AI in the ISMS: what German utilities must prove for their AI applications

No AI provision, but still in the audit

Neither the BSI Act as amended on 6 December 2025 nor §§ 5c to 5e EnWG mentions artificial intelligence. They don't have to. § 30(1) BSIG requires measures for the "IT systems, components and processes" an entity uses to provide its services (our translation). A language model answering customer emails is one of those. So is a machine-learning load forecast.

Deployments are growing faster than inventories. According to the PwC study reported by the trade paper ZfK on 13 April 2026, 79 percent of the utilities surveyed have rolled out first AI solutions, and 61 percent of those are still experimenting. Roughly three quarters of the 70 or so solutions in the study run on hyperscaler cloud infrastructure. For the ISMS that means data leaves the company's own data centre and one more provider joins the supply chain.

One sentence in the EnWG is easy to miss. Under § 5c(1) sentence 2, adequate protection must be ensured "as early as the procurement of plant equipment and services" (our translation). An AI pilot that quietly slides into production after six months has missed that moment.

The framework itself is covered in our piece on the IT security catalogue under § 5c EnWG and in the overview of NIS2 and the KRITIS Umbrella Act.

Which framework covers which AI

It depends on where the AI runs. Systems needed for the secure operation of a power or gas grid fall under the IT security catalogue under § 5c EnWG. Other activities may fall under § 30 BSIG. And AI that acts as a safety component of a critical entity also falls under the AI Act's high-risk rules from 2 December 2027.

§ 28(5) BSIG sets the switch. Sections 30, 31, 32, 35, 36, 38, 39, 61 and 62 BSIG do not apply to entities that operate energy supply networks, energy plants or digital energy services and are subject to §§ 5c to 5e EnWG. The next sentence carves back: an operator of further critical facilities, or one whose further activities belong to an entity type in Annexes 1 or 2 of the BSIG, is covered by the BSIG for those. Multi-utility Stadtwerke with drinking water or district heating know this double track well.

Until the new version arrives, grid operation is governed by the IT security catalogue of August 2015 and critical energy plants by the one of December 2018. The BNetzA confirms this on its page for the rule-making procedure. Both catalogues centre on an ISMS under DIN EN ISO/IEC 27001 and its certification. There are no exemptions by grid operator size.

The AI Act comes in elsewhere. Article 15(5) requires the provider of a high-risk AI system to guard against poisoned training data, "adversarial examples" and "model evasion". The deployer, meaning the utility, must keep automatically generated logs for at least six months under Article 26(6). Whether an AI system is caught at all is the subject of our piece on Annex III and the Commission's guidelines. For most AI at a municipal utility the answer is no. The ISMS asks anyway.

AI applications as assets: what is new in the ISMS

What's new is less the duty than the attack pattern. A language model can't reliably tell instructions from data. Put a hidden command into a customer email, and an assistant summarising that email may carry it out. OWASP ranks this first in its 2025 list for LLM applications (prompt injection), followed by sensitive information disclosure and the supply chain. Sixth place goes to "excessive agency": an agent with more permissions than it needs.

Four parts of the ISMS change noticeably.

• Inventory. The BSI criteria catalogue of 6 June 2025 calls for an overview of all AI applications, with owners, models in use and permitted use cases. It should show what each application can access, so that a new vulnerability in a model can be traced to the affected systems quickly.
• Data leakage. Connecting a model to customer data or meter readings, for instance through retrieval-augmented generation, needs an access check before retrieval. Germany's data protection conference (DSK) published dedicated guidance on RAG in October 2025.
• Supply chain. § 30(2) no. 4 BSIG and § 5c(4) no. 4 EnWG name it explicitly. With AI it covers the model provider, the cloud platform, plugins and the origin of downloaded model weights. The BSI regards the pickle format as unsafe and advises checking signatures.
• Logging. Without logs of inputs, outputs and triggered actions, an incident can be neither detected nor reported.

The inventory is the bottleneck. An AI feature that a software vendor adds to an existing product never passes through procurement. The BSI catalogue leaves such products out as long as the organisation cannot tell AI is inside. An auditor will still ask which systems touch customer data, and at that point it becomes obvious.

What the BSI says about LLM systems

Three papers, none of them binding. They are still the obvious yardstick for an ISMS audit, because § 30(2) BSIG says measures should "comply with the state of the art" and § 5c(3) EnWG sets the same bar for the catalogue (our translation).

One line from the evasion paper belongs in every risk analysis: there is currently "no single bullet proof solution" against such attacks, and even market leaders with several layers of defence struggle to stop them reliably. That's more honest than most product sheets. It also means documenting the residual risk and limiting the impact, rather than promising invulnerability.

The BSI's older baseline paper on generative AI models has been at version 2.0 since 17 January 2025. If you want a broader introduction that is not specific to energy, our earlier piece on BSI-compliant AI integration covers it. It won't work as a list of obligations: it has no link to the EnWG or the catalogue.

ISO 27001 stays the evidence, ISO 42001 is an option

ISO/IEC 42001, published in December 2023, describes a management system for AI. Neither the BSIG nor the EnWG requires it. What counts for the BNetzA is certification to ISO/IEC 27001 as the IT security catalogue demands, and according to its procedure page the agency wants the new catalogue to follow the "process-oriented management system approach of ISO/IEC 27001" even more closely (our translation).

Both standards share the same high-level structure: context, leadership, planning, support, operation, evaluation, improvement. So a utility can run 42001 as an extension of its existing ISMS, with a joint management review and joint internal audits. The added value lies where 27001 is silent, in impact assessment for affected people, data quality and the life cycle of a model.

