AI governance in critical infrastructure

For the past decade, Irish utilities have been focused on physical infrastructure. Over the next decade, another form of infrastructure will become just as important: artificial intelligence.

AI is rapidly moving from pilot projects and innovation programmes into core utility operations. It is being used to improve forecasting, analyse asset performance, support operational decisions, strengthen cyber defences and enhance customer services. Across Ireland's utility sector, adoption is already underway.

Yet a new challenge is emerging.

While AI capability is advancing quickly, governance is developing much more slowly. For utility leaders, this creates a significant risk. The question is no longer whether AI will become embedded within critical infrastructure. It already is. The question is whether governance, assurance and oversight will mature quickly enough to keep pace.

Explore the insight below from our Utilities Regulatory and Transformation team.

Shane Garahy

Partner, Risk Consulting

KPMG in Ireland

mail
call

The next transformation challenge is not technology. It is trust.

Most major utility transformations ultimately depend on public trust.

Customers trust that energy networks will remain available. Communities trust that water infrastructure will continue operating. Governments trust that critical national services can withstand disruption. Regulators trust that organisations can demonstrate control over increasingly complex operations.

AI now sits directly within that trust equation.

As organisations introduce AI into operational environments, decisions become influenced by technologies that can be difficult to understand, explain and challenge.

Governance models developed for traditional systems are being stretched by tools that learn, adapt and generate outcomes in fundamentally different ways.

The challenge is not that AI is unsafe. The challenge is that many organisations do not yet have consistent mechanisms for demonstrating that it is being used safely.

Governance is becoming a critical infrastructure capability

Historically, AI governance has been discussed as a compliance requirement or risk management activity. That perspective is becoming outdated. For utilities, governance is rapidly becoming a core organisational capability.

Major investment programmes, digital transformation initiatives and infrastructure modernisation projects increasingly rely on large volumes of operational and customer data. AI is helping organisations process that information faster and identify opportunities that may otherwise be missed.

As reliance on AI grows, governance becomes essential for answering fundamental questions:

Who is accountable for decisions influenced by AI?
How are outputs challenged and validated?
Where is human judgement required?
What evidence exists that controls are operating effectively?

Organisations that cannot answer these questions confidently will struggle to scale AI safely. Those that can will be better positioned to unlock value while maintaining the confidence of regulators, boards and stakeholders.

Regulation is moving from awareness to enforcement

The debate is no longer whether AI regulation is coming. It is whether organisations are prepared for it.

Over the last year, regulatory expectations have become significantly clearer. The European Commission has issued guidance on the classification of high-risk AI systems, while Ireland has introduced the Regulation of Artificial Intelligence Bill 2026, establishing the national enforcement framework for the EU AI Act. Together, these developments move AI governance from policy discussion towards practical implementation and regulatory oversight.

For utilities, this matters because many AI use cases are being deployed in environments that support critical infrastructure and essential services. Regulators are increasingly focused on risk management, human oversight, governance and accountability.

The organisations that act early will be better placed to innovate with confidence. Those that delay may face increased scrutiny, higher remediation costs and growing pressure to retrofit governance around AI capabilities that are already embedded in operations

Moving early creates a strategic advantage

The utilities that lead in AI adoption will not necessarily be those deploying the most advanced technologies.

They are more likely to be the organisations that establish governance before scale creates complexity.

Good governance does not slow innovation. In practice, it often enables it. Clear accountability, structured oversight and trusted assurance mechanisms give organisations confidence to expand AI use safely across operations, infrastructure and customer services.

This is why the conversation is shifting.

The challenge is no longer whether AI will transform utilities. The challenge is whether governance capability can develop at the same pace.

Looking forward

For years, utility leaders have focused on the resilience of physical infrastructure. Over the next decade, they will increasingly need to focus on the governance of digital infrastructure.

AI is already becoming embedded within the systems, processes and decisions that support essential services across Ireland. The real question is whether organisations can govern AI at the speed they are deploying it.

Those that move early will build trust, strengthen assurance and create the confidence needed to scale. Those that delay risk discovering an uncomfortable reality.

The biggest AI failure in critical infrastructure is unlikely to occur because the technology did not work. It is more likely to occur because governance failed to keep pace with adoption.

How KPMG can help

The KPMG Ireland Utilities Regulatory & Resilience Centre brings together capabilities across regulatory transformation, enterprise risk, operational resilience, cyber and OT governance, AI governance and programme assurance.

For practical support, get in touch with our team to explore how best to translate regulatory obligations into operational reality.

Let's do business. Submit your proposal to KPMG in Ireland.

Submit your RFP