AI in Power Generation Faces Legal Vacuum as Regulators Lag

Why it matters

Power generators are rapidly adopting AI for bidding, operations, and maintenance without clear regulatory guardrails. The legal exposure spans multiple domains—from FERC market rules to NERC reliability standards to emerging state AI laws—creating compliance uncertainty that could translate into enforcement actions, financial penalties, or tort liability. Companies that build governance frameworks now will have a structural advantage as rules crystallize.

The regulatory gap

As of August 2026, no state Public Utilities Commission has issued formal guidance on how utilities should deploy AI in operations, according to analysis from Foley Hoag. Arizona stands alone in opening a formal examination: the Arizona Corporation Commission launched Docket AU-00000A-26-0060 to query electric, gas, and water utilities about their use of AI in forecasting, procurement, and planning, with a stakeholder workshop expected in October 2026.

The vacuum leaves generators navigating a convergence of legal frameworks never designed for algorithmic decision-making. Power companies are using AI for market bidding, plant operations, predictive maintenance, asset optimization, and wildfire detection—all activities governed by existing rules that don't account for machine learning's opacity or autonomy.

Grid reliability and market manipulation exposure

Generators must comply with mandatory North American Electric Reliability Corporation standards enforced by the Federal Energy Regulatory Commission. If an AI-driven operational decision causes a reliability violation, the compliance framework imposes substantial penalty risk. NERC's sanction guidelines consider factors including management involvement, self-reporting, and whether a compliance program existed—but offer no clarity on how those factors apply when an algorithm, not a human, made the call.

NERC Critical Infrastructure Protection standards require rigorous access controls and change management for systems touching bulk electric system cyber assets. Those obligations become difficult to satisfy when AI models update frequently with minimal human oversight.

On the market side, AI-driven trading strategies raise enforcement risk under FERC's Anti-Manipulation Rule. Algorithmic coordination between generators using similar models—even unintentional—could trigger allegations of tacit collusion. FERC's Office of Enforcement has prioritized fraud and market manipulation cases, and its Division of Analytics and Surveillance actively monitors algorithmic behavior in organized markets.

Cybersecurity and data privacy layers

Power generation facilities qualify as critical infrastructure under Presidential Policy Directive 21 and the Federal Power Act. Integrating AI systems—especially cloud-hosted or vendor-managed solutions—expands the attack surface. Under the Cyber Incident Reporting for Critical Infrastructure Act of 2022, generators will soon be required to report substantial cyber incidents within specified timeframes, including AI-related breaches.

AI systems ingest large volumes of operational data, creating trade secret and privacy risks. Where generation data intersects with customer information, state privacy statutes like California's Consumer Privacy Act may impose notice and consent obligations. Generators with international operations face additional complexity under frameworks like the EU's General Data Protection Regulation.

Emerging governance patchwork

Federal AI policy remains in flux. Executive Order 14110, issued in October 2023, directed agencies to assess AI risks in critical infrastructure. The Trump Administration revoked that order in January 2025, then issued Executive Order 14409 in June 2026 directing agencies to strengthen federal infrastructure against AI-enabled risks and establish an AI cybersecurity clearinghouse for critical infrastructure operators.

Multiple states are advancing bills with competing standards for automated decision systems, algorithmic impact assessments, and transparency requirements. Generators operating across state lines face a fragmented compliance landscape likely to shift significantly in coming years. The EU Artificial Intelligence Act adds another layer for companies with European operations, potentially classifying energy infrastructure AI systems as "high-risk" and triggering conformity assessments and human-oversight requirements.

Liability and insurance gaps

If an AI system causes a generation failure, equipment damage, or grid disturbance, traditional negligence frameworks struggle with the technology's opacity. Potential theories include products liability against AI vendors, negligence against the generator for inadequate oversight, and strict liability for abnormally dangerous activities. Standard commercial general liability and property policies may exclude AI-related losses or contain cyber exclusions that create coverage gaps.

AI used for emissions optimization or environmental compliance monitoring introduces additional risk if the system produces inaccurate outputs relied upon in regulatory filings to the Environmental Protection Agency or state agencies. Submitting AI-generated data without adequate validation could expose generators to enforcement actions for material misstatements, though no enforcement precedent specifically addressing AI-generated environmental data has yet emerged.

Building governance now

Foley Hoag recommends generators establish AI governance frameworks that include algorithmic risk assessments prior to deployment, human-in-the-loop requirements for safety-critical decisions, vendor due diligence, contractual protections, regular model auditing and validation protocols, and incident response plans specific to AI failures. Engagement with industry groups like the Electric Power Research Institute and its Open Power AI Consortium can help develop sector-specific best practices.

These details were first reported by Foley Hoag in their Energy and Climate Counsel blog.