Our view: if you have no inventory of your AI applications yet, a 42001 certificate gains you little. If you have one and want to run governance, AI literacy under Article 4 of the AI Act and information security in one system, 42001 makes a workable frame. How the parts of AI governance fit together is shown in our AI governance building blocks.

Recital 55: cyber AI is not a safety component

Here is a distinction that takes weight off many utilities. Annex III no. 2 of the AI Act classifies AI systems used as safety components in electricity, gas or heat supply as high-risk. Recital 55 draws the line: components "intended to be used solely for cybersecurity purposes" should not count as safety components. As examples of genuine safety components the regulation names systems for monitoring water pressure and fire alarm control systems in cloud computing centres.

The Commission's draft guidelines of May 2026 get more specific. According to the analysis by McCann FitzGerald of 2 June 2026, they list an AI system for cyber monitoring of energy grids as an example outside the high-risk category. And no. 2 only bites when the deployer is designated a critical entity under the CER Directive.

For the ISMS nothing changes. Attack detection systems are a mandatory part of the catalogue under § 5c(4) no. 11 EnWG. If such a tool uses machine learning, it's an asset like any other, with a supplier, an update path and its own attack surface. A tool that defends against attacks needs defending too.

How far the catalogue may reach

The catalogue's reach has been disputed since the first draft. In May 2025 the BNetzA consulted on key points, still under the old § 11 EnWG. Its stated aim: to harmonise the catalogues for grids and plants and to extend them to the newly regulated addressees, operators of digital energy services among them.

On 11 June 2025 the association of municipal utilities, VKU, pushed back. "We need an IT security catalogue cast in one piece, not patchwork," said its chief executive Ingbert Liebing. On the demand that certain systems run with no residual risk: "There is no such thing as 100 percent security. Not even if you write it into regulatory texts." (Both quotes our translation.) The VKU also disputed that the BNetzA may regulate the office IT of energy companies at all.

ANSSI and the BSI put the emphasis elsewhere. Their paper recommends deliberately limiting the autonomy of LLM systems and placing critical decisions under human supervision. It draws no line between the office and grid control.

Then there is the copilot that grid planning uses in the office, with read access to grid data. Office IT that, on the VKU's reading, the BNetzA may not regulate? Or a system that matters for secure grid operation? The new catalogue will have to answer that. Today nobody has.

AI incidents and the reporting deadlines

A data leak through a manipulated chatbot is, first of all, a security incident like any other. If it is significant within the meaning of § 2 no. 11 BSIG, operators under § 5c EnWG face the deadlines in § 5d(3): an early warning within 24 hours, a notification with a first assessment within 72 hours, a final report no later than one month after that. What this chain looks like for ransomware is laid out in our piece on reporting and evidence duties under NIS2.

The harder part comes before the report. A prompt injection leaves no malware on a server; it sits in the text of a request. Without logs of what went into the model and what it set off, you notice the leak only when someone else finds it. Where personal data is involved, the 72-hour notification under Article 33 GDPR may apply as well. Two reporting routes, one incident, and both need the same logs.

What happens on a breach is set out in general terms in the law. For energy grids and energy plants, § 95(1) nos. 3b to 3e EnWG sanctions breaches of §§ 5c to 5e within the framework of § 65 BSIG: up to 10 million euros for essential entities and up to 7 million euros for important ones, and for turnover above 500 million euros up to 2 percent or 1.4 percent of worldwide annual turnover. Under § 5e EnWG management must oversee implementation and is liable to its own company for damage caused culpably.

Challenges and risks

The biggest uncertainty is the catalogue itself. Until the BNetzA adopts it, auditors check against the 2015 and 2018 versions, which know nothing about AI. Anyone adding AI-specific measures now does so without an official template, with the state of the art as the only justification.

Shadow AI is the second issue. A language model in the browser that someone uses to rephrase a customer complaint shows up in no inventory. That is why the BSI criteria catalogue relies on terms of use that set which data may go into which application, and on training for all end users.

And registration. By the end of the grace period on 31 July 2026, more than 19,000 entities had registered with the BSI, against an estimated 29,500 in scope, ZfK reported on 4 August 2026. The BSI is having that estimate reviewed. An organisation still working out its own classification has other priorities than AI in the ISMS.

What utilities should do now

You don't need a special track for AI. What helps is a handful of decisions inside the existing ISMS, made before the new catalogue lands.

Next steps

1. Build the inventory

   Every AI application with owner, model, vendor, data access and permitted use cases, including the AI features inside existing software.

2. Decide the scope

   For each application, record whether it belongs to secure grid operation and therefore to the scope of the IT security catalogue, or whether § 30 BSIG applies. Don't leave the copilot with grid data open; assign it, with reasons. Those reasons belong in the documentation, not in an email.

3. Extend the risk analysis to AI attacks

   Prompt injection, data leakage, supply chain. The checklist in the BSI paper on evasion attacks is a usable starting point.

4. Bring AI vendors into supplier management

   An assurance that inputs are not used to train public models, the data location, and the vendor's own incident reporting path.

5. Log, then rehearse

   Decide what gets recorded: prompts and responses, plus every action the system triggers. Then run one tabletop exercise with an AI incident.

6. Train management

   § 5e(3) EnWG and § 38(3) BSIG require regular management training on IT risks. AI risks belong in it.

How we support utilities in setting up AI governance with a register and an approval path is described in our service AI governance for utilities. All articles on the subject are collected in the topic area AI in the energy industry.

Further reading

Frequently asked questions