto hardware you own does not score well automatically. It does put every one of those outcomes back inside your control, where you can evidence them rather than point at somebody else's certificate. The NCSC and its international partners have published guidelines for secure AI system development, and they are written on the assumption that you know what is in your system. That assumption is only true if you hold it.
Why does offline operation matter more than features here?
Because an essential service is judged on its worst day, not its average one. Water is pumped, trains are signalled and networks are restored during the outage, not after it. If the AI layer stops when the link stops, then either it was never load-bearing, in which case it is hard to justify the spend, or it was, in which case you have added a single point of failure to a service the public relies on.
This is the plainest test I know to put to any vendor: pull the network cable, then see what still works. Our answer is that the Mickai Sovereign Intelligence Operating System runs on hardware the customer owns, is capable of operating fully offline, and moves no data off the estate. That is not a privacy flourish. It is a resilience property, and in this sector resilience is the requirement.
Features are straightforward to add later. A dependency on somebody else's availability is very hard to remove later.
What can an auditor actually check after the fact?
An auditor can check that every consequential action was recorded, that the record has not been altered since, and that a named person approved it, without us in the room. This is where most AI deployments in regulated settings come apart, because a chat transcript is not evidence. It can be edited, it proves nothing about who approved what, and it does not survive a serious challenge from an inspector or a court.
We record every consequential action in an Open Audit Record. Each entry is sealed with ML-DSA-65, the post-quantum signature scheme NIST published as FIPS 204 in 2024, and the NCSC has been clear that organisations running long-lived systems should be planning their migration to post-quantum cryptography now rather than at the deadline. The record is tamper-evident, and that word is chosen carefully. Nobody can stop a determined party altering a file. Altering it makes verification fail, which is the property you actually need. An auditor can export the record and verify it offline, with a public key, using tools that are not ours. That last clause is the one that counts: evidence you have to trust us to validate is not evidence.
Consequential actions also wait for a named person to approve them. That gives you the accountability trail the CAF governance outcomes and UK GDPR both expect, and it keeps the human decision where the regulation assumes it already is.
What does a sensible first deployment look like?
Narrow, and on your own estate. Pick one workload where the current cost is analyst time rather than control authority: incident write-ups, asset documentation, supplier assurance questionnaires, drafting regulatory returns. Prove the audit record end to end, with your own auditor, before the system goes anywhere near an operational decision. Then widen it deliberately, one workload at a time, with the failure mode written down before each step.
SIOS ships as 63 studios, 14 of them production-ready at launch and 49 in development, with 50 specialised models behind them. Start with one studio, one team and one measurable task. Our closed beta is open, and one regulated company is onboarding as a design partner.
None of this is an argument against the companies that build the compute or the cloud layer. For work that is not regulated, renting capacity is often the right call and we are not trying to talk anyone out of it. What I do not accept is the assumption that a water company, a rail operator or a network provider must ship its operational data offsite and take a supplier's word for what happened to it. That is a commercial arrangement presented as a technical necessity.
Mickai LTD is a UK company, Companies House 17166618, held privately by its founder. MICKAI is a registered UK trade mark, UK00004373277. The architecture behind SIOS is covered by 104 filed UK patent applications carrying 2,340 claims, filed and not granted. I set all of that out for one reason: in essential services you are buying a dependency, and you are entitled to know exactly what you are depending on.
Frequently asked questions
Do the NIS Regulations 2018 apply to an AI system?
They apply to the network and information systems an operator of essential services relies on, and an AI system used in that service is one of them. There is no exemption for machine learning. If the system informs an operational decision, it sits inside the regulated boundary and the same security and continuity duties apply.
How is AI assessed under the NCSC Cyber Assessment Framework?
Against the same contributing outcomes as any other system, across the four CAF objectives: managing security risk, protecting against attack, detecting events, and minimising incident impact. An assessor marks each outcome achieved, partially achieved or not achieved. Remote services tend to struggle on asset and supply chain understanding, on event detection, and on operating through disruption.
Can AI run fully offline in a utility or transport environment?
Yes, if it was built for it. SIOS runs on hardware the customer owns and is capable of operating with no external connection and no data leaving the estate. The test to put to any vendor is simple: disconnect the network and see which capabilities survive. In essential services that answer matters more than the feature list.
What evidence does a regulator accept about an AI decision?
Something checkable without the vendor in the room. Every consequential action in SIOS is written to an Open Audit Record and sealed with ML-DSA-65, the post-quantum signature scheme published by NIST as FIPS 204 in 2024. An auditor can export that record and verify the signatures offline with a public key, using third-party tools.
Does an AI system need human approval in critical national infrastructure?
In practice, yes, for anything consequential. UK GDPR Article 22 restricts decisions taken solely by automated means with legal or similarly significant effects, and CAF governance outcomes expect a named owner for risk decisions. SIOS holds consequential actions until a named person approves them, and records who approved what, when.
Written by Micky Irons, founder and chief executive of Mickai LTD, which builds a sovereign AI operating system for regulated organisations. More at mickai.co.uk.
Top comments (0)