Legal Considerations For AI Deployment In The Power Sector

Key Takeaways

• Power generators deploying artificial intelligence (“AI”) face a convergence of legal risks spanning grid reliability compliance, market manipulation exposure, cybersecurity obligations, data privacy, tort liability, and a rapidly shifting federal and state AI governance landscape.
• No state Public Utilities Commission has issued formal AI guidance for utility operations, and federal, state, and international AI policy continues to develop.
• Generators should establish AI governance frameworks now—including algorithmic risk assessments, human-in-the-loop requirements for safety-critical decisions, and vendor due diligence—to position themselves ahead of evolving compliance obligations.

Power generators are increasingly using AI in myriad ways, including bidding power into the market, plant operations, predictive maintenance, asset optimization, and wildfire detection. As these deployments accelerate, so too do the legal and regulatory questions surrounding AI in the power sector. As of August 2026, no state Public Utilities Commission has specifically addressed the issue of utility operational AI. The Arizona Corporation Commission (“ACC”) is the only state to have opened a formal examination into energy industry AI deployment (Docket AU-00000A-26-0060). The ACC queried electric, gas, and water utilities for information detailing their use of AI in forecasting, procurement, and planning; a stakeholder workshop is expected to occur in October 2026.

The lack of formal guidance has created a regulatory vacuum for AI implementation in the power industry. While thoughtful adoption of AI can help optimize operations, reduce costs, and improve regulatory compliance, plant owners also face a convergence of legal risks spanning energy regulation, data privacy, cybersecurity, tort law, and emerging AI-specific governance frameworks at both the state and federal levels.

How Do Regulatory Compliance and Grid Reliability Obligations Apply to AI-Driven Operations?

Power generators are subject to mandatory reliability standards administered by the North American Electric Reliability Corporation (“NERC”) and enforced by the Federal Energy Regulatory Commission (“FERC”). Deploying AI for generation dispatch, load forecasting, or equipment maintenance raises questions of whether an AI-driven operational decision that causes a reliability violation triggers the same enforcement exposure as a human decision. While NERC violations are not subject to traditional strict liability, the compliance framework imposes substantial penalty risk for both intentional and unintentional violations. NERC’s Sanction Guidelines specifically consider management involvement in any intentional violation or attempt to conceal a violation, as well as other factors, including the entity’s full compliance history, whether the entity self-reported the violation, the entity’s cooperation with any investigation, and whether the entity had a compliance program in place. NERC Critical Infrastructure Protection (“CIP”) standards also require that any system with access to bulk electric system cyber assets satisfy rigorous access-control, change-management, and vulnerability-assessment requirements—obligations that may be difficult to satisfy when AI models are updated frequently or operate with little or no human oversight.

Additionally, generators with capacity market or ancillary services obligations (e.g., ISO-NE, PJM, or CAISO tariffs and other operating protocols) must meet performance guarantees. If AI-optimized bidding or dispatch strategies result in non-performance during scarcity events, generators face financial penalties and potential market-manipulation scrutiny under FERC’s Anti-Manipulation Rule (18 C.F.R. § 1c.2).

Can AI Trading Strategies Trigger Market Manipulation Liability?

AI-driven energy trading and bidding strategies raise enforcement risk under FERC’s market behavior rules. Algorithmic coordination—even unintentional—between generators using similar AI models could raise allegations of tacit collusion or market manipulation. FERC’s Office of Enforcement has consistently prioritized fraud and market manipulation cases, and the Division of Analytics and Surveillance monitors algorithmic behavior in organized markets. Generators should ensure that AI trading tools include adequate compliance controls, audit trails, and human oversight to defend against enforcement actions.

What Are the Cybersecurity Risks of AI for Critical Infrastructure?

Power generation facilities are classified as critical infrastructure under Presidential Policy Directive 21 (“PPD-21”), issued in February 2013 to strengthen critical infrastructure security and resilience, and under the Federal Power Act as part of the bulk power system. Integrating AI systems—particularly cloud-hosted or vendor-managed solutions—expands the attack surface and introduces supply-chain risk. Key legal considerations include:

• NERC CIP compliance: AI systems interacting with operational technology must comply with CIP-005 (electronic security perimeters), CIP-007 (system security management), and CIP-010 (configuration change management). 
• Cybersecurity reporting obligations: Under forthcoming regulations pursuant to the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA), generators will be required to report substantial cyber incidents regardless of cause—including AI-related breaches—within specified timeframes.
• Third-party vendor risk: Contracts with AI vendors should allocate liability for data breaches, ensure compliance flowdown, and address intellectual property ownership of data derived from operational systems.

