Google deployed Gemini Enterprise into Constellation Energy nuclear operations. Microsoft is restarting Three Mile Island. Meta committed to 6.6 GW of nuclear capacity. AI is entering the bulk electric system. This guide maps the evidence that NERC auditors will require.
Who this is for: Utility NERC compliance officers, nuclear plant cybersecurity teams, ISO/RTO operations engineers, NERC auditors, energy sector CISOs, and anyone responsible for AI governance in bulk electric system (BES) environments. Also relevant for cloud providers deploying AI services into regulated energy infrastructure.
CRITICAL ASSESSOR NOTICE: SWT3 witness anchors record that a governance event occurred and capture its computational factors. They do not replace assessor judgment. The assessor must independently verify that the substance of each control implementation meets the requirements of the applicable framework. Anchors provide the evidence trail; the assessor determines whether that evidence is sufficient.
Penalty context: NERC CIP violations carry penalties up to $1,000,000 per violation per day under Section 215(e) of the Federal Power Act. FERC has assessed penalties exceeding $10 million in single enforcement actions. AI systems that make autonomous decisions within BES environments without auditable evidence represent a material compliance risk.
The AI industry is hitting a physical power constraint. Training and operating frontier models requires gigawatt-scale, 24/7 baseload power that renewables alone cannot reliably deliver. Hyperscalers are responding by signing the largest private-sector nuclear procurement deals since the 1970s.
| Company | Committed Capacity | Key Partnerships |
|---|---|---|
| Meta | ~6.6 GW | TerraPower, Oklo, Vistra, Constellation |
| ~3.6 GW | Constellation (890 MW uprate + 2,700 MW supply), Kairos Power, Elementl Power | |
| Microsoft | ~835 MW | Constellation (Three Mile Island Unit 1 restart, renamed Crane Clean Energy Center) |
| Amazon | ~2.6 GW | Susquehanna campus, Constellation Calvert Cliffs (690 MW) |
Combined, at least 13 announced projects commit approximately 9.8 GW of nuclear capacity to AI data center operations. This is not speculative planning. These are signed power purchase agreements with construction timelines, regulatory filings, and billions of dollars in committed capital.
But the deals go beyond power delivery. Google and Constellation signed a separate five-year technology alliance to deploy AI directly into nuclear plant operations. This places frontier AI models inside the most heavily regulated operational technology environments in the world.
On October 6, 2026, Google and Constellation Energy announced a 20-year power purchase agreement to bring 890 MW of new nuclear capacity onto the PJM Interconnection grid. The capacity comes from technology and equipment upgrades (uprates) at 11 reactor units across six sites:
The investment exceeds $4.3 billion. First uprate expected online by 2028, with all 890 MW operational before end of 2032.
The more consequential element for compliance teams is the five-year technology alliance. Constellation will deploy Gemini Enterprise agentic workflows into three core operational areas:
The third area is the one that creates compliance obligations. When AI operates inside or adjacent to OT networks that connect to the bulk electric system, it becomes subject to NERC CIP standards. Every AI-driven determination on a BES Cyber System requires a documented audit trail that NERC auditors can examine.
Nuclear power plants are subject to two distinct cybersecurity regulatory regimes that operate simultaneously.
| Regulator | Standard | Scope | Primary Concern |
|---|---|---|---|
| NRC | 10 CFR 73.54, Reg Guide 5.71 | Digital systems affecting reactor safety, security, and emergency preparedness | Preventing radiological sabotage |
| NERC | CIP-002 through CIP-015 | BES Cyber Systems and Electronic Security Perimeters | Bulk electric system reliability |
These regimes overlap on critical digital assets that could cause a plant trip. An AI system deployed at a Constellation nuclear site could potentially need to satisfy both NRC 10 CFR 73.54 requirements (if it touches safety-related digital assets) and NERC CIP requirements (if it touches BES Cyber Systems). The regulatory burden is cumulative, not alternative.
Neither the NRC nor the DOE has issued specific binding guidance on deploying commercial AI models in nuclear plant operational environments. The NRC reviewed 500+ Regulatory Guides and concluded the existing framework is "generally sufficient" for AI. This means AI deployments must satisfy existing requirements without AI-specific carve-outs or accommodations.
The OT network architecture: Nuclear plants use a defense-in-depth, zoned network architecture. Zone 1 (safety systems) is air-gapped with no routable connectivity. Zone 2 (control network) uses industrial protocols isolated by data diodes. Zone 3 (plant network) typically marks the NERC CIP Electronic Security Perimeter boundary. AI deployments will most likely operate in Zones 3 and 4, processing data that flows outward from lower zones via one-way transfers. Direct AI interaction with Zone 1 safety systems would face extraordinary regulatory barriers.
CIP-007 Requirement 4 mandates security event logging on all applicable Cyber Assets. For AI systems operating on BES Cyber Systems, this means:
Every AI model inference, API call, agentic workflow action, and tool invocation on a BES Cyber System constitutes a system-generated event that falls under R4. If the AI acts as a user with interactive access, CIP-007 R5 applies as well: unique user IDs, account lockout on failed attempts, and removal of unnecessary accounts.
CIP-010 Requirement 1 governs configuration changes to BES Cyber Systems. For AI deployments, this means every model update, weight change, adapter swap, prompt template modification, or agentic workflow reconfiguration is a configuration change requiring:
This is the most directly impactful standard for AI operations. Traditional software changes are infrequent and deliberate. AI model updates, fine-tunes, and prompt modifications can be continuous. Each change triggers the full CIP-010 R1 lifecycle.
CIP-013 requires documented supply chain risk management plans covering vendor risk identification, procurement controls, incident notification, and software integrity verification. When a utility deploys Google's Gemini Enterprise into its operations, Google becomes a vendor subject to CIP-013 supply chain risk management. The utility must document how it manages the risk introduced by the AI provider, including access controls, update notification, and integrity verification of model artifacts.
Approved by FERC Order No. 907 in June 2025, CIP-015-1 requires Internal Network Security Monitoring (INSM) inside Electronic Security Perimeters. Phase 1 enforcement begins October 1, 2028 for High and Medium Impact BES Cyber Systems at Control Centers.
The standard requires three capabilities:
For AI deployments, this means AI-generated network traffic (model inference calls, tool invocations, agentic workflow communications) operating inside an ESP will be subject to mandatory anomaly detection. AI traffic patterns must be baselined so that INSM tools can distinguish normal AI operations from adversarial activity.
Records that audit logging infrastructure was operating and capturing events. For CIP-007 R4, this witnesses that the logging system itself was functional during the period under review. This addresses the auditor's first question: not "what did the logs say?" but "were the logs running?"
CIP-007 R4.3 requires 90-day log retention. Verify that audit trail attestations span the full 90-day window. An attestation gap within the retention period means the utility cannot prove logging was operational for that interval.
Records deviations between expected and observed AI system behavior. For CIP-010 R1, drift detection witnesses configuration changes that may not have followed the formal change management process. An AI model that updates its behavior through fine-tuning or prompt modification without triggering the CIP-010 lifecycle creates a compliance gap that drift detection can identify.
Under CIP-010 R1.5, baseline updates must occur within 30 calendar days of a change. If drift detection attestations show behavioral changes with no corresponding baseline update, the auditor has identified a CIP-010 violation.
Records cryptographic verification of model weight file hashes. For CIP-010 R1.6 (software integrity verification) and CIP-013 (supply chain risk management), this witnesses that the AI model artifact in production matches the version that was authorized and tested. When a utility deploys a model from a cloud provider, weight integrity attestation proves the artifact has not been tampered with between the provider's release and the utility's deployment.
For nuclear facilities subject to both NRC and NERC, verify that weight integrity attestations satisfy both CIP-010 R1.6 (NERC) and the software integrity provisions of NRC Regulatory Guide 5.71. The hash verification is the same; the documentation requirements differ.
Records that inference-level logging was operational, capturing model inputs, outputs, and decision factors. For CIP-007 R4.4 (15-day log review), inference logs provide the data that reviewers examine for anomalies. Without inference-level logging, the 15-day review cycle has nothing meaningful to review for AI-driven operations.
When reviewing AI systems in BES environments, verify that inference logs capture enough detail for the 15-day anomaly review to be meaningful. A log that records "model invoked" but not what the model decided provides limited value for identifying anomalous AI behavior affecting grid operations.
Records that an AI system's outputs remained within defined safety boundaries. For grid operations, this witnesses that an AI-driven dispatch decision, voltage adjustment, or load forecast stayed within the operational parameters that the utility defined. If an AI system recommends an action outside safety boundaries, the attestation records that the boundary was enforced.
In nuclear environments, safety boundaries are not suggestions. Verify that safety boundary attestations are produced in real time (not batch), and that boundary violations trigger immediate containment actions with corresponding AI-EMRG.1 records.
Records the provenance and risk assessment of AI components in the deployment. For CIP-013, this witnesses the utility's supply chain risk management for the AI model provider. When the provider is a hyperscaler like Google, the supply chain attestation documents the risk assessment, vendor access controls, and incident notification procedures required by CIP-013.
CIP-013 applies to the acquisition and ongoing management of vendor products. Verify that supply chain attestations cover not only the initial procurement but ongoing vendor risk management, including model update notification and access control reviews.
Nuclear and grid OT environments present a unique challenge for compliance evidence: the systems that most need governance are the ones that cannot connect to external networks. Standard cloud-based logging and monitoring solutions cannot operate inside air-gapped or data-diode-separated OT enclaves.
SWT3 supports local offline verification for precisely this scenario. Witness anchors can be generated, stored, and verified entirely within the OT boundary without any outbound network connection. The anchors are deterministic and self-contained. An auditor can verify them with the CLI tool on an isolated workstation.
For environments where data must eventually leave the OT boundary for compliance reporting, the anchors can be transferred via one-way data diode (the same mechanism used for historian data) without exposing the OT network to inbound traffic. The anchor verification is independent of the transport mechanism.
The Stuxnet lesson: The 2010 Stuxnet incident demonstrated that air gaps are not absolute barriers. USB transfers, maintenance laptops, and supply chain compromises can bridge gaps. For AI deployments that process data originating from lower network zones, CIP-013 supply chain risk management and CIP-015-1 INSM become critical. Witness evidence produced inside the air-gapped environment provides an independent record that survives even if the gap is bridged.
When reviewing AI deployments in BES environments, NERC auditors should evaluate the following evidence chain:
The 2028 deadline: CIP-015-1 Phase 1 enforcement begins October 1, 2028. Utilities deploying AI inside Electronic Security Perimeters today should be building the baseline traffic profiles and evidence infrastructure now, not when the enforcement deadline arrives. An AI system deployed in 2026 without contemporaneous audit trails will face a choice when auditors arrive in 2028: admit they cannot explain their AI's decisions, or attempt to reconstruct explanations after the fact. Neither is acceptable under the standards.