AI agents and robots in plant maintenance add new inputs (documents, sensor data, natural language), new tools (work order systems, robot controllers) and new software supply chains. The existing regulatory frame still applies: identify digital assets, protect them in depth, and keep humans in charge of high-impact actions.
This post is a threat modeling exercise. It describes no real incident and makes no claim that any plant uses the systems it discusses.
What does the regulator already require?
In the United States, 10 CFR 73.54 requires operators of nuclear power plants to provide high assurance that digital computer and communication systems and networks are adequately protected against cyber attacks. The rule covers digital systems tied to safety-related and important-to-safety functions, security functions and emergency preparedness, plus support systems whose compromise would affect those functions.
Key requirements include identifying the assets, running a cyber security program built on defense-in-depth, training staff including contractors, evaluating changes to protected assets before implementation, and maintaining a plan with incident response and recovery. Other countries have their own regimes, and this post covers only the US text we fetched.
NIST SP 800-82 Rev. 3 offers the broader OT security guidance, with performance, reliability and safety requirements in mind.
What changes when you add an AI agent?
An agent reads something, decides, and calls a tool. Each part opens a question.
Inputs. A maintenance agent might read work orders, procedures, vendor manuals and sensor summaries. Any text in those sources is data the model may treat as instruction. The question is who can write to each source.
Tools. The agent might create or close work orders, order parts, or message technicians. OWASP's excessive agency page names the root causes: excessive functionality, excessive permissions and excessive autonomy. Its mitigations fit here directly: minimize the extensions, avoid open-ended ones such as arbitrary shell commands, minimize downstream permissions, require human approval for high-impact actions, and authorize requests in downstream systems rather than trusting the model's judgment.
Outputs. If model text feeds another system, OWASP's improper output handling guidance applies: treat the model like any other user.
Supply chain. Weights, libraries and plugins arrive from outside. Provenance and file format checks apply, as for any software.
What changes with robots?
A robot in a maintenance task moves in the physical world, so a software fault can have a physical effect. ISO 10218 covers industrial robot safety, and trade and testing sources report its 2025 edition added cybersecurity requirements scoped to robot safety. We did not read the clauses, so check the standard itself.
For the threat model, the useful question is: can any path from an agent, a network or a remote vendor change the robot's behavior without passing a safety function that is independent of that path? Independent safety systems matter because they still work when the control software is wrong.
How do you structure the exercise?
- Draw the maintenance workflow with the agent in it. Mark every input, tool and output.
- For each input, list who can write to it, including contractors and vendors.
- For each tool, list its permissions and the worst action it permits.
- For each worst action, ask what independent barrier stops it.
- Mark the actions that must always need a named human's approval.
- Decide what gets logged and who reviews it.
Keep the agent on the information side of the boundary. An agent that suggests a work order for a person to approve has a very different risk profile from one that issues commands to control systems.
What to do
- Inventory digital assets that an agent or robot would touch, using your existing 73.54 asset list as the base.
- Give agents read-only access first, and widen only with approval.
- Remove open-ended tools such as shell access.
- Require human approval for any action that changes plant state.
- Keep safety functions independent of agent and robot software.
- Treat models and plugins as supplied software: verify, pin and record them.
- Run a tabletop exercise on a poisoned work order.
Quick check
Does 10 CFR 73.54 mention AI?
The text we fetched does not. It covers digital systems and networks generally, so any AI component inside a protected system falls under the same program requirements.
What is the first control to apply to a maintenance agent?
Limit what it can do. Read-only access and human approval for state-changing actions remove most of the dangerous cases.
Sources
- 10 CFR 73.54, Legal Information Institute
- NIST SP 800-82 Rev. 3
- OWASP GenAI: LLM06:2025 Excessive Agency
- OWASP GenAI: LLM05:2025 Improper Output Handling
- Control Design: ISO 10218 update
Last reviewed: 18 October 2026.
