Yes, where the AI system supports an essential service. The Network and Information Systems Regulations 2018 cover air, rail, water and road transport operators, and the duty attaches to the network and information systems behind the service, AI included. The Department for Transport is the competent authority. Mickai runs offline on hardware you own, adding no outward connection.
Do the NIS Regulations cover AI used by transport operators?
Yes. The Network and Information Systems Regulations 2018 regulate services, not technologies, so an AI system sitting behind an essential service is inside the perimeter in the same way a scheduling database or a signalling network is.
The phrase "artificial intelligence" does not appear in the 2018 Regulations. Some operators read that silence as permission. It is not. The duty under regulation 10 is to take appropriate and proportionate technical and organisational measures to manage the risks to the network and information systems your essential service relies on, and to prevent and minimise the impact of incidents. That is a functional test, indifferent to what the vendor calls the product.
So the useful question is not whether AI is regulated. It is whether the essential service degrades when a system returns a wrong answer, a late answer, or none at all. If it does, you are already carrying a regulated dependency, whether or not anyone wrote it into a register.
Which transport operators are in scope?
Air, rail, water and road transport are all named sectors in the Regulations. In-scope operator types include airport managing bodies, air carriers, air traffic management, rail infrastructure managers and railway undertakings, port managing bodies and port facility operators, vessel traffic services, and road traffic management bodies.
Scope turns on two things: the threshold requirements set out in the schedules for your subsector, and designation. Do not self-diagnose from an article, including this one. Read the Regulations for your own operator type, then confirm your status with the Department for Transport, which is the competent authority for transport.
Two traps. Falling below a threshold ends your direct duty, not your obligations to the operators you supply, who pass their own security requirements down in contract. And thresholds bite on measures like traffic or passenger volume, so an operator who sat comfortably outside the regime three years ago may not sit outside it now.
When does an AI system become part of an essential service?
When the service depends on it, and when a failure of that system's confidentiality, integrity, availability or authenticity would change what the service does. Both halves matter, and the second is the one most assessments skip.
Consider a model that ranks asset defect reports from inspection footage and feeds maintenance prioritisation, or one that triages alarm and sensor events in a terminal operations centre so a controller sees a shortlist instead of the full alarm stream. Both are advisory on paper. Both get relied on by controllers working at pace, which makes an integrity failure that quietly downgrades the wrong events an operational failure, not an IT inconvenience.
The distinction to draw is not advisory against automatic. It is whether a named person genuinely exercises judgement before the output takes effect, and whether you can show it. That is a design question you answer before procurement, not a wording question you settle afterwards.
Then there is the AI you did not procure. Staff pasting operational data into a general purpose public tool creates an unmanaged system in the path of your essential service, with no asset record, no access control and no log you can hand an inspector. It is a supply chain problem that arrived without a contract.
How does the Cyber Assessment Framework treat AI?
The Cyber Assessment Framework is the outcome-based tool UK regulators use to judge whether an operator is meeting its NIS duties. The current version, CAF v4.0, was published by the NCSC on 6 August 2025 with improved coverage of AI-related cyber risks throughout the framework and a new section on secure software development and maintenance.
The CAF does not hand you an AI checklist. It sets objectives and contributing outcomes you assess as achieved, partially achieved or not achieved, so a model becomes ordinary work under principles you already report against. Asset management: are the model, its configuration and its reference data in your register, with an owner? Supply chain: who built it, where does inference actually execute, and who can change its behaviour without telling you? Data and system security: what leaves the boundary, and how is the runtime hardened? Security monitoring: can you reconstruct what the system was asked and what it returned on a given shift? Response and recovery: can the service run when the model is withdrawn, and have you tested that rather than assumed it?
Timing is set locally. The move to CAF v4.0 is not mandated centrally: each competent authority sets its own transition expectations. Ask yours which version it will assess you against, and when.
What does the Department for Transport expect from operators?
DfT expects you to assess yourself against the framework, to hold evidence rather than assertions, and to report incidents on time. The Regulations back that with information notices, inspection powers and a penalty ceiling of £17 million, so the evidence question is not academic.
One practical point catches operators out. DfT's sector implementation guidance for transport dates from 2018, while the framework underneath it has moved on more than once since. It will not tell you how your next assessment scores an AI dependency. Treat the framework version your regulator names as the operative document.
On incidents, the duty under regulation 11 is to notify the competent authority without undue delay, and in any event no later than 72 hours after becoming aware of an incident having a significant impact on the continuity of the essential service. Your competent authority sets the significance thresholds for your subsector. Work out in advance how a model integrity or availability failure maps onto them, because settling that at hour 60 is not a plan.
Does the Cyber Security and Resilience Bill change this?
It will change the regime, and it is not law yet. The Cyber Security and Resilience (Network and Information Systems) Bill is before Parliament and has not received Royal Assent, so nothing in it binds you today. Check its current stage on bills.parliament.uk before relying on any timetable.
