OT and ICS Integration

How AI agents connect to factory, grid and pipeline control systems.

Joint guidance from nine agencies in six countries on December 3, 2025 says AI should not make operational safety decisions and every AI-enabled process must fall back to manual control. Siemens and Rockwell now ship AI agents inside the engineering tools that program controllers.

Purdue model levels and AI controls: Level 4-5 Enterprise: LLMs on exported OT data only; Level 3.5 DMZ: Push-only, one-way transfer; Level 3 Operations and engineering: Siemens Eigen agent · Rockwell Conductor; Level 2 Supervisory control: VOLTZITE reached engineering workstations; Level 1 Controllers: NERC CIP-015 network monitoring; Level 0 Process and robots: No AI safety decisions · ISO 10218 PURDUE LEVELS AND WHERE AI CONNECTS 4-5EnterpriseLLMS ON EXPORTED OT DATA ONLY 3.5DMZPUSH-ONLY, ONE-WAY TRANSFER 3Operations and engineeringSIEMENS EIGEN AGENT · ROCKWELL CONDUCTOR 2Supervisory controlVOLTZITE REACHED ENGINEERING WORKSTATIONS 1ControllersNERC CIP-015 NETWORK MONITORING 0Process and robotsNO AI SAFETY DECISIONS · ISO 10218
Ransomware groups hitting industry, 2025
119
Average ransomware dwell in OT
42 days
OT threat groups tracked by Dragos
26
Registry failures
0

Registry

No registry incident yet turns on a failed OT and ICS integration control

None of the 19 incidents in the 137AI Incident Registry records a failure of this control. That reflects what public sources disclose about each incident, not proof the control works; the failures that did surface sit under behavioral envelopes, human oversight and access control.

Implementations

Industrial AI agents arrive at the engineering level, above the controllers

Siemens' Eigen Engineering Agent works inside TIA Portal, and Rockwell's FactoryTalk Conductor, announced October 21, 2026, offers locally hosted models. In China, SUPCON and Inspur pitch an "autonomous operating plant" built on SUPCON's TPT model, with no published human-confirmation controls. Dragos saw VOLTZITE, which overlaps with Volt Typhoon, move from cellular gateways to engineering workstations at US pipelines.

Named OT and ICS integration implementations
ImplementationVendor or bodyCountryWhat it enforcesStatus
CIP-015 internal network security monitoringNERC and FERCUnited StatesMonitoring of traffic inside the grid electronic security perimeterFERC Order 907, Jun 26, 2025
Eigen Engineering AgentSiemensGermanyAI agent inside TIA Portal engineeringHannover Messe 2026
FactoryTalk ConductorRockwell AutomationUnited StatesVerified agents and skills; option for locally hosted modelsAnnounced Oct 21, 2026; GA Q1 2027
Principles for the Secure Integration of AI in OTCISA, NSA, FBI, ASD ACSC, BSI, NCSC and othersInternationalNo AI safety decisions; manual fallback; push-only data export; AI off switchDec 3, 2025
TPT model with Inspur appliancesSUPCON and Inspur InformationChinaOn-premises process-industry AI; no published human-confirmation controlsMay 2026

Row color shows the agent class served: orange physical, teal personal and ambient, blue software.

Recent events

  • Dragos named three new OT threat groups in February 2026: AZURITE, PYROXENE and SYLVANITE.
  • FERC directed NERC to extend grid network monitoring to access control systems, calling the gap a reliability risk.
  • ISO 10218:2025 folded the ISO/TS 15066 force limits into the robot safety series.
  • China requires critical infrastructure operators, industrial ones included, to report incidents within one hour from November 1, 2025.

Exposure

Physical access and connectivity surface rate very significant or critical for four of 17 agent types

The OT and ICS integration discipline covers the physical access and connectivity surface dimensions of the agent attack surface ratings. These agent types depend on it most.

Agent types most exposed on this dimension
Agent typeDimensionRatingWhy
Industrial robots and cobotsPhysical accessVery significantCobots work within reach of people by design
DronesConnectivity surfaceVery significantEvery flight depends on radio or cellular links
Fleets and swarmsConnectivity surfaceVery significantFleet connectivity is operational requirement
Smart home assistantsConnectivity surfaceVery significantHome WiFi, Zigbee, Z-Wave, Thread, Bluetooth, cellular for some devices

Rules

OT security standards are mature; AI-specific OT rules are guidance only

Rules and standards for OT and ICS integration
RuleJurisdictionWhat it requiresStatus
Principles for the Secure Integration of AI in OTUS and partnersNo AI safety decisions; manual fallback; push-only export; AI off switchDec 3, 2025
IEC 62443 seriesInternationalZones, conduits and security levels for industrial systemsCurrent
NERC CIP-015-1North AmericaInternal network security monitoring for the gridEffective Sep 2, 2025, phased
EU Cyber Resilience ActEUSecurity by design and vulnerability reporting for digital productsReporting from Sep 11, 2026; full Dec 11, 2027
Critical Information Infrastructure Security Protection RegulationsChinaOperator security, incident reporting, procurement reviewEffective Sep 1, 2021
MLPS 2.0 (GB/T 22239-2019)ChinaGraded protection with an industrial control extensionEffective Dec 1, 2019

Status colors: green in force, blue voluntary standard or framework, amber adopted and phasing in, gray draft or pending, red withdrawn.

Limits

OT controls assume deterministic systems that behave the same way twice; AI models do not

Network separation also weakens once vendors want cloud connections for model updates and remote analytics.

Record

Page Record

Datasets
ai_control_implementations.csv (5 rows for this page); ai_incident_controls.csv (0 linked); ai_attack_surface.csv
Key sources
CISA, NSA, FBI, ASD ACSC, BSI, NCSC and others
NERC and FERC
Rockwell Automation
SUPCON and Inspur Information
Siemens
Source notes
Eigen Engineering Agent: secondary source; TPT model with Inspur appliances: secondary source
Last verified
October 2026