AI monitoring and threat modelling in the UK’s critical national infrastructure

What is the issue?

Artificial Intelligence (AI) is becoming an increasingly important part of how critical national infrastructure (CNI) is operated, maintained, and optimised. Across sectors such as energy and water, AI is being used to support functions including predictive maintenance, infrastructure monitoring, demand forecasting and operational decision making, offering opportunities to improve efficiency, reliability and resilience.

However, AI adoption may also create new forms of fragility that are not well captured by traditional resilience, performance or compliance measures. As AI becomes more deeply embedded in critical systems, organisations may become increasingly dependent on automated technologies, external providers, specialised expertise and interconnected digital infrastructure. Risks such as vendor concentration, workforce deskilling, reduced transparency, governance weaknesses and failures that propagate across interconnected systems may emerge gradually and be difficult to detect until after disruption occurs.

Despite growing AI adoption across CNI, there is limited visibility of where and how these technologies are being deployed, how dependent organisations are becoming on them, and whether appropriate safeguards are in place to manage failures and recover from disruption. Existing evidence is often fragmented across sectors, making it difficult for policymakers, regulators, and operators to develop a clear picture of emerging risks and resilience challenges.

As a result, there is currently no widely adopted approach for systematically identifying, monitoring and assessing how AI may affect the resilience of CNI. Addressing these gaps is essential to ensuring that the benefits of AI can be realised while maintaining the security, reliability and resilience of essential services.

How are we helping?

RAND Europe is working with the UK Artificial Intelligence Security Institute (AISI) to develop a practical framework for monitoring how AI adoption may affect the resilience of CNI. The project seeks to establish a cross-sector understanding of where AI is shaping resilience challenges, the types of fragilities that may emerge as adoption increases, and the extent to which organisations are prepared to manage and recover from AI-related disruption.

The research combines structured desk research, landscape analysis and extensive stakeholder engagement, including expert expert interviews and surveys. In addition, the research includes a series of validation workshops with infrastructure operators, regulators, policymakers, academics and industry specialists to ensure the accuracy and applicability of the monitoring framework. It also draws on foresight and scenario-building exercises to assess emerging technologies, future risk trajectories and factors affecting fragility and resilience across CNI sectors.

Using detailed evidence from the energy and water sectors, alongside additional analysis of the food and telecommunications sectors, we are developing a monitoring framework that distinguishes between three key dimensions of fragility: the extent of AI exposure, the sources of AI-related fragility, and maturity of measures in place to mitigate and manage risks. This approach enables a more proactive understanding of resilience by helping identify not only where failures occur, but also the underlying conditions that make disruption more likely.

This project will provide policymakers, regulators and infrastructure operators with an evidence-based framework and practical set of indicators for monitoring AI-related risks across sectors. By supporting earlier identification of emerging fragilities and strengthening oversight of AI adoption, this project aims to help ensure that AI contributes to more resilient CNI rather than creating new source of systemic fragility.