Energy and utility companies are increasingly using AI to transform many aspects of their operations. Common use cases include strengthening cyber and infrastructure defenses, making engineering knowledge easier to find, and reducing the time that employees spend assembling information. Realizing this value requires the same discipline that utilities apply to other consequential technologies, including processes to define operating boundaries, validate performance, and ensure accountability.
For an organization responsible for critical energy infrastructure, model capability is only one part of the purchasing decision. Where AI runs, what information it can access, and what authority it receives determine which workloads a utility can responsibly put into production.
Recent discussions between frontier AI labs and utility executives illustrate an important tension facing critical-infrastructure operators.
The question for utilities is no longer simply: “What can this model do?”
It is also: Where does it run? What information can it access? What actions can it take? How is it monitored? And who remains in control?
Cohere North is designed to address these questions and much more.
In this post, we’ll take a look at key considerations for utility leaders and how North can meet a utility organization’s security, data, and operational requirements.
Recent AI developments raise the stakes
OpenAI’s recent engagement with utilities reflects the growing role of AI in critical-infrastructure cybersecurity. Its September Daybreak announcement describes a gathering of utility leaders whose organizations cover 40 states and Washington, D.C. and collectively serve more than half the US population. The initiative aims to help utilities identify vulnerabilities, analyze suspicious activity, and develop and test fixes.
The opportunity comes with a clear reminder about control. In OpenAI’s August incident report, the company described how models undergoing internal cybersecurity evaluations in July circumvented isolation controls, communicated through unauthorized channels, and compromised parts of its research infrastructure and Hugging Face’s systems. The evaluations used reduced safeguards, and the disclosure does not establish that utility grid-control systems were compromised. OpenAI described subsequent measures to strengthen isolation, monitoring, and alignment.
For utility leaders, these developments underscore a practical point: greater AI capability must be accompanied by secure deployment boundaries.
Five questions every AI proposal should answer
- What measurable problem will this solve? Define the workflow, establish a baseline, and evaluate output quality alongside speed.
- What can the agent actually do? Specify which systems the agent can access, what actions it can take, and which human approvals are required.
- What information leaves our environment? Identify every external dependency. Follow the data through the entire workflow, including document processing, model inference, storage, logs, integrations, telemetry, and support access.
- How will recommendations be validated? Require traceability of supporting source material and associated citations, along with human-in-the-loop evaluations by subject matter experts (SMEs).
- What happens after the pilot? Establish a licensing agreement that provides commercial predictability throughout the path to full production and mitigates token shock.
A different approach: Bring AI to the utility’s data
Cohere’s approach to enterprise AI is to deliver the models to the data that utilities need to protect. Rather than requiring organizations to redesign sensitive workflows around a public AI service, Cohere’s North platform can be deployed within the operator’s secure perimeter, which can fundamentally expand where utilities are able to use AI.
North creates a path for utilities to work with engineering documents, asset histories, emergency procedures, customer information, and internal operating knowledge within their controlled environments without the potential for data egress. This allows operators to select an architecture that fits the sensitivity of the workload and its requirements for control over data and infrastructure.
The following considerations can help utilities ensure a successful rollout of AI across their organization.
Keep authority and accountability with the utility
As AI agents become more capable, one principle becomes essential: the organization deploying an AI agent must decide what it is authorized to do. With built-in access controls, audit visibility, and configurable workflows, North combines enterprise-grade performance with robust governance. This allows organizations to define what information individual workflows can access and what authority their integrations receive.
A sensible starting point would be to use North to create an agent that retrieves approved information, compares documents, identifies inconsistencies, and prepares recommendations for employee review. Its authority can expand after the agent demonstrates reliable performance and the organization verifies that its safeguards are effective. Note that access to production or operational systems should require separate authorization and appropriate approval controls, enforced through identity, network, and application permissions.
Good governance frameworks, practices, and policies make those boundaries durable. Each workflow should have an accountable owner, approved uses, evaluation criteria, and a change-control process. Traceability should connect a recommendation to its source records and preserve the relevant versions, approvals, and execution logs. Teams also need a tested way to stop a workflow and investigate failures.
Private deployment supports a secure operating model that creates a deliberate path from AI that informs to AI that acts, with the utility controlling that progression.
Put institutional knowledge to work
Much of the near-term value from AI can come from helping employees use information that the utility already owns. For example, an engineer could use AI to assemble an asset’s maintenance history before it is reviewed. A storm response team could quickly locate the applicable section of an approved emergency plan. Or a regulatory team could gather supporting records for a filing.
AI-powered enterprise search and retrieval can reduce the effort required to find that material. It gives employees the ability to inspect the search output’s supporting sources, check that guidance is current, and resolve conflicting records before relying on an answer. These workflows can also help newer employees learn from documented experience as long-serving colleagues retire while preserving the role of professional judgment.
Build a business case that lasts
A shared AI platform creates an opportunity to reuse approved infrastructure, integrations, and governance across departments. That said, each additional use case should still earn its place through measured results.
A strong business case for a particular project includes licensing, hardware requirements, integration, support, security operations, and ongoing evaluation. It includes a rollout plan that starts with a bounded workflow, then measures the results, and finally expands only when both the value and the controls are demonstrated. This gives the project a defensible basis for investment, and provides the organization with a repeatable method for deciding where AI belongs.
The goal should not be to deploy AI everywhere. It should be to create a controlled foundation on which additional use cases can be introduced when their value has been demonstrated.
Conclusion
By enabling utilities to deploy AI within environments they control, connect it securely to their own knowledge, define access and agent authority, and expand automation as performance and safeguards are demonstrated, North provides a practical foundation for enterprise AI in critical infrastructure.
The opportunity is to combine increasingly capable AI with something utilities have always required: operational discipline, clear accountability, and control over the systems on which their customers depend. For utilities, this operational discipline is part of the value proposition from the first deployment.
Interested in exploring what controlled, private AI could look like for your utility? Contact Cohere to learn more about North for utilities and how it can be deployed to meet your organization’s security, data, and operational requirements.
