Are AI Tools Creating Compliance Gaps in Utilities?
Could AI tools inadvertently create compliance gaps in utilities? Discover the hidden risks and how to navigate them.
Utilities have survived a century of regulatory scrutiny by building cultures of meticulous documentation, defensible processes, and institutional caution. Now, they're deploying AI tools at an accelerating pace — and some of what makes AI powerful is precisely what makes compliance officers nervous: speed, opacity, and autonomous decision-making that doesn't leave a clean paper trail.
Eric Swidey, founder of Thirty Seven Inc., put it bluntly: utilities deploying AI tools may be creating a compliance gap that will only become visible when auditors start asking questions. That's a slow-motion problem, the kind that feels manageable right up until it isn't.
The Pull Toward AI Is Real — and So Is the Pressure to Move Fast
Utilities are operating under a perfect storm of competing demands. Aging infrastructure, extreme weather events, federal decarbonization targets, and workforce retirements are all hitting simultaneously. AI promises relief: faster outage prediction, smarter grid load balancing, and predictive maintenance that can extend equipment life and reduce costly failures.
The operational case for AI in utilities isn't hype — it's genuine, and the business pressure to deploy quickly is intense.
That pressure is where the compliance risk begins. Utilities procuring AI tools from third-party vendors often inherit systems whose decision logic is not fully transparent — even to the vendors themselves. A machine learning model trained to optimize transformer dispatch schedules or flag equipment anomalies may perform brilliantly in the field while producing outputs that, under regulatory review, can't be adequately explained or defended.
NERC reliability standards, FERC reporting requirements, and state-level public utility commission rules — these frameworks were written for human decision-makers and deterministic systems. They assume that when something goes wrong, someone can reconstruct exactly why a decision was made. AI doesn't always work that way.
Where the Compliance Gaps Actually Form
The gaps aren't usually dramatic; they don't announce themselves. They accumulate quietly in the space between what an AI system does and what existing compliance frameworks expect to see documented.
Consider a utility using an AI-driven tool to prioritize vegetation management crews along transmission corridors. The model is ingesting satellite imagery, historical outage data, weather forecasts, and LiDAR scans to rank risk. It's probably making better decisions than a human dispatcher working from a spreadsheet. But when a wildfire ignites near a transmission line the AI deprioritized, regulators will want to know: Why was that corridor ranked low? What data drove that decision? Who reviewed it? What was the override policy?
If the utility can't answer those questions from documented records, the sophistication of the AI system becomes legally irrelevant.
This is the core of the compliance gap problem: AI tools in utilities often operate without governance structures that match their operational footprint. Decisions are made at machine speed, at scale, without the oversight checkpoints that traditional workflows built in by necessity. The logging that does exist may be technically detailed but operationally meaningless to a compliance auditor who needs plain-language rationale, not a model's confidence score.
There's also a vendor accountability dimension that's frequently underestimated. When a utility outsources decision support to an AI platform, the regulatory responsibility doesn't transfer with it. The utility is still the licensed entity. It's still the one answering to the PUC. If the vendor's model produces a decision that results in a reliability event or a safety failure, the utility owns the consequences — even if it didn't build the model and doesn't fully understand it.
The Regulatory Clock Is Running
Regulators have been watching the AI deployment wave with a mix of curiosity and caution. That window of watchful waiting is narrowing.
FERC and NERC have both signaled increased attention to how automated and AI-assisted systems are being incorporated into bulk power operations. Several state public utility commissions have begun asking pointed questions about algorithmic decision-making in rate cases and reliability reviews. The SEC's evolving disclosure rules around material technology risks add another layer for publicly traded utilities.
The trajectory is clear: energy sector compliance frameworks will catch up to AI adoption, and the utilities that deployed first without governance structures in place will face the steepest remediation curve.
This isn't speculation — it's the historical pattern of how regulatory frameworks respond to new technology in heavily regulated industries. The early adopters often get to define best practices, but they also absorb the compliance cost of operating ahead of clear rules. Right now, many utilities are accumulating that exposure without fully accounting for it.
What Proactive Compliance Actually Looks Like
The utilities that will navigate this well aren't the ones waiting for regulatory clarity before acting. They're the ones treating AI governance as an extension of their existing compliance infrastructure — not a separate tech-team problem.
A few practices separate the prepared from the exposed:
Model inventories and documentation standards. Every AI tool in operational use should be documented: what it does, what data it ingests, what decisions it influences, who approved its deployment, and what the human oversight protocol is. This sounds basic, but many utilities that have deployed AI tools on a departmental basis — vegetation management here, customer analytics there — have no centralized inventory.
Explainability requirements baked into procurement. Before a utility signs a contract with an AI vendor, procurement teams should require demonstrated explainability for any model that touches compliance-relevant decisions. If a vendor can't articulate how their system's outputs can be audited and documented, that's a red flag, not a negotiating point.
Human-in-the-loop checkpoints mapped to regulatory exposure. Not every AI decision needs human review — that would defeat the efficiency argument. But the highest-risk decisions, those touching reliability standards, safety protocols, or rate-recoverable expenditures, need documented human oversight. Map those touchpoints now, before an auditor does it for you.
Treating audit trails as a design requirement, not an afterthought. AI systems should log not just what they decided but what inputs drove that decision, at a level of detail that a compliance professional can interpret. Building that into vendor contracts and system architecture from the start is far cheaper than retrofitting it after a regulatory inquiry.
The insider reality here is that many utility compliance teams are technically sophisticated but organizationally siloed from the teams deploying AI tools. Operations, IT, and data science functions are moving fast. Compliance and legal are often brought in after the fact, to bless a deployment rather than shape it. Closing that organizational gap is as important as any technical fix.
The Audit Is Coming
The question isn't whether regulators will scrutinize AI use in utilities — it's when, and whether your documentation will hold up when they do. The utilities that treat this moment as an opportunity to build durable governance frameworks will come out ahead. Those that treat AI as purely an operations problem, separate from regulatory exposure, are building liability that isn't on anyone's balance sheet yet.
AI tools in utilities aren't going away, and they shouldn't. The operational gains are real, and the grid's challenges are too large to solve without them. But the energy sector's compliance obligations don't pause for technology adoption cycles. The gap between where AI deployment is today and where utility compliance frameworks expect it to be is real, it's widening, and it compounds the longer it goes unaddressed.
Start the inventory. Pull in compliance early. Demand explainability from vendors. The auditors will eventually catch up — the only variable is whether you're ready when they do.
Explore our marketplace for AI solutions tailored for utilities.