Full Report
The New York Public Service Commission last week launched an inquiry into public utility use of artificial intelligence, noting that AI systems “create risk for organizations” but are also increasingly used to perform basic tasks. The Sept. 17 order requires electric, gas and water utilities to respond within 60 days with “a written inventory report…
Analysis Summary
# Regulation/Compliance: NY PSC Order Initiating Inquiry into Utility AI Use
## Overview
This regulation is a formal inquiry and reporting mandate issued by the New York Public Service Commission (PSC). It acknowledges that while Artificial Intelligence (AI) can improve operational efficiency in basic tasks, it introduces significant risks to critical infrastructure organizations. The order initiates a formal proceeding to audit and oversee how utilities are integrating AI into their operations to ensure safety, reliability, and security.
## Key Details
- **Issuing Authority:** New York Public Service Commission (PSC)
- **Effective Date:** September 17, 2026 (Order Date)
- **Jurisdiction:** New York State; Public Utilities sector
- **Status:** In Effect (Active Reporting Mandate)
## Requirements
### Mandatory Requirements
1. **Written Inventory Report:** Utilities must submit a comprehensive list of all AI systems currently in use.
2. **Use Case Descriptions:** The report must describe specific applications of AI within operations (e.g., customer service, system inspections, grid management).
3. **Risk Identification:** Organizations must identify potential risks created by these AI systems as part of the inquiry.
### Recommended Practices
1. **Continuous Evaluation:** Organizations should establish internal frameworks to evaluate new AI opportunities as technology evolves.
2. **Cross-Departmental Audit:** Engage both IT and operational technology (OT) teams to ensure all "shadow AI" or pilot programs are captured in the inventory.
## Affected Organizations
- **Industries:** Electric, Gas, and Water utilities.
- **Organization Size:** All jurisdictional public utilities regardless of size.
- **Geographic Scope:** New York State.
## Compliance Timeline
- **September 17, 2026:** Order formally initiated by the NY PSC.
- **November 16, 2026:** Final deadline for submission of the written inventory report (60 days from order).
## Implementation Guidance
### Assessment Phase
- Perform a top-down audit of all software and automated tools to distinguish between traditional automation and AI-driven systems.
- Categorize AI use cases by function (e.g., Customer Engagement, Infrastructure Inspection, Predictive Maintenance).
### Implementation Phase
- Compile the "Written Inventory Report" detailing the deployment date, purpose, and scope of each AI system.
- Draft technical descriptions of how these AI systems interface with utility operations.
### Validation Phase
- Conduct an internal legal and technical review of the report to ensure all jurisdictional use cases are disclosed.
- Submit the report through the NY PSC’s formal filing system (Document and Matter Management).
## Technical Requirements
- **System Inventory:** Documentation of AI models, data inputs, and operational outputs.
- **Cybersecurity Risk Profile:** Assessment of how AI integration affects the attack surface of critical infrastructure, particularly in Operational Technology (OT) environments.
## Penalties & Enforcement
- **Fines:** While specific fine amounts for this inquiry are not listed in the summary, the PSC has the statutory authority to issue civil penalties for failure to comply with commission orders.
- **Other Consequences:** Increased regulatory scrutiny, potential for mandated audits, and reputational risk.
- **Enforcement:** Enforced through the NY PSC’s oversight and regulatory proceedings.
## Related Standards
- **NIST AI Risk Management Framework (AI RMF):** Highly relevant for the risk assessment portion of the reporting.
- **NIST SP 800-53:** Relevant for security controls involving automated and AI-enhanced systems.
## Resources
- **Official Documentation:** [https://documents.dps.ny.gov/public/Common/ViewDoc.aspx?DocRefId={A044B0A0-0000-CD33-BEE0-07C138F2F784}] (NY PSC Order)
- **Associated News:** Utility Dive coverage of AI dependency risks.
## Practical Recommendations
1. **Define "AI" Broadly:** To ensure compliance, utilities should include machine learning, predictive analytics, and generative AI tools in their inventory.
2. **Centralize AI Governance:** Appoint a lead (CIO or CISO) to maintain the AI inventory beyond the 60-day deadline, as this inquiry likely signals future permanent regulations.
3. **Prepare for Follow-up:** The PSC inquiry is a "proceeding," meaning the data gathered will likely lead to further technical requirements or security mandates.