Infrastructure Compliance Protocols

Europe just defined how AI must be secured On 15 Jan, the European Telecommunications Standards Institute (ETSI) published a standard, EN 304 223, defining baseline cybersecurity requirements for AI models and systems. ➡️ A common set of AI cybersecurity controls, usable across jurisdictions, vendors, supply chains. Why this matters now Traditional cybersecurity was built for software & networks. AI changes the attack surface: ▫️ training data can be poisoned ▫️ models can be manipulated or obfuscated ▫️ prompts can be indirectly injected ▫️ behaviour can drift in invisible ways ➡️ EN 304 223 explicitly names these risks, treating them as security failures. How this takes effect EN 304 223 is already being pulled into procurement processes, security questionnaires, internal audits, vendor due diligence, insurance reviews. With the EU AI Act, high-risk AI systems will need to demonstrate compliance through conformity assessment either via internal control with robust technical documentation, or through assessment by a notified body. ➡️ EN 304 223 is the operational “how” that law and auditors will rely on. The real breakthrough: lifecycle security The standard defines 13 principles and 72 trackable requirements, organised across 5 phases of the AI system lifecycle: 1️⃣ secure design 2️⃣ secure development 3️⃣ secure deployment 4️⃣ secure maintenance 5️⃣ secure end of life ➡️ Retraining a model = redeploying a system from a security standpoint. AI security becomes a continuous operational discipline. Accountability made operational EN 304 223 assigns accountability across 3 technical roles: ✔️ developers ✔️ system operators ✔️ data custodians ➡️ AI risk lives between teams. This standard makes ownership explicit. The target: production AI EN 304 223 applies to deep neural networks and GenAI models already embedded in products, services, and operational decisions. Academic or research environments are excluded. ➡️ This standard is about AI that is live, scaled, and consequential, particularly in finance, healthcare, and critical infrastructure. What “compliance” means Complying with legal, audit, procurement, and insurance expectations using EN 304 223 as evidence: mapping controls across the lifecycle and ownership across roles. What Boards and executives should do now 1️⃣ Mandate an AI inventory: What AI is live, where, doing what, using which data pipelines, supplied by whom. 2️⃣ Assign named accountability across the lifecycle: Align to the standard’s role logic per system. 3️⃣ Require an AI security evidence pack per high-impact system, mapped across its lifecycle. 4️⃣ Decide your assurance route early. For high-risk systems plan for internal control vs notified body assessment. The bigger signal EU is turning AI security into auditable infrastructure. Trustworthy AI is becoming a standard of execution. For companies operating globally, proof of AI security is becoming the baseline. #AI #GenAI #AIGovernance #AISecurity #Boardroom

The transition to #renewableenergy is accelerating across the globe—and at the heart of this shift lies the Battery Energy Storage System #BESS. While performance and capacity often steal the spotlight, it's the silent framework of #safetystandards and compliance protocols that make these systems reliable, scalable, and grid-ready. Let’s unpack what goes into making a truly safe, standards-aligned BESS: 1. Cells and Battery Modules: At the most granular level, individual lithium-ion cells and #batterymodules must comply with rigorous standards such as: • UL 1642 – Focuses on the electrical, mechanical, and environmental safety of lithium cells • UL 1973 – Addresses battery systems used in stationary and motive applications • UL 9540A – Evaluates thermal runaway fire propagation in battery systems These certifications lay the foundation for risk-free operation by mitigating hazards right at the cell level. 2. Battery Racks: #Batteryracks are not just containers—they're engineered structures housing multiple modules. Certified under UL 9540A, racks must prove their resilience against thermal events, offering another critical layer of protection. 3. Power Conversion System: PCS is the brain that manages energy flow between the grid and batteries. It must adhere to UL 1741, ensuring compliance with #antiislanding protection, voltage/frequency limits, and communication protocols critical for grid integration. 4. Battery Management System & Communication Interfaces: This digital backbone monitors voltage, temperature, state-of-charge, and fault conditions. It follows a suite of certifications: • UL 1741 & UL 9540 • CSA C22.2 No. 340-201 • IEEE 2686, 2688 This ensures that the #BMS not only protects the system but also communicates effectively with utilities, fire protection systems, and SCADA platforms. 5. Fire/Gas Detection & Explosion Protection: Advanced detection and suppression systems must comply with: • NFPA 72 & 855, and the International Fire Code (IFC) • Explosion protection as per NFPA 13, 15, 68, 69 and IEEE 855 These ensure that any off-gassing, over-temperature, or arcing event is identified early, triggering mitigation before escalation. 6. Interconnection with the Grid: The BESS must synchronize safely and intelligently with utility networks using protocols defined by: • IEEE 1547 & 2800: These standards cover everything from voltage ride-through to cybersecure communications. 7. System-Level and Installation Compliance: Holistic safety comes from aligning with installation guidelines such as: • NFPA 70 (NEC) • UL 9540 for complete BESS certification • IEEE C2 (NESC) for utility-grade deployments These cover enclosure requirements, spacing, #thermalzoning, wiring, earthing, and egress pathways for emergency responders. I welcome conversations with peers, partners, and policymakers working toward a safer, smarter energy future. How is your team approaching layered safety and compliance in energy storage?

