Power is one of the few industries where an AI deployment has to answer to two regulators before it does anything useful. Touch the bulk-power system and you are inside NERC CIP, the critical-infrastructure cybersecurity regime, with its access controls and audit obligations. Influence dispatch or bidding and you are inside ERCOT and FERC market rules, where automated behavior can raise questions about gaming and manipulation. Most AI vendors have never heard of either. That is exactly why their pilots stall.
For an operator, these aren't obstacles to route around. They're the design brief.
Why power is doubly regulated
The grid is critical infrastructure, so its security is federally mandated through NERC CIP. The wholesale market is a public mechanism, so behavior in it is policed by ERCOT and FERC. AI lands in the overlap. A model that helps a control center act on grid data has a cybersecurity surface. A model that helps a desk bid into the market has a compliance surface. Treating either as ordinary software is how an operator ends up with an unreviewed risk in a place that doesn't tolerate them.
So the useful question isn't how to avoid the rules. It's how to build AI that moves through both cleanly.
Building CIP-aware
AI that respects NERC CIP shares a few properties, and they're design decisions, not paperwork:
- Security and access designed in. Where data lives, who and what can reach it, and how access is logged are settled before deployment, not bolted on for an audit.
- An auditable trail. What the system did and why is recorded in terms a CIP audit can evaluate.
- Human-in-the-loop on grid-affecting decisions. A qualified operator owns any call that touches the bulk-power system, which keeps the deployment reviewable and accountability clear.
The market-rules dimension
The ERCOT side adds a second discipline. AI that influences dispatch or bidding has to be explainable and human-accountable, because automated market behavior that can't be explained is a compliance problem waiting to happen. The safe pattern is the same as on the CIP side: the model advises, a person decides, and the decision and its rationale are logged. That keeps the operator able to answer a regulator who asks why a bid or dispatch looked the way it did.
What the evidence looks like
Kaysee, Cortland's reliability platform, runs in operator environments on generation equipment with the human in the loop and the governance documented. It's a concrete example of the pattern both regulators reward: advisory intelligence, traceable reasoning, a person owning the decision, an auditable trail. The same discipline that lets it operate on a turbine is what a CIP audit and a market-compliance review both want to see.
The regulation isn't what keeps AI off the grid. Designed for from the start, it's what lets the model stay in the control center and on the desk instead of getting pulled at the first review.