It amends the 2018 Regulations rather than replacing them, and transport was in scope before and stays in scope. The changes that matter to an operator buying AI sit elsewhere. The Bill brings data centres, medium and large managed service providers, and large load controllers into the regime, and it lets regulators designate critical suppliers so the most important dependencies of an essential service carry mandatory requirements directly. Reporting becomes two-stage: an initial notification within 24 hours, then a fuller report within 72. Reportability widens to incidents capable of having a significant impact, even where the impact never materialises.
Read that last change against an AI deployment. A model integrity incident you caught before it altered an operational decision may still be reportable, and reporting it requires that you saw it. The logging and approval design has to exist before the duty lands. Most of the detail arrives through secondary legislation after Royal Assent, so make your AI dependencies legible now rather than wait for a commencement date.
Why does running offline help an operator of essential services?
Because it removes a class of exposure instead of managing it, and because it makes the evidence question answerable. A system with no outward connection has no egress path to monitor, no supplier-side change you did not sanction, and no third-party availability sitting between your controllers and their decisions.
There is a test I ask buyers to run on anything we propose. Unplug the network for a working day. Confirm that nothing stops, and that nothing left. A supplier who cannot survive that is part of your resilience problem.
Mickai's Sovereign Intelligence Operating System runs on hardware you own, is offline capable, and moves no data off your estate. There are 63 studios in the system, 14 production-ready at launch and 49 in development, with 50 specialised models behind them. Consequential actions wait for a named person to approve them, each sealed in the Open Audit Record under ML-DSA-65, the post-quantum signature scheme NIST published as FIPS 204 in 2024. An auditor exports a record and verifies it offline with a public key, using tools that are not ours.
That is tamper-evident, and the difference from the word buyers usually hear matters. Nothing stops someone altering a record. Altering it makes verification fail, so the change is detectable by a third party who does not have to take our word for anything. One caveat, because inspection and survey paperwork always comes up: a local OCR runtime has read scanned PDFs in controlled tests, and extraction and ingestion integration into SIOS is still being completed.
None of this makes an operator compliant. Compliance is an outcome of your governance and your assessment, and no product delivers it. What running on your own hardware does is narrow the surface you defend and shorten the distance between an inspector's question and a record you can hand over. We are not arguing against the companies building the compute and cloud layer, and cloud remains the right answer for plenty of non-regulated work. We are arguing against the assumption that a regulated operator must rent its intelligence, ship operational data offsite, and accept a supplier's account of what happened to it.
The closed beta is open, and one regulated company is onboarding as a design partner.
Frequently asked questions
Are we an operator of essential services if we run a regional airport?
Airport managing bodies are a listed operator type, but scope depends on the threshold requirements in the Regulations for air transport and on designation. Do not assume either way from passenger numbers alone. Ask the Department for Transport to confirm your status. If you sit below the threshold, aviation security obligations and your airline and handler contracts may still impose comparable security requirements.
Does a cloud AI supplier fall inside our NIS scope?
Your duty covers the network and information systems your essential service relies on, including ones you do not own, so a cloud AI supplier is your supply chain risk and appears in your assessment under the supply chain principle. The supplier may not be regulated itself. You stay accountable for the service, and the Bill would add managed service providers and designated critical suppliers.
Do we have to report an AI failure as a NIS incident?
If it has a significant impact on the continuity of your essential service, yes, under the 72-hour notification duty. The trigger is service impact, not the technology involved, and your competent authority sets the significance thresholds. The Cyber Security and Resilience Bill would widen this to incidents capable of significant impact and add an initial notification within 24 hours.
Does NIS2 apply to UK transport operators?
NIS2 is an EU directive and is not UK law, so UK transport operators are governed by the Network and Information Systems Regulations 2018. It can still reach you if you are established in the EU or provide in-scope services there, in which case a member state regulator is involved too. NIS2 uses the terms essential and important entities.
How do we evidence AI security to a NIS inspector?
Put the model, its configuration and its data in your asset register with a named owner. Show where inference executes and who can change behaviour. Keep a verifiable record of inputs, outputs and approvals for consequential actions. Demonstrate that the service runs without the model. Map all of it to Cyber Assessment Framework outcomes rather than writing a separate AI annex.
Related briefings
UK AI regulation
- Is There a UK AI Act? How the UK Regulates AI Today
- AI Cyber Security Code of Practice: Who It Applies To
- Does Cyber Essentials Cover the AI Tools Your Staff Use?
- ICO Code of Practice on AI and Automated Decision-Making
- ISO 42001 vs ISO 27001: Do You Need Both Standards?
Data protection and UK GDPR
- UK GDPR and AI: Does Your Data Have to Stay in the UK?
- UK Data Storage vs AI Processing: What Is the Difference
Part of a series of 60 briefings on deploying and governing AI in UK regulated organisations, archived with a DOI at 10.5281/zenodo.22975756.
Evaluating AI for a regulated organisation? Mickai runs on hardware you own, offline. Consequential actions wait for a named person to approve them, and what the AI did is sealed into a signed record an auditor can check without us. Applications for the invitation-only closed beta are open. Apply for the closed beta.
Written by Micky Irons, founder and chief executive of Mickai LTD.
Top comments (0)