Integrating artificial intelligence into industrial environments requires a fundamental shift from standard IT risk management to specialized architectures that prioritize process continuity and functional safety. In a classic IT environment, the primary focus is data confidentiality. Conversely, in operational technology (OT) and critical infrastructure, availability and physical safety take precedence over confidentiality—a distinction clearly defined in the NIST SP 800-82 Guide to OT Security.
Industrial architects face a challenge: how to deploy AI models that process noisy data from legacy sensors without creating operational risks, such as false positives or unpredictable equipment shutdowns. Directly porting consumer or office-grade AI models into an industrial circuit is dangerous without proper adaptation and risk assessment.
Why the classic IT approach to AI is unsuitable for OT systems
Traditional AI assessment methods typically focus on mathematical model accuracy under controlled conditions. However, for critical infrastructure, accuracy is only one of many factors. On a production floor, a predictive maintenance algorithm encounters vibration noise, electromagnetic interference, and sensor degradation. If AI interprets random noise as a critical anomaly and triggers an emergency conveyor shutdown, the enterprise incurs significant losses.
For AI in critical infrastructure, the NIST framework emphasizes the need to evaluate a broader context: potential harm, reliability, safety, and decision accountability. Furthermore, industrial networks have strict latency limits. If signal transmission to the cloud and the return response exceed the controller's (PLC) allowable reaction time, the AI solution loses its value.
Adapting NIST AI RMF 1.0: four AI security functions
To systematize AI risk management, it is advisable to use the voluntary NIST AI RMF 1.0 (Artificial Intelligence Risk Management Framework). This document is not a mandatory regulatory standard, but it structures the management process around four key functions: Govern, Map, Measure, and Manage.
- Govern: Defining responsibility between automated algorithms and SCADA operators. In critical systems, this means implementing a "human-in-the-loop" principle, where AI does not make fully autonomous decisions regarding control actions.
- Map: Identifying data sources and understanding the context of their use. Architects define exactly which sensors provide information and where the boundaries of the model's physical impact on the technological process lie.
- Measure: Assessing not only accuracy but also model resilience. This involves measuring the frequency of false positives and the system's ability to operate under incomplete or noisy data conditions.
- Manage: Developing architectural tools to minimize risks, from moving computations to the network edge to ensuring continuous decision logging.
Map & Measure stage: data normalization and noise filtering
One of the main problems in IIoT is the specificity of primary data from legacy equipment. To eliminate the risks of "hallucinations" or false recommendations, architectural barriers must be implemented.
First, disparate industrial equipment data is normalized. According to OPC Foundation approaches, using the OPC UA protocol allows for the unification of physical quantity descriptions, structuring of metadata, and filtering of obvious anomalies before data reaches the predictive maintenance model.
Second, edge computing (Edge AI) is implemented to filter noise directly at the source. Instead of sending the entire raw data stream, micro-models at the network edge perform primary cleaning, eliminating the influence of electromagnetic interference and preventing the generation of false emergency alerts.
Manage stage: Edge vs Cloud according to the AWS IoT Lens methodology
When designing IIoT systems, a key decision is the distribution of computing power. The AWS Well-Architected IoT Lens methodology helps architects determine which data should be processed at the edge and which in the cloud to ensure system reliability.
Latency constraints in critical infrastructure often necessitate peripheral execution of AI inference (Edge AI). When detecting instantaneous component failure, the decision must be made in real-time, making cloud communication latency unacceptable. Conversely, cloud computing remains optimal for model training and long-term wear trend analysis, where millisecond reactions are not critical.
Audit layer: logging AI recommendations in SCADA
The biggest barrier to AI adoption in the industry is the lack of transparency in decision-making. To ensure accountability, detailed audit logs are implemented for SCADA commands initiated by AI. The operator must be able to verify the logic of an automated decision before confirming it.
In enterprise digitalization projects, custom AI agent development services are provided by Softengi (a member of the Intecracy Group alliance, which is an alliance of independent companies linked by partner agreements and share exchanges). Softengi is certified under the ISO/IEC 42001:2023 AI management standard. To ensure data collection at the edge, the industrial AZIOT Platform is used, supporting telemetry collection via MQTT and Modbus protocols with subsequent integration into SCADA systems.
To ensure reliable logging and compliance with audit requirements, the UnityBase platform (jointly developed by Intecracy Group companies, where InBase is a key but not sole developer) can be used. Commercial editions of UnityBase (Enterprise and Defence), designed for high-load projects and systems with increased security requirements, contain built-in Audit Trail mechanisms, row-level security (RLS), and cryptographic signatures. This forms a reliable basis for recording every AI decision and operator action, making unauthorized modification impossible.
NIST AI RMF 1.0 function adaptation matrix for IIoT/OT requirements
The following matrix helps architects translate framework principles into practical engineering steps:
| NIST AI RMF function | Task in IIoT context | Practical implementation |
|---|---|---|
| Govern | Defining responsibility boundaries between AI and SCADA operators | Establishing a "human-in-the-loop" policy for critical commands, avoiding fully autonomous shutdowns. |
| Map | Identifying data sources (PLC, sensors) and assessing their quality | Normalizing data via OPC UA to eliminate legacy system anomalies. |
| Measure | Assessing model impact on performance and safety | Monitoring the frequency of false positive shutdowns instead of classic accuracy metrics. |
| Manage | Meeting latency limits and ensuring accountability | Distributing computing (Edge vs Cloud) using AWS IoT Lens methodology and maintaining immutable decision audits. |
Such an architectural approach allows for leveraging the analytical potential of AI in industry while adhering to strict functional safety and operational reliability standards.
FAQ
How can NIST AI RMF 1.0 be adapted for predictive maintenance systems?
Adaptation involves mapping (Map) sensor data sources, measuring (Measure) false positive risks, and managing (Manage) through the implementation of edge noise filtering and maintaining AI decision audit logs.
What is the difference between AI risk management in IT systems versus industrial networks (OT)?
According to NIST SP 800-82, IT systems often prioritize confidentiality, whereas OT networks and critical infrastructure prioritize availability and physical safety. AI errors in this context can lead to equipment shutdowns and operational accidents.
How can false equipment shutdowns caused by AI model errors on noisy data be avoided?
It is advisable to normalize data via OPC UA, use edge computing (Edge AI) for primary sensor noise filtering on legacy equipment, and maintain a human-in-the-loop role to verify generated SCADA commands.