How Should Generators Protect Data Privacy and Proprietary Information?

AI systems in power generation often ingest large volumes of operational data, including real-time generation output, fuel procurement information, equipment performance metrics, and potentially customer load profiles. Legal risks include:

• Trade secret exposure: Sharing proprietary operational data with AI vendors or cloud platforms may jeopardize trade-secret protection if adequate contractual safeguards (nondisclosure agreements, data segregation, use restrictions) are not in place.
• State privacy laws: Where generation-related data intersects with customer information (particularly for distributed generation or behind-the-meter resources), state privacy statutes (such as the California Consumer Privacy Act (“CCPA”), California Privacy Rights Act (“CPRA”), and other state analogues) may impose notice, consent, and other obligations for the processing or transfer of certain forms of personal information. State data breach notification laws may also be implicated in the event of a breach affecting a database that commingles personal and operational information.
• Cross-border data transfers: Generators with international operations may face a host of complex requirements for cross-border data transfers, including implications under the EU’s General Data Protection Regulation (“GDPR”). Companies with an international presence should consult with counsel regarding applicable data localization requirements and other compliance obligations, particularly when smart meter data, customer records, or other data is transferred or processed by AI systems located outside the jurisdiction where the data originates.

How Do Emerging AI Governance Frameworks Apply to the Power Sector?

A growing patchwork of state and federal AI governance initiatives creates compliance uncertainty:

• Federal AI executive actions:Executive Order (“EO”) 14110 (October 2023) directed federal agencies to assess AI risks in critical infrastructure sectors and prompted follow-up agency action to impose safety and security requirements on AI systems used in critical infrastructure. The Trump Administration revoked EO 14110 in January 2025 and directed agencies to identify and suspend, revise, or rescind actions taken pursuant to EO 14110 that present obstacles to AI innovation. Most recently, EO 14409 (June 2026) directed agencies to strengthen federal infrastructure against AI-enabled risks, establish an AI cybersecurity clearinghouse for critical infrastructure operators, and extend AI-enabled cyber defense tools to critical infrastructure sectors. Generators should continue to monitor how the evolving federal policy landscape addresses AI in critical infrastructure.
• State AI legislation: Multiple states, including Massachusetts, are advancing bills with competing standards and safeguards regulating automated decision systems, algorithmic impact assessments, and AI transparency. Generators operating across state lines face a fragmented compliance landscape that is likely to change significantly in the coming years.
• EU AI Act: Generators with European operations or customers must evaluate whether AI systems used in energy infrastructure qualify as “high-risk” under Article 6 and Annex III of the EU Artificial Intelligence Act, potentially triggering conformity assessments, documentation, and human-oversight requirements.

Who Is Liable When AI Causes a Generation Failure?

If an AI system causes or contributes to a generation failure, equipment damage, environmental release, or grid disturbance, questions of tort liability arise. Traditional negligence frameworks may struggle with AI’s opacity—who is the responsible actor when an AI model trained on historical data makes a faulty prediction? Potential theories include:

• Products liability against AI vendors for defective algorithms;
• Negligence against the generator for inadequate oversight, testing, or validation; and
• Strict liability for abnormally dangerous activities if AI controls safety-critical systems.

Insurance coverage is also uncertain. Standard commercial general liability and property policies may exclude AI-related losses or contain cyber exclusions that create gaps.

Does AI Use Create Environmental, Social, and Governance (“ESG”) Reporting Risks?

AI used for emissions optimization, environmental compliance monitoring, or ESG reporting introduces risk if the AI produces inaccurate outputs that are relied upon in regulatory filings (e.g., U.S. Environmental Protection Agency (“EPA”) Continuous Emission Monitoring and state and federal greenhouse gas (“GHG”) reporting and climate disclosure rules). Submitting AI-generated data to regulators without adequate validation could expose generators to enforcement actions for material misstatements, though no enforcement precedent specifically addressing AI-generated environmental data has yet emerged.

Recommendations for Risk Mitigation

First and foremost, generators should consult with counsel to establish an AI governance framework that includes algorithmic risk assessments prior to deployment. That policy should, at a minimum, include human-in-the-loop requirements for safety-critical decisions, vendor due diligence, contractual protections, regular model auditing and validation protocols, and incident response plans specific to AI failures. Stakeholders should also regularly engage with industry groups (such as the Electric Power Research Institute and its Open Power AI Consortium) that are working to develop sector-specific AI best practices and practical applications for AI models.

This is a rapidly evolving area where regulatory guidance continues to develop. Generators that build thoughtful, robust governance structures now will be well-positioned as compliance obligations crystallize.