Joint guidance on principles for the secure integration of artificial intelligence in operational technology – Canadian Centre for Cyber Security

Summary

The Canadian Centre for Cyber Security, together with CISA and seven international partners, has published joint guidance outlining principles for securely integrating artificial intelligence (AI) into operational technology (OT) that supports critical infrastructure.

The publication recognises AI’s potential to boost efficiency, improve decision-making, reduce costs and enhance customer experience for critical infrastructure owners and operators, while warning that AI integration also creates material risks to availability and reliability of essential services.

Key Points

International collaboration: guidance issued jointly by Cyber Centre, CISA, ASD/ACSC (Australia), BSI (Germany), NCSC-NL (Netherlands), NCSC-NZ (New Zealand), NCSC-UK (UK), FBI, and NSA AISC (US).
AI benefits for critical infrastructure include improved efficiency, decision support, cost savings and better service delivery.
AI in OT introduces risks to availability and reliability that could affect public safety and economic well-being if not managed properly.
Four core principles are recommended for secure AI–OT integration: understand AI; consider AI use in the OT domain; establish AI governance and assurance frameworks; embed safety and security practices into AI-enabled OT systems.
CI owners and operators are urged to review the joint guidance and implement the principles to reduce risk when deploying AI in OT environments.

Context and relevance

This guidance comes at a time when AI adoption across industrial and infrastructure settings is accelerating. Because OT often underpins health, safety and economic systems, the joint international approach signals that governments see AI–OT security as a cross-border priority. The principles align with ongoing trends in regulatory scrutiny, supply-chain resilience and the push for stronger governance around AI in safety-critical domains.

Why should I read this?

If you run, design or influence critical infrastructure, this is one of those must-see checklists. It tells you what to worry about, what to put in place and why a single misstep with AI in OT could ripple into real-world harm — so you can avoid firefighting later.