NERC CIP Standards — Regulatory Reference

NERC CIP does not have AI-specific provisions, but several existing standards apply directly when AI agents touch Bulk Electric System (BES) Cyber Systems. CIP-004 requires that only personnel with documented, authorized need-to-know can access BES Cyber System data — that obligation extends to any automated agent acting on behalf of a person or system. CIP-011 requires information protection controls for BES Cyber System Information (BCSI). An AI agent retrieving operational technology data without pre-retrieval access enforcement can create a CIP-011 violation even if the underlying human user is authorized. CIP-007 requires security event logging for all access to BES Cyber Systems, which demands tamper-evident records of every agent query.

Five standards have direct bearing on AI agent deployments. CIP-002 governs how BES Cyber Systems are categorized — that classification determines the sensitivity floor for any data the agent may request. CIP-004 controls access management: only vetted, authorized parties may access high- and medium-impact BES systems, which applies to agent identities as much as human identities. CIP-005 defines electronic security perimeters that AI agents must not cross without authorization. CIP-007 mandates security management and logging for all system access. CIP-011 covers protection of BCSI at rest and in transit — a requirement that extends to how AI systems handle data after retrieval. Taken together, these standards create a strict need-to-know and audit trail obligation for any AI agent in scope.

AutoPIL enforces access decisions before any BES Cyber System data enters an agent's context window, which is the control point CIP-004 and CIP-011 require but most AI frameworks lack. BES Cyber System sources are classified at CRITICAL sensitivity in AutoPIL's source registry, and policies derived from CIP-004 (ENG-NERC-CIP004-001) and CIP-011 (ENG-NERC-CIP011-001) define strict agent-level need-to-know rules. Every evaluation — ALLOW or DENY — is written to an append-only, cryptographically chained audit log. That log supports CIP-007 logging obligations and can be used as evidentiary records during a CIP-008 incident response. The agent registry ties each agent identity to a specific policy, preventing unregistered agents from touching protected sources.

NERC CIP violations carry civil penalties of up to $1 million per violation per day, enforced by FERC. Violations are assessed per standard, per day, so a single misconfigured AI agent accessing BES Cyber System data without proper controls could accumulate violations across CIP-004, CIP-007, and CIP-011 simultaneously. AI agent use creates new exposure in two specific ways: first, agents can access data at machine speed and volume, meaning a misconfiguration produces far more access events than a human user would; second, most AI frameworks have no built-in mechanism to enforce need-to-know at the retrieval layer, leaving a gap that auditors and FERC enforcement staff increasingly scrutinize. Documented, pre-retrieval enforcement controls are the clearest way to demonstrate due diligence.

NERC CIP applies to any entity that owns or operates facilities that are part of the Bulk Electric System — generation owners, transmission owners, distribution providers, reliability coordinators, and balancing authorities, among others. The standards apply to BES Cyber Systems: any cyber assets that, if disrupted, would impact the reliable operation of the BES. If an AI agent queries real-time operational data from an energy management system, SCADA platform, or any classified BES Cyber Asset, that agent is operating within the NERC CIP compliance perimeter. The standards do not require that a system be human-operated to be in scope — if it can affect BES reliability or accesses BCSI, it is subject to the relevant CIP requirements regardless of whether it is automated.