Energy and utility firms deploy high-risk AI systems when an agent acts as a safety component in supplying electricity, gas, heating or water. Article 26 of the EU AI Act then requires them to give oversight to people with competence, training and authority. That means control room operators who understand the agent's limits and can take back control at once.
What does Article 26 require of a utility?
In substance, a deployer of a high-risk system must use it according to the provider's instructions; assign human oversight to natural persons with the necessary competence, training and authority, and support them; ensure input data under its control is relevant and sufficiently representative; monitor operation, inform the provider of risks and suspend use if a serious risk appears; report serious incidents; keep logs under its control for an appropriate period; inform workers' representatives before using it at work; and inform people subject to its decisions where required.
Utilities usually also sit under NIS2 as essential entities, which already demands cybersecurity risk management and incident reporting. Article 26's duty to suspend a system and report serious incidents fits naturally into those arrangements.
Which utility agents are high-risk?
The Act treats as high-risk AI systems used as safety components in the management and operation of critical infrastructure, including the supply of water, gas, heating and electricity. An agent that can switch network sections, adjust pressure, dispatch flexibility or balance load, where its failure could endanger supply or safety, may be one. An agent that forecasts demand for a planner to use is a weaker case.
Other high-risk uses can appear too. A utility that assesses an individual's creditworthiness, for example before agreeing a deferred payment plan or financing a heat pump, is doing what the Act lists. Agents that manage field crews based on individual performance fall within the workforce uses.
Most customer service agents, billing assistants and asset reporting agents are not high-risk, though customers must be told when they interact with an AI system, and decisions affecting vulnerable customers, such as disconnection, deserve the same care regardless.
What competence does each role need?
Control room operators overseeing an agent that acts on the network need to know which actions it may take at which depth. A governed agent might read telemetry at depth 1, propose switching plans at depth 2, carry out pre-approved routine operations at depth 3, and have any action that could interrupt supply held for a named operator at depth 4. Operators must be able to read why an action was held, which bound held it, and the provenance of the data behind it: sealed readings from the utility's own systems, signed data from a neighbouring operator, or external data such as a third-party weather feed. They must be able to take manual control in seconds.
Field managers overseeing crew allocation agents need to understand what the agent weighs and to set aside allocations that are unsafe or unfair.
Customer and credit staff deciding payment plans need to read the agent's assessment and decide against it within mandate, with particular attention to customers in vulnerable circumstances.
Training must keep pace with the agent. An agent's certificate lapses after 90 days and is renewed against real cases; a run that clears no depth drops it to depth 1 the same day. In a control room, that means routine operations return to people immediately, which staffing and drills must anticipate, especially in winter peaks or storms.
Authority in a control room is usually clear for people: operators can act. The risk is a culture where the agent's proposal is treated as the default. Operators must be told, and shown, that rejecting a held action is normal work.
How does a utility meet Article 26's competence duty?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Identify high-risk uses | Inventory of agent capabilities touching supply safety, credit and workforce | Inventory signed by owners |
| Oversight assigned to named people | Named operators per shift for each network agent | Rotas and assignment register |
| Necessary competence | Simulator or scenario assessment on the utility's own network events | Assessment records per operator |
| Necessary authority | Operating procedures let operators reject held actions or take manual control | Procedures; rejections and takeovers in the record |
| Training kept current | Briefing at each agent recertification or network change | Briefing records linked to change log |
| Monitor and suspend | Agent suspension written into incident procedures | Suspension events; incident reports |
| Inform workers' representatives | Consultation before crew allocation agents go live | Consultation records |
Proving this across a workforce is discussed in how utilities can prove staff are trained to oversee AI agents, and the general idea in what evidence of competence is.
What will regulators ask?
Energy regulators, cybersecurity authorities and market surveillance authorities may each ask: which agents act on the network, and are they high-risk? Who can stop them, and how fast? Show the last held action an operator rejected. How were operators trained and assessed? What happened the last time an agent dropped to depth 1? How are customers in vulnerable circumstances protected when an agent drafts payment or disconnection decisions?
What does Article 26 not cover?
It does not set network safety or supply rules, which come from energy law and licence conditions. It does not apply to non-high-risk agents. It does not prescribe training content. It does not replace NIS2, data protection or consumer protection duties. Related treatments are in Article 26 duties in the public sector, relevant to publicly owned utilities, and in consumer lending, relevant to payment plans and financing.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where the Academy fits
Pryme Intelligence Academy's Architect track is for people who lead regulated, multi-agent deployments, ending in a capstone and a board review with two Pryme assessors, and the credential is valid for 24 months. For a utility running several agents across network, crews and customers, that is the level for whoever designs the oversight arrangements. Literacy across the wider workforce is covered in what AI literacy means for utilities using AI agents and AI literacy and certification for people who work with agents.
Questions people ask
Is a demand forecasting agent high-risk?
If it only informs planners who make the decisions, it is a weaker case for high-risk status than an agent that acts on the network. Check the exact use and its safety role with counsel.
How fast should operators be able to stop a network agent?
Fast enough that a wrong action can be halted before it affects supply. That is a design and drill question: test it and record the result.
Do customer service staff need Article 26 training?
Only if they oversee a high-risk capability, such as credit assessment for payment plans. Otherwise they need a baseline of AI literacy under Article 4.