> For the complete documentation index, see [llms.txt](https://docs.layerlens.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.layerlens.ai/more-in-this-section-2/compliance-1.md).

# Energy and utilities compliance

Energy compliance combines **federal reliability rules (NERC) + federal energy regulator (FERC) + state PUCs + pipeline / OSHA safety + environmental (EPA) + market rules (ISO/RTOs)**. AI in this sector inherits all layers.

## Regulatory frame

| Regime                          | Applies when                               | Evaluation-evidence shape                               |
| ------------------------------- | ------------------------------------------ | ------------------------------------------------------- |
| **NERC CIP**                    | Bulk Electric System cyber assets          | Asset classification; access control; incident response |
| **NERC OPS / PRC / TPL / etc.** | BES reliability                            | Procedure compliance; protection coordination           |
| **FERC orders**                 | Interstate transmission, wholesale markets | Order-specific requirements (e.g., 880, 881, 2222)      |
| **State PUC / CPUC rules**      | Retail rates, service quality              | Tariff filings; rate cases                              |
| **CPUC wildfire rules (CA)**    | CA electric utilities                      | Wildfire mitigation plans; AI risk-modeling oversight   |
| **PHMSA (49 CFR 192/195)**      | Gas / liquids pipelines                    | Integrity management; record retention                  |
| **OSHA 1910.269**               | Electric power generation/T\&D             | Switching/working-on rules; LOTO; PPE                   |
| **EPA Clean Air / Water Acts**  | Power generation; water utilities          | Emissions / discharge monitoring                        |
| **ISO/RTO market rules**        | Wholesale market participants              | Specific market protocols                               |
| **Privacy laws (CCPA, etc.)**   | Customer-data scope                        | DSR; consent; retention                                 |
| **CALEA / state surveillance**  | Carrier-like services (some utilities)     | Lawful intercept                                        |
| **NIST AI RMF**                 | Voluntary; cited in DOE / NREL guidance    | GOVERN/MAP/MEASURE/MANAGE evidence                      |

## NERC CIP

NERC Critical Infrastructure Protection standards apply to BES Cyber Systems:

* CIP-002: Cyber asset categorization
* CIP-003: Security management
* CIP-004: Personnel and training
* CIP-005: Electronic security perimeters
* CIP-007: Systems security management
* CIP-008: Incident reporting
* CIP-010: Configuration change management and vulnerability assessments
* CIP-011: Information protection
* CIP-013: Supply chain risk management

Penalties up to $1M per day per violation.

**Stratix posture:**

* Stratix is **not** a BES Cyber System; it is a SaaS evaluation platform
* For utilities using Stratix to evaluate AI that influences BES operations, the AI itself and its operational-deployment footprint may be in CIP scope (depending on impact rating)
* BYOK custom models recommended for sensitive workloads
* NERC CIP-013 supply-chain diligence package available — talk to enterprise

## FERC orders

Selected high-impact orders:

* **Order 880** — Cybersecurity reporting requirements
* **Order 881** — Ambient-adjusted ratings for transmission
* **Order 2222** — DER aggregation in wholesale markets
* **Order 2023** — Generator interconnection reform

Each carries specific compliance evidence requirements.

## State PUC / CPUC

State-by-state regulation of retail service:

* **CPUC AI rules (CA)** — Active rule-making; wildfire-mitigation AI is most scrutinized
* **NY PSC / CT PURA / TX PUC / IL ICC / others** — Per-state proceedings on AI-influenced decisions
* **Service-quality penalties** when AI-driven systems contribute to outages

**Stratix evaluation evidence:**

* AI use-case inventory tied to filings
* Drift dashboards for regulator-pull-on-demand

## PHMSA (49 CFR 192/195)

Gas-pipeline (192) and liquids-pipeline (195) safety:

* Integrity management programs
* Operator qualification
* Public awareness
* Incident reporting

**Stratix evaluation evidence:**

* Hard rule on field-safety AI: cite 49 CFR section
* Audit log of AI guidance vs. recorded incidents

## OSHA 1910.269

Electric power generation, transmission, distribution. The dominant federal worker-safety standard for line work.

**Stratix evaluation evidence:**

* LOTO + PPE rules on every field-safety AI output
* Manual-version match rule

## EPA

Clean Air Act / Clean Water Act apply to generation and water utilities. AI used in compliance reporting must produce verifiable inputs.

## ISO/RTO market rules

Each ISO/RTO has its own protocols:

* PJM, MISO, ERCOT, CAISO, ISO-NE, NYISO, SPP
* Settlement disputes are common; AI-augmented bidding must produce auditable trail
* FERC enforcement on market manipulation extends to algorithmic strategies

**Stratix evaluation evidence:**

* ISO-rule compliance rule per market output
* Settlement-data freshness check

## Privacy laws

CCPA / state privacy / GDPR — same framework as [retail compliance](/more-in-this-section-2/compliance-10.md).

## NIST AI RMF

Cited as voluntary best practice in DOE and NREL AI guidance. For DOE-funded R\&D, NIST AI RMF mapping is a common deliverable.

## Recommended setup

1. Pro tier minimum; Enterprise for utilities and ISO/RTO participants
2. SSO + RBAC for dispatch / NOC / customer-service / field roles
3. BYOK custom models for NERC CIP-touching workloads
4. Hard rules: advisory-only on dispatch, switching-procedure citation, NERC standard compliance, OSHA 1910.269 / PHMSA citation, medical-baseline routing
5. Group-fairness scorers on customer-affecting AI
6. Audit retention matching the longest applicable NERC / PHMSA / state requirement (default 7+ years; 6 years for many NERC standards)
7. AI use-case inventory tied to NERC and state filings
8. NIST AI RMF mapping retained per use case
9. DPA executed; tenant data residency where contracted

## See also

* [Energy scenarios](/more-in-this-section-2/scenarios-1.md)
* [Energy eval patterns](/more-in-this-section-2/eval-patterns-1.md)
* [Concept: Multi-tenancy](/7.-observe-see-whats-happening/multi-tenancy.md)
* [Enterprise](/4.2-industry-use-cases/energy-utilities.md)
* [BYOK custom models](/5.-select-pick-the-model/byok-custom-models.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.layerlens.ai/more-in-this-section-2/compliance-1.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.