Critical Infrastructure Policy

Rules for AI in grids, water, transport and the data centers AI runs on.

China requires a preliminary incident report within four hours under rules in force since November 2025, and its amended Cybersecurity Law added an AI clause in January 2026. The US AI-ISAC was still a pre-decisional memo in February 2026, and grid network monitoring is not enforced until October 2028.

Incident reporting clocks: China, preliminary report 4 hours; EU NIS2, early warning 24 hours; EU NIS2, notification 72 hours; China, full report 72 hours; China, post-incident analysis 30 days INCIDENT REPORTING CLOCKS China, preliminary report 4 hours EU NIS2, early warning 24 hours EU NIS2, notification 72 hours China, full report 72 hours China, post-incident analysis 30 days HOURS
China AI compute, Jun 2026
2,185 EFLOPS
China 2030 compute target
9,800 EFLOPS
US fast-track data center threshold
100 MW
Registry incidents
1

Evidence

China tightened infrastructure reporting while the US built data centers faster

Developments: critical Infrastructure Policy
DateCaseCountryWhat happenedSource
Jul 23, 2025EO 14318 on data center permittingUnited StatesFaster review for data centers over 100 MW or $500 millionSource
Dec 3, 2025Principles for AI in operational technologyUS, Australia, UK and partnersFour principles for integrating AI into OTSource
Jan 1, 2026China amended Cybersecurity LawChinaFirst AI article; fines up to RMB 10 millionSource
Feb 3, 2026AI-ISAC statusUnited StatesStill a pre-decisional memo with no timelineSource
Sep 2026MIIT information infrastructure planChinaRMB 3.8 trillion for 2026 to 2030; extends East Data West ComputingSource

Registry

One registry incident drew regulator or court action relevant to critical infrastructure policy

Registry incidents linked to this page
IncidentDateRegulator or court action
Chinese State Group Runs Espionage Through Claude CodeSep 2025On November 26, 2025, the House Homeland Security Committee asked Anthropic CEO Dario Amodei to testify.

Rules

Infrastructure rules cover AI indirectly through incident reporting and high-risk lists

Key instruments: critical infrastructure policy
RuleJurisdictionWhat it requiresStatus
EO 14318 data center permittingUS federalFast-track review and federal land for large data centersSigned Jul 23, 2025
NERC CIP-015-1North AmericaInternal network monitoring for the gridEnforced Oct 1, 2028
China Cybersecurity Law amendments and incident rulesChina4, 72 and 720-hour reporting; higher finesNov 2025 and Jan 2026
EU AI Act Annex III, point 2EUAI safety components in infrastructure are high-riskDec 2, 2027
NIS2 and CER directivesEUCyber and physical resilience for critical entitiesNIS2 deadline Oct 17, 2024; incomplete

Status colors: green in force, blue voluntary standard or framework, amber adopted and phasing in, gray draft or pending, red withdrawn.

Record

Page Record

Datasets
ai_governance_evidence.csv (5 rows); ai_rules.csv (245 rows); registry incidents (1 linked)
Key sources
EO 14318 on data center permitting
Principles for AI in operational technology
China amended Cybersecurity Law
AI-ISAC status
MIIT information infrastructure plan
Last verified
October 2026