Physical AI - Mindset Changing on Security

1. Security becomes a question of physical consequence

Physical AI links sensing, inference and action in the physical world. In a grid solution, the security question therefore becomes inseparable from safety: what can the system cause, under which conditions, and who remains accountable? Protecting information is essential; protecting the permissible behaviour of the system becomes equally important.

Leadership should approve an operating envelope before approving autonomy. Define acceptable states, prohibited actions, escalation conditions and the safe response to uncertainty or loss of communications. Treat this as a joint decision by grid operations, safety engineering, cybersecurity and the product owner.

A useful assurance case connects each credible failure or attack to a physical consequence, a prevention or containment control, a test result and a named risk owner. Model accuracy alone cannot demonstrate that an operational system is safe.

NIST: operational technology security, reliability and safety ↗

2. From least privilege to least agency

Least privilege governs what a user or service may access. For an AI agent controlling equipment, we propose an additional principle: least agency. Give the agent no more freedom to initiate or execute actions than the consequence assessment justifies. Confidence scores must not become permission to operate.

• Observe and recommend: start with read-only analysis, explanations and operator recommendations.
• Bounded execution: automate only low-consequence, reversible actions inside approved limits, with independent checks and a complete decision trail.
• High-consequence authority: retain accountable human authorisation for actions such as topology changes or protection-setting changes, with the approval design determined by the hazard analysis.

Human oversight must fit the available response time. Keep time-critical protection in validated deterministic controls and independent interlocks; do not make an operator’s last-second approval the only safety barrier. AI must not be able to rewrite its own operating limits or bypass the protection layer.

3. Govern the model as a new class of firmware

Where training happens in the cloud and inference runs at the edge, a model release can change how equipment behaves without changing the application binary. From an assurance perspective, treat that release with the discipline of a critical-infrastructure firmware update. This is an engineering governance analogy, not a claim that every model is legally classified as firmware.

Require signed release packages and verification at the device, controlled signing keys, compatibility checks, staged deployment and a tested rollback path to an approved version. A valid signature proves origin and integrity; it does not prove safe behaviour. Release approval must also depend on operational validation and the approved safety envelope.

Maintain an AI bill of materials alongside the software bill of materials: model and weight versions, training-data provenance, preprocessing, dependencies, evaluation evidence and deployment configuration. Trace each deployed model back to its inputs, approvals and suppliers.

The grid is also a source of future training data. Spoofed telemetry can mislead inference now and poison a later model if it enters the training pipeline. This is not automatic: an inference-only model does not silently retrain itself. Protect sensor identity, time synchronisation, calibration, data lineage and cross-sensor consistency, and quarantine suspect records before learning. Edge data integrity becomes part of model integrity.

4. Let the data stay. Let the model travel.

Grid data can be subject to critical-infrastructure, sectoral, privacy, contractual or cross-border restrictions. The requirements depend on the jurisdiction, data classification, operator and intended use; there is no single global rule that all grid data must stay local. Design the sovereignty boundary before choosing the training architecture.

The design direction we are exploring is to send an approved model or training job to the authorised local environment, train against data held there, and return only authorised model updates or aggregated parameters. The principle is simple: let the data stay, let the model travel.

NVIDIA FLARE provides a framework that supports federated learning through to production deployment. Its documented security options include confidential computing and privacy-preserving techniques. These are enabling capabilities, not proof that a specific grid deployment is safe or compliant. Our grid-specific direction remains exploratory and should proceed through controlled pilots and operator validation.

Parameters and gradients can still reveal information or carry poisoned updates. Authorise what may leave each site, assess leakage, validate contributors and updates, and select secure aggregation or differential privacy where appropriate. Confidential computing can protect data in use within an attested environment; it does not make malicious input trustworthy or remove transfer obligations.

NVIDIA FLARE: production deployment framework ↗

NVIDIA FLARE: security architecture and federated learning risks ↗

5. Treat EU market access as three connected workstreams

The EU AI Act identifies AI intended as a safety component in electricity supply management and operation within its Annex III high-risk framework. Classify the specific intended purpose and role; not every grid forecast or analytics tool is automatically high-risk. Leaders should establish ownership for risk management, data governance, human oversight and evidence supporting the applicable obligations.

European Commission: AI Act and critical infrastructure ↗

The Cyber Resilience Act addresses cybersecurity across the lifecycle of in-scope products with digital elements placed on the EU market. Assess the product boundary and supplier role, vulnerability handling and support commitments. Its Article 14 reporting obligations began on 11 September 2026; the main requirements apply from 11 December 2027.

European Commission: Cyber Resilience Act scope and application ↗

The Data Act adds a distinct lens: rights to connected-product data, data sharing and cloud switching, plus safeguards against unlawful third-country government access to non-personal data held in the EU by data-processing services. It is not a blanket EU data-localisation law. Map its applicable duties alongside privacy, energy-sector and national rules, including the treatment of exported model updates.

European Commission: Data Act overview ↗

European Commission: Data Act international access safeguards ↗

The leadership mandate: approve capability and restraint together

Before scaling a grid Physical AI programme, require five decisions to be documented and signed off by the accountable business, engineering, safety and security leaders:

1. Authority: which actions are prohibited, automated or subject to human authorisation?
2. Assurance: what evidence proves the model stays within the safety envelope, including under attack and degraded conditions?
3. Release integrity: who approves each model version, and how is its provenance verified and recovery rehearsed?
4. Sovereignty: what remains local, what may travel, and who authorises each transfer or training job?
5. Accountability: which operator owns the stop decision, incident response and ongoing regulatory evidence?

Anuthand’s advisory position is to begin with bounded pilots, independent safety controls and measurable release gates. Physical AI earns permission to scale when its limits are demonstrable, its learning is governed and its operational consequences remain accountable.