Every compliance team has reviewed their AI policy. Almost none have reviewed their AI infrastructure. That is where the gap lives. HIPAA was written for human decisions made one at a time. Agentic AI makes thousands per hour and most of the sub-calls that carry PHI are never logged. The audit trail requirement exists. The audit trail doesn't. GDPR gives data subjects the right to explanation. Most AI systems running on cloud infrastructure cannot tell you which EU personal data touched which US server during which inference call. The right exists. The architecture to support it doesn't. PCI-DSS prohibits storing cardholder data. But when fraud detection AI receives raw card data in a context window, is that storage? The question is live. Most QSAs aren't asking it yet. They will. SOC2 requires vendor risk assessment. Your AI provider is a sub-processor. Most teams assess their cloud infrastructure vendors and skip AI providers entirely. That is a gap in your controls, not your policy. These are not legal problems. They are architecture problems with legal consequences. The carousel covers the specific gap in each framework, what the standard says, what AI actually does, and what compliance-first infrastructure looks like in practice. Swipe through. If your team has deployed AI in a regulated environment, at least two of these will be ones you have not fully addressed. Which framework keeps your compliance team up at night? Drop it in the comments. #HIPAA #GDPR #PCIDSS #SOC2 #AICompliance #EnterpriseAI #AIGovernance #DataSovereignty #SovereignAI #AIInfrastructure #CTO #CISO #AIStrategy #RegTech #AILeadership

⚠️ Most discussions about #CIRCIA focus on the 72 hour reporting requirement. I think that misses the bigger risk. Once fully implemented through regulation, CIRCIA will require critical infrastructure entities to report covered cyber incidents to the Cybersecurity and Infrastructure Security Agency (#CISA) within 72-hours and ransomware payments within 24 hours. The forthcoming rule does far more than create a reporting obligation. It creates significant obligations related to incident detection, evidence preservation, record retention, and post-incident cooperation. For many small businesses, particularly those that rely on MSPs, MSSPs, cloud providers, and other third-party cybersecurity vendors, the challenge may not be submitting a report within 72 hours. The challenge may be obtaining the information necessary to determine that a reportable incident occurred in the first place. In my latest article (link below), I discuss: ➡️ How the "reasonable belief" standard triggers reporting obligations ➡️Why vendor dependency creates compliance risk ✅ Contractual protections organizations may consider before the final rule takes effect As organizations prepare for CIRCIA, they should look beyond the reporting requirement and ask whether their third party vendors can support the organization's compliance obligations when an incident occurs. #Cybersecurity #CyberLaw #Compliance #Governance #RiskManagement #GovCon #CriticalInfrastructure

After more than 20 years working in OT and ICS cybersecurity across critical infrastructure, I've seen organizations struggle with the difference between compliance and security. This white paper provides a practical guide to NERC CIP for OT executives, covering compliance requirements, audit realities, supply chain risk, emerging standards such as CIP-015, and how NERC CIP aligns with IEC 62443, NIST 800-82, and NIST CSF. The key message is simple: NERC CIP establishes the minimum compliance baseline, but true resilience comes from building security programs that go beyond the audit and focus on protecting operations. #NERCCIP #OTCybersecurity #ICS #OperationalTechnology #CriticalInfrastructure #ElectricUtilities #IEC62443 #NIST80082 #IndustrialCybersecurity #OTSecurity #CyberResilience