A water utility board must approve a leak-prediction model. What should be the governance baseline for AI security expectations?

Recognized industry AI security guidance mapped to the utility’s control objectives is the soundest basis for evaluating an AI vendor supporting water or power operations. Mapping translates abstract guidance into utility-specific requirements—identity, change control, model integrity, logging, incident response, and OT/IT boundary protections—so procurement and security can score evidence, not slogans. That mapping also creates a reusable baseline for future AI suppliers serving critical municipal infrastructure.

Relying on the vendor’s slide deck claims of “military-grade AI security” fails because marketing superlatives are untestable without independent controls evidence and often misuse assurance language. Anonymous social-media tips about a competitor fail conceptually as an evaluation basis: they lack provenance, invite bias or disinformation, and do not map to the utility’s control objectives. An intern’s personal notebook of preferred model brands fails because brand preference is not risk-based selection and bypasses formal security requirements.

Exam caveat: industry guidance must be tailored to utility OT constraints and safety instrumented systems; wholesale IT-cloud checklists without operational technology context can miss process-safety risk.

Operational check: require vendors to respond against a mapped AI security control objectives matrix, discard marketing-only claims as insufficient evidence, and keep selection records auditable for regulators and the